MVPThemes vulnerabilities

Products

• zoxpress 2
• ZoxPress - The All-In-One WordPress News Theme 2
• click mag 1
• Click Mag - Viral WordPress News Magazine/Blog Theme 1
• Flex Mag - Responsive WordPress News Theme 1
• Jawn 1
• Reviewer 1
• The League 1
• Zox News 1
• Zox News - Professional WordPress News & Magazine Theme 1

Latest MVPThemes CVEs

Newest publication first

1. CVE-2026-66648 WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability

   Published 2026-08-24

   Critical·CVSS 9.8 EPSS 0.48%

   Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.

2. CVE-2026-66658 WordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerability

   Published 2026-08-13

   High·CVSS 8.5 EPSS 0.36%

   Subscriber SQL Injection in Reviewer <= 3.14.2 versions.

3. CVE-2026-25454 WordPress The League theme <= 4.4.1 - Broken Access Control vulnerability

   Published 2026-03-25

   Medium·CVSS 6.5 EPSS 0.35%

   Missing Authorization vulnerability in MVPThemes The League the-league allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The League: from n/a through <= 4.4.1.

4. CVE-2024-13655 Flex Mag - Responsive WordPress News Theme <= 3.5.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Deletion

   Published 2025-03-07

   High·CVSS 8.1 EPSS 0.34%

   The Flex Mag - Responsive WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the propanel_of_ajax_callback() function in all versions up to, and including, 3.5.2. Th...

5. CVE-2024-13654 ZoxPress - The All-In-One WordPress News Theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion

   Published 2025-02-12

   High·CVSS 8.1 EPSS 0.42%

   The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'reset_options' function in all versions up to, and including, 2.12.0. This make...

6. CVE-2024-13656 Click Mag - Viral WordPress News Magazine/Blog Theme <= 3.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion

   Published 2025-02-12

   High·CVSS 8.1 EPSS 0.46%

   The Click Mag - Viral WordPress News Magazine/Blog Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the propanel_of_ajax_callback() function in all versions up to, and including,...

7. CVE-2024-13653 ZoxPress - The All-In-One WordPress News Theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

   Published 2025-02-12

   High·CVSS 8.8 EPSS 0.52%

   The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'backup_options' and 'restore_options' functions in all versions up to, and inc...

8. CVE-2024-13643 Zox News <= 3.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Modification

   Published 2025-02-11

   High·CVSS 8.8 EPSS 0.64%

   The Zox News - Professional WordPress News & Magazine Theme plugin for WordPress is vulnerable to unauthorized data modification. This vulnerability can lead to privilege escalation and denial of service conditions due to missing capability checks on the backup_options() and rese...

9. CVE-2024-11936 Zox News <= 3.16.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

   Published 2025-01-26

   High·CVSS 8.8 EPSS 0.38%

   The Zox News theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'backup_options' and 'restore_options' function in all versions up to, and including, 3.16.0. This makes it possible...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.