Big Store Vulnerabilities

The Big Store theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.0.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 2.0.8

Fixed in:

2.0.9

Disclosed:

Mar 27, 2025

CVE-2025-30881 on NVD →

The Big Store plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.9.3. This is due to missing or incorrect nonce validation on the default_home and th_activeplugin functions. This makes it possible for unauthenticated attackers to activate arbitrary plugins via a forged...

CVSS:

4.3

Affected:

up to 1.9.3

Fixed in:

1.9.4

Disclosed:

Mar 5, 2023

CVE-2023-27431 on NVD →