sizam vulnerabilities

Products

• REHub Framework 4
• Rehub 3
• REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme 2
• RH Frontend Publishing Pro 1

Latest sizam CVEs

Newest publication first

1. CVE-2026-28126 WordPress RH Frontend Publishing Pro plugin < 4.3.4 - Cross Site Scripting (XSS) vulnerability

   Published 2026-03-05

   High·CVSS 7.1 EPSS 0.17%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam RH Frontend Publishing Pro rh-frontend allows Reflected XSS.This issue affects RH Frontend Publishing Pro: from n/a through < 4.3.4.

2. CVE-2025-63051 WordPress REHub Framework plugin < 19.9.9.4 - Sensitive Data Exposure vulnerability

   Published 2026-01-22

   Medium·CVSS 4.3 EPSS 0.35%

   Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam REHub Framework rehub-framework allows Retrieve Embedded Sensitive Data.This issue affects REHub Framework: from n/a through < 19.9.9.4.

3. CVE-2025-14358 WordPress REHub Framework plugin <= 19.9.5 - Broken Access Control vulnerability

   Published 2026-01-08

   High·CVSS 7.5 EPSS 0.34%

   Missing Authorization vulnerability in sizam REHub Framework rehub-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects REHub Framework: from n/a through <= 19.9.5.

4. CVE-2025-63050 WordPress REHub Framework plugin < 19.9.9.7 - Cross Site Scripting (XSS) vulnerability

   Published 2025-12-09

   Medium·CVSS 6.5 EPSS 0.25%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam REHub Framework rehub-framework allows Stored XSS.This issue affects REHub Framework: from n/a through < 19.9.9.7.

5. CVE-2025-67565 WordPress Rehub theme <= 19.9.9.1 - Sensitive Data Exposure vulnerability

   Published 2025-12-09

   Medium·CVSS 5.3 EPSS 0.31%

   Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam Rehub rehub-theme allows Retrieve Embedded Sensitive Data.This issue affects Rehub: from n/a through <= 19.9.9.1.

6. CVE-2025-64197 WordPress Rehub theme < 19.9.9.1 - Cross Site Scripting (XSS) vulnerability

   Published 2025-10-29

   Medium·CVSS 6.5 EPSS 0.20%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam Rehub rehub-theme allows Stored XSS.This issue affects Rehub: from n/a through < 19.9.9.1.

7. CVE-2025-7368 Rehub <= 19.9.7 - Unauthenticated Password Protected Post Disclosure

   Published 2025-09-06

   Medium·CVSS 5.3 EPSS 0.27%

   The REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme theme for WordPress is vulnerable to Information Exposure in all versions up to, and including, 19.9.7 via the 'ajax_action_re_getfullcontent' function due to insufficient restrictions on which posts can be in...

8. CVE-2025-7366 Rehub <= 19.9.7 - Unauthenticated Arbitrary Shortcode Execution via re_filterpost

   Published 2025-09-06

   High·CVSS 7.3 EPSS 0.36%

   The The REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 19.9.7. This is due to the software allowing users to execute an action that does not properly valid...

9. CVE-2024-31233 WordPress Rehub theme <= 19.6.1 - Auth. SQL Injection vulnerability

   Published 2024-04-07

   High·CVSS 8.5 EPSS 0.52%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sizam Rehub.This issue affects Rehub: from n/a through 19.6.1.

10. CVE-2024-31234 WordPress REHub Framework plugin < 19.6.2 - SQL Injection vulnerability

    Published 2024-04-07

    High·CVSS 8.5 EPSS 0.50%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sizam REHub Framework.This issue affects REHub Framework: from n/a before 19.6.2.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.