SeventhQueen vulnerabilities

Products

• Kleo 3
• K Elements 2
• Sweet Date 2
• BuddyApp 1
• Restrictions for BuddyPress 1
• SweetDate Core 1
• Typer Core 1

Latest SeventhQueen CVEs

Newest publication first

1. CVE-2025-69140 WordPress SweetDate Core plugin < 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2026-06-17

   High·CVSS 7.1 EPSS 0.18%

   Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions.

2. CVE-2026-27417 WordPress Sweet Date theme < 4.0.1 - PHP Object Injection vulnerability

   Published 2026-03-05

   Critical·CVSS 9.8 EPSS 0.45%

   Deserialization of Untrusted Data vulnerability in SeventhQueen Sweet Date sweetdate allows Object Injection.This issue affects Sweet Date: from n/a through < 4.0.1.

3. CVE-2026-22465 WordPress BuddyApp theme <= 1.9.2 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2026-03-05

   High·CVSS 7.1 EPSS 0.28%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeventhQueen BuddyApp buddyapp allows Reflected XSS.This issue affects BuddyApp: from n/a through <= 1.9.2.

4. CVE-2025-12391 Restrictions for BuddyPress <= 1.5.2 - Missing Authorization to Unauthenticated Tracking Status Update

   Published 2025-11-18

   Medium·CVSS 5.3 EPSS 0.29%

   The Restrictions for BuddyPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_optin_optout() function in all versions up to, and including, 1.5.2. This makes it possible for unauthenticated attackers to opt...

5. CVE-2025-64363 WordPress Kleo theme < 5.5.0 - Local File Inclusion vulnerability

   Published 2025-10-31

   High·CVSS 7.5 EPSS 0.42%

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SeventhQueen Kleo kleo allows PHP Local File Inclusion.This issue affects Kleo: from n/a through < 5.5.0.

6. CVE-2025-64362 WordPress K Elements plugin < 5.5.0 - Cross Site Scripting (XSS) vulnerability

   Published 2025-10-31

   Medium·CVSS 6.5 EPSS 0.17%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeventhQueen K Elements k-elements allows DOM-Based XSS.This issue affects K Elements: from n/a through < 5.5.0.

7. CVE-2025-39367 WordPress Kleo theme < 5.4.4 - Broken Access Control vulnerability

   Published 2025-04-28

   Medium·CVSS 5.3 EPSS 0.29%

   Missing Authorization vulnerability in SeventhQueen Kleo kleo.This issue affects Kleo: from n/a through < 5.4.4.

8. CVE-2024-56000 WordPress K Elements plugin < 5.4.0 - Unauthenticated Account Takeover vulnerability

   Published 2025-02-18

   Critical·CVSS 9.8 EPSS 0.52%

   Incorrect Privilege Assignment vulnerability in SeventhQueen K Elements k-elements allows Privilege Escalation.This issue affects K Elements: from n/a through < 5.4.0.

9. CVE-2024-12102 Typer Core <= 1.9.6 - Authenticated (Contributor+) Post Disclosure

   Published 2025-01-30

   Medium·CVSS 4.3 EPSS 0.32%

   The Typer Core plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.6 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with C...

10. CVE-2024-56209 WordPress Kleo theme < 5.4.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 2024-12-31

    High·CVSS 7.1 EPSS 0.29%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeventhQueen Kleo kleo allows Reflected XSS.This issue affects Kleo: from n/a through < 5.4.4.

11. CVE-2024-43222 WordPress Sweet Date theme <= 3.7.3 - Privilege Escalation vulnerability

    Published 2024-12-09

    Critical·CVSS 9.8 EPSS 0.78%

    Missing Authorization vulnerability in SeventhQueen Sweet Date sweetdate allows Privilege Escalation.This issue affects Sweet Date: from n/a through <= 3.7.3.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.