Photome Vulnerabilities

The PhotoMe theme for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an inj...

CVSS:

7.2

Affected:

up to 5.7.1

Fixed in:

5.7.2

Disclosed:

Feb 3, 2026

CVE-2026-24949 on NVD →

The PhotoMe theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 5.6.11 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an a...

CVSS:

8.1

Affected:

up to 5.6.11

Fix:

No patched version reported

Disclosed:

Jan 27, 2026

CVE-2025-69301 on NVD →

The PhotoMe | Photography Portfolio WordPress theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 5.7.2 (exclusive). This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and mod...

CVSS:

7.2

Affected:

up to 5.7.2

Fixed in:

5.7.2

Disclosed:

Jan 2, 2026

CVE-2026-24381 on NVD →