KlbTheme vulnerabilities

Products

• Total Donations 3
• Bacola theme 1
• Bacola theme (core plugin) 1
• Clotya theme 1
• Clotya theme (core plugin) 1
• Cosmetsy theme 1
• Cosmetsy theme (core plugin) 1
• Furnob theme 1
• Furnob theme (core plugin) 1
• Machic Core 1
• Machic theme 1
• Medibazar theme 1
• Medibazar theme (core plugin) 1
• Partdo theme 1
• Partdo theme (core plugin) 1

Latest KlbTheme CVEs

Newest publication first

1. CVE-2026-94159 WordPress Total Donations plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-09

   High·CVSS 7.1

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Total Donations totaldonations allows Stored XSS.This issue affects Total Donations: from n/a through 2.0.5.

2. CVE-2026-73391 WordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerability

   Published 2026-08-19

   Critical·CVSS 9.3

   Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.

3. CVE-2026-73390 WordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability

   Published 2026-08-19

   Critical·CVSS 9.8

   Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.

4. CVE-2023-49186 WordPress Machic Core plugin <= 1.2.6 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2026-01-05

   High·CVSS 7.1

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in KlbTheme Machic Core allows DOM-Based XSS.This issue affects Machic Core: from n/a through 1.2.6.

5. CVE-2023-49838 Cross-Site Request Forgery (CSRF) vulnerability in multiple themes by KlbTheme

   Published 2024-03-26

   Medium·CVSS 4.3

   Cross-Site Request Forgery (CSRF) vulnerability in KlbTheme Clotya theme, KlbTheme Cosmetsy theme, KlbTheme Furnob theme, KlbTheme Bacola theme, KlbTheme Partdo theme, KlbTheme Medibazar theme, KlbTheme Machic theme.This issue affects Clotya theme: from n/a through 1.1.6; Cosmets...

6. CVE-2023-49839 Reflected Cross-Site Scripting vulnerability in multiple WordPress components by KlbTheme

   Published 2024-03-26

   High·CVSS 7.1

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Cosmetsy theme (core plugin), KlbTheme Partdo theme (core plugin), KlbTheme Bacola theme (core plugin), KlbTheme Medibazar theme (core plugin), KlbTheme Furnob theme (co...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.