Photobox Vulnerabilities

Multiple themes for WordPress by Themify Themes are vulnerable to arbitrary file uploads due to missing file type validation in various versions. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote cod...

CVSS:

8.8

Affected:

up to 2.0.1

Fix:

No patched version reported

Disclosed:

Apr 1, 2025

CVE-2025-30996 on NVD →

Multiple themes for WordPress by Themify Themes are vulnerable to Reflected Cross-Site Scripting in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a use...

CVSS:

6.1

Affected:

up to 2.0.1

Fix:

No patched version reported

Disclosed:

Apr 1, 2025

CVE-2025-31013 on NVD →

Update the theme. DevilScreaM discovered and reported this Arbitrary File Upload vulnerability in WordPress Photobox Theme. This could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website. This vulnerability has be...

Affected:

up to 1.1

Fixed in:

1.1

Disclosed:

Aug 1, 2023

A "themify-ajax.php" file upload arbitrary PHP code execution vulnerability was found in WordPress Photobox theme. Update the theme.

Affected:

up to 1.1

Fixed in:

1.1

Disclosed:

Aug 1, 2014

Affected:

up to 2.0.1

Fix:

No patched version reported

CVE-2025-31013 on NVD →

Affected:

up to 2.0.1

Fix:

No patched version reported

CVE-2025-30996 on NVD →