postmagthemes vulnerabilities

Products

• Context Blog 2
• postmagthemes demo import 1

Latest postmagthemes CVEs

Newest publication first

1. CVE-2026-6801 Context Blog <= 1.3.5 - Unauthenticated Sensitive Information Exposure via 'postID' Parameter

   Published 2026-07-11

   Medium·CVSS 5.3 EPSS 0.36%

   The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the context_blog_modal_popup. This makes it possible for unauthenticated attackers to extract the content of password-protected posts.

2. CVE-2025-12074 Context Blog <= 1.2.5 - Unauthenticated Private Post Disclosure

   Published 2026-02-18

   Medium·CVSS 5.3 EPSS 0.38%

   The Context Blog theme for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.5 via the 'context_blog_modal_popup' due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extra...

3. CVE-2022-1540 PostmagThemes Demo <= 1.0.7 - Admin+ Arbitrary File Upload

   Published 2022-12-05

   High·CVSS 7.2 EPSS 1.1%

   The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) leading to RCE.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.