Colorway Vulnerabilities

Multiple plugins andthemes for WordPress by inkthemes are vulnerable to Sensitive Information Exposure in various versions. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

CVSS:

5.3

Affected:

up to 4.2.3

Fix:

No patched version reported

Disclosed:

Sep 12, 2025

CVE-2025-59003 on NVD →

The ColorWay Theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.2.3. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknown action granted they can trick a site administrator...

CVSS:

4.3

Affected:

up to 4.2.3

Fix:

No patched version reported

Disclosed:

Feb 8, 2023

CVE-2023-25447 on NVD →

Multiple themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'id' parameter found in the '[different-value]_customizer_notify_dismiss_action' and '[different-value]_customizer_notify_dismiss_recommended_plugins' AJAX actions in various versions due to insufficient input sanitization and output...

CVSS:

6.1

Affected:

up to *

Fix:

No patched version reported

Disclosed:

Feb 14, 2022

The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter.

CVSS:

6.1

Affected:

up to 3.4.1

Fixed in:

3.4.2

Disclosed:

Jul 1, 2016

CVE-2016-10961 on NVD →