theme

Oxygen Vulnerabilities

2 known security issues reported for the Oxygen WordPress theme. Most recent disclosed Mar 27, 2026.

2 high

Running Oxygen on your site? Check whether your installed version is affected.

Scan your site free

Oxygen <= 6.0.8 - Unauthenticated Server-Side Request Forgery via route_path

high

The Oxygen Theme theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.8 via the laborator_calc_route AJAX action. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to...

CVSS:
7.2
Affected:
up to 6.0.8
Fixed in:
6.0.9
Disclosed:
Mar 27, 2026

CVE-2025-12886 on NVD →

Oxygen <= 6.0.8 - Unauthenticated Server-Side Request Forgery

high

The Oxygen theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.8. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal s...

CVSS:
7.2
Affected:
up to 6.0.8
Fix:
No patched version reported
Disclosed:
Jan 27, 2026

CVE-2025-69299 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database