QuanticaLabs vulnerabilities

Products

• MediCenter - Health Medical Clinic 3
• Cost Calculator 2
• CSS3 Accordions for WordPress 2
• CSS3 Compare Pricing Tables for WordPress 2
• Car Park Booking System for WordPress 1
• CSS3 Vertical Web Pricing Tables 1
• GymBase Theme Classes 1
• Pressroom 1
• timetable responsive schedule 1

Latest QuanticaLabs CVEs

Newest publication first

1. CVE-2026-28137 WordPress MediCenter - Health Medical Clinic WordPress Theme theme <= 14.9 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2026-03-05

   High·CVSS 7.1

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Reflected XSS.This issue affects MediCenter - Health Medical Clinic: from n/a through <= 14.9.

2. CVE-2025-54014 WordPress MediCenter - Health Medical Clinic <= 15.1 - PHP Object Injection Vulnerability

   Published 2025-08-20

   Critical·CVSS 9.8

   Deserialization of Untrusted Data vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Object Injection.This issue affects MediCenter - Health Medical Clinic: from n/a through <= 15.1.

3. CVE-2025-54046 WordPress Cost Calculator Plugin <= 7.4 - Cross Site Scripting (XSS) Vulnerability

   Published 2025-08-20

   Medium·CVSS 6.5

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs Cost Calculator ql-cost-calculator allows Stored XSS.This issue affects Cost Calculator: from n/a through <= 7.4.

4. CVE-2025-47554 WordPress CSS3 Compare Pricing Tables for WordPress plugin <= 11.6 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2025-07-16

   High·CVSS 7.1

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs CSS3 Compare Pricing Tables for WordPress css3_web_pricing_tables_grids allows Reflected XSS.This issue affects CSS3 Compare Pricing Tables for WordPress: from n/a t...

5. CVE-2025-54047 WordPress Cost Calculator plugin <= 7.4 - Broken Access Control Vulnerability

   Published 2025-07-16

   Medium·CVSS 4.3

   Missing Authorization vulnerability in QuanticaLabs Cost Calculator ql-cost-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost Calculator: from n/a through <= 7.4.

6. CVE-2025-54026 WordPress GymBase Theme Classes plugin <= 1.4 - SQL Injection Vulnerability

   Published 2025-07-16

   High·CVSS 8.5

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in QuanticaLabs GymBase Theme Classes gymbase_classes allows SQL Injection.This issue affects GymBase Theme Classes: from n/a through <= 1.4.

7. CVE-2025-32311 WordPress Pressroom theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2025-07-04

   High·CVSS 7.1

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs Pressroom pressroom allows Reflected XSS.This issue affects Pressroom: from n/a through <= 7.0.

8. CVE-2025-52727 WordPress CSS3 Vertical Web Pricing Tables plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerability

   Published 2025-06-27

   High·CVSS 7.1

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs CSS3 Vertical Web Pricing Tables css3_vertical_web_pricing_tables allows Reflected XSS.This issue affects CSS3 Vertical Web Pricing Tables: from n/a through <= 1.9.

9. CVE-2025-39376 WordPress Car Park Booking System for WordPress plugin <= 2.6 - Broken Access Control vulnerability

   Published 2025-05-19

   Medium·CVSS 4.3

   Missing Authorization vulnerability in QuanticaLabs Car Park Booking System for WordPress car-park-booking-system-for-wordpress.This issue affects Car Park Booking System for WordPress: from n/a through <= 2.6.

10. CVE-2025-31923 WordPress CSS3 Accordions for WordPress plugin <= 3.0 - Broken Access Control Vulnerability

    Published 2025-05-16

    Medium·CVSS 5.4

    Missing Authorization vulnerability in QuanticaLabs CSS3 Accordions for WordPress css3_accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CSS3 Accordions for WordPress: from n/a through <= 3.0.

11. CVE-2025-31922 WordPress CSS3 Accordions for WordPress plugin <= 3.0 - CSRF to Stored XSS vulnerability

    Published 2025-05-16

    High·CVSS 7.1

    Cross-Site Request Forgery (CSRF) vulnerability in QuanticaLabs CSS3 Accordions for WordPress css3_accordions allows Stored XSS.This issue affects CSS3 Accordions for WordPress: from n/a through <= 3.0.

12. CVE-2025-47556 WordPress CSS3 Compare Pricing Tables for WordPress plugin <= 11.6 - Broken Access Control Vulnerability

    Published 2025-05-16

    Medium·CVSS 5.4

    Missing Authorization vulnerability in QuanticaLabs CSS3 Compare Pricing Tables for WordPress css3_web_pricing_tables_grids allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CSS3 Compare Pricing Tables for WordPress: from n/a through <= 11...

13. CVE-2025-27013 WordPress MediCenter theme < 14.7 - Sensitive Data Exposure vulnerability

    Published 2025-02-18

    Medium·CVSS 5.3

    Missing Authorization vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MediCenter - Health Medical Clinic: from n/a through < 14.7.

14. CVE-2018-6583 SQL Injection exists in the Timetable Responsive Schedule 1.5 component for Joomla! via a view=event&alias= request.

    Published 2018-02-17

    Critical·CVSS 9.8 EPSS 19.2%

    SQL Injection exists in the Timetable Responsive Schedule 1.5 component for Joomla! via a view=event&alias= request.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.