Kalium Vulnerabilities

The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the kalium_vc_contact_form_request() function in all versions up to, and including, 3.29. This makes it possible for unauthenticated attackers to use the theme an an...

CVSS:

5.3

Affected:

up to 3.29

Fixed in:

3.30

Disclosed:

Jan 15, 2026

CVE-2025-12895 on NVD →

[en] The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the kalium_vc_contact_form_request() function in all versions up to, and including, 3.29. This makes it possible for unauthenticated attackers to use the theme...

Affected:

up to 3.30

Fixed in:

3.30

Disclosed:

Jan 15, 2026

CVE-2025-12895 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Laborator Kalium kalium allows Reflected XSS.This issue affects Kalium: from n/a through <= 3.18.3.

Affected:

up to 3.18.3

Fix:

No patched version reported

Disclosed:

Nov 6, 2025

CVE-2025-53349 on NVD →

[en] Improper Control of Generation of Code ('Code Injection') vulnerability in Laborator Kalium kalium allows Code Injection.This issue affects Kalium: from n/a through <= 3.25.

Affected:

up to 3.25

Fix:

No patched version reported

Disclosed:

Oct 22, 2025

CVE-2025-49926 on NVD →

[en] Missing Authorization vulnerability in Laborator Kalium. This issue affects Kalium: from n/a through 3.18.3.

Affected:

up to 3.18.3

Fix:

No patched version reported

Disclosed:

Sep 9, 2025

CVE-2025-53348 on NVD →

The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.18.3. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 3.18.3

Fixed in:

3.19

Disclosed:

Aug 21, 2025

CVE-2025-53348 on NVD →

The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.18.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action g...

CVSS:

4.3

Affected:

up to 3.18.3

Fixed in:

3.19

Disclosed:

Aug 14, 2025

CVE-2025-53347 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Laborator Kalium allows Cross Site Request Forgery. This issue affects Kalium: from n/a through 3.18.3.

Affected:

up to 3.18.3

Fix:

No patched version reported

Disclosed:

Aug 14, 2025

CVE-2025-53347 on NVD →

The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.25. This makes it possible for unauthenticated attackers to execute code on the server.

CVSS:

9.8

Affected:

up to 3.25

Fixed in:

3.26

Disclosed:

Jun 19, 2025

CVE-2025-49926 on NVD →

The Kalium theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.18.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a...

CVSS:

6.1

Affected:

up to 3.18.3

Fixed in:

3.19

Disclosed:

Jan 4, 2025

CVE-2025-53349 on NVD →