looswebstudio vulnerabilities

Products

• Arkhe 1
• Highlighting Code Block 1
• SEO SIMPLE PACK 1

Latest looswebstudio CVEs

Newest publication first

1. CVE-2026-12108 Highlighting Code Block <= 2.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'font_family' Setting

   Published 2026-07-10

   Medium·CVSS 4.4 EPSS 0.34%

   The Highlighting Code Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with admini...

2. CVE-2025-26748 WordPress Arkhe theme <= 3.12.0 - CSRF to Local File Inclusion vulnerability

   Published 2025-04-15

   High·CVSS 8.1 EPSS 0.32%

   Cross-Site Request Forgery (CSRF) vulnerability in looswebstudio Arkhe arkhe allows PHP Local File Inclusion.This issue affects Arkhe: from n/a through <= 3.12.0.

3. CVE-2024-2795 SEO SIMPLE PACK <= 3.2.1 - Information Exposure

   Published 2024-06-28

   Medium·CVSS 5.3 EPSS 0.54%

   The SEO SIMPLE PACK plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.1 via META description. This makes it possible for unauthenticated attackers to extract limited information about password protected posts.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.