BuddhaThemes vulnerabilities

Products

• WeDesignTech Ultimate Booking Addon 2
• ColorFolio 1
• ColorFolio - Freelance Designer WordPress Theme 1
• HYDRO 1
• Lizza LMS Pro 1
• Neo | Barber Shop WordPress Theme 1

Latest BuddhaThemes CVEs

Newest publication first

1. CVE-2026-94065 WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability

   Published 2026-10-09

   High·CVSS 8.8 EPSS 0.28%

   Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: from n/a through 1.3.

2. CVE-2026-94064 WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability

   Published 2026-10-09

   High·CVSS 8.8 EPSS 0.28%

   Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5.

3. CVE-2026-27096 WordPress ColorFolio - Freelance Designer WordPress Theme theme <= 1.3 - Deserialization of untrusted data vulnerability

   Published 2026-03-19

   High·CVSS 8.1 EPSS 0.33%

   Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3.

4. CVE-2025-69340 WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.3 - Broken Access Control vulnerability

   Published 2026-03-05

   High·CVSS 7.5 EPSS 0.47%

   Missing Authorization vulnerability in BuddhaThemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.3.

5. CVE-2025-13563 Lizza LMS Pro <= 1.0.3 - Unauthenticated Privilege Escalation

   Published 2026-02-19

   Critical·CVSS 9.8 EPSS 0.41%

   The Lizza LMS Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'lizza_lms_pro_register_user_front_end' function not restricting what user roles a user can register with. This makes it possible for unaut...

6. CVE-2025-69341 WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.3 - Broken Access Control vulnerability

   Published 2026-01-06

   Medium·CVSS 5.4 EPSS 0.20%

   Missing Authorization vulnerability in BuddhaThemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through <= 1.0.3.

7. CVE-2025-31428 WordPress HYDRO theme <= 2.8 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2025-06-27

   High·CVSS 7.1 EPSS 0.25%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddhaThemes HYDRO hydro allows Reflected XSS.This issue affects HYDRO: from n/a through <= 2.8.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.