Ovatheme vulnerabilities

Products

• BRW 3
• Ovatheme Events Manager 3
• Athens 1
• BookPro 1
• Cube Portfolio 1
• eventlist 1
• Ireca 1
• Movie Booking 1
• Ova Advent 1
• Ovatheme Events 1
• Remons 1
• Tripgo 1

Latest Ovatheme CVEs

Newest publication first

1. CVE-2026-27400 WordPress BookPro plugin <= 1.1.0 - Arbitrary File Deletion vulnerability

   Published 2026-06-17

   High·CVSS 8.6 EPSS 0.54%

   Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions.

2. CVE-2026-27093 WordPress Tripgo theme < 1.5.6 - Local File Inclusion vulnerability

   Published 2026-03-19

   High·CVSS 8.1 EPSS 0.36%

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Tripgo tripgo allows PHP Local File Inclusion.This issue affects Tripgo: from n/a through < 1.5.6.

3. CVE-2025-69090 WordPress Remons theme <= 1.3.4 - Local File Inclusion vulnerability

   Published 2026-03-05

   High·CVSS 8.1 EPSS 0.59%

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Remons remons allows PHP Local File Inclusion.This issue affects Remons: from n/a through <= 1.3.4.

4. CVE-2025-67963 WordPress Movie Booking plugin <= 1.1.5 - Arbitrary File Deletion vulnerability

   Published 2026-01-22

   High·CVSS 8.6 EPSS 0.61%

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ovatheme Movie Booking movie-booking allows Path Traversal.This issue affects Movie Booking: from n/a through <= 1.1.5.

5. CVE-2025-49994 WordPress Athens theme <= 1.1.6 - Local File Inclusion vulnerability

   Published 2026-01-22

   High·CVSS 8.1 EPSS 0.62%

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Athens athens allows PHP Local File Inclusion.This issue affects Athens: from n/a through <= 1.1.6.

6. CVE-2025-7663 Ovatheme Events Manager <= 1.8.6 - Missing Authorization

   Published 2025-11-08

   Medium·CVSS 6.5 EPSS 0.22%

   The Ovatheme Events Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the /class-ovaem-ajax.php file in all versions up to, and including, 1.8.6. This makes it possible for unauthenticated attackers to dele...

7. CVE-2025-8561 Ova Advent <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

   Published 2025-10-15

   Medium·CVSS 6.4 EPSS 0.24%

   The Ova Advent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

8. CVE-2025-6553 Ovatheme Events Manager <= 1.8.5 - Unauthenticated Arbitrary File Upload

   Published 2025-10-11

   Critical·CVSS 9.8 EPSS 0.76%

   The Ovatheme Events Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_checkout() function in all versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to upload arbitrary fi...

9. CVE-2025-54716 WordPress Ireca Theme <= 1.8.5 - Local File Inclusion Vulnerability

   Published 2025-08-28

   High·CVSS 8.1 EPSS 0.53%

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Ireca ireca allows PHP Local File Inclusion.This issue affects Ireca: from n/a through <= 1.8.5.

10. CVE-2025-53576 WordPress Ovatheme Events Plugin <= 1.2.8 - Local File Inclusion Vulnerability

    Published 2025-08-28

    High·CVSS 8.1 EPSS 0.54%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Ovatheme Events ova-events allows PHP Local File Inclusion.This issue affects Ovatheme Events: from n/a through <= 1.2.8.

11. CVE-2025-53204 WordPress eventlist plugin <= 1.9.2 - Local File Inclusion Vulnerability

    Published 2025-08-20

    High·CVSS 8.1 EPSS 0.72%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme eventlist eventlist allows PHP Local File Inclusion.This issue affects eventlist: from n/a through <= 1.9.2.

12. CVE-2025-52823 WordPress Cube Portfolio Plugin <= 1.16.8 - SQL Injection Vulnerability

    Published 2025-08-14

    High·CVSS 8.5 EPSS 0.29%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ovatheme Cube Portfolio cubeportfolio allows SQL Injection.This issue affects Cube Portfolio: from n/a through <= 1.16.8.

13. CVE-2025-52814 WordPress BRW plugin <= 1.8.8 - Local File Inclusion Vulnerability

    Published 2025-06-27

    High·CVSS 8.1 EPSS 0.58%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme BRW ova-brw allows PHP Local File Inclusion.This issue affects BRW: from n/a through <= 1.8.7.

14. CVE-2025-32510 WordPress Ovatheme Events Manager plugin <= 1.8.4 - Arbitrary File Upload vulnerability

    Published 2025-06-17

    Critical·CVSS 10.0 EPSS 0.49%

    Unrestricted Upload of File with Dangerous Type vulnerability in ovatheme Ovatheme Events Manager ova-events-manager allows Using Malicious Files.This issue affects Ovatheme Events Manager: from n/a through <= 1.8.4.

15. CVE-2025-49314 WordPress BRW plugin <= 1.8.6 - Cross Site Scripting (XSS) Vulnerability

    Published 2025-06-06

    Medium·CVSS 6.5 EPSS 0.27%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ovatheme BRW ova-brw allows Stored XSS.This issue affects BRW: from n/a through <= 1.8.6.

16. CVE-2025-49313 WordPress BRW plugin <= 1.8.6 - Local File Inclusion Vulnerability

    Published 2025-06-06

    High·CVSS 7.5 EPSS 0.79%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme BRW ova-brw allows PHP Local File Inclusion.This issue affects BRW: from n/a through <= 1.8.6.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.