TeconceTheme vulnerabilities

Products

• Mayosis Core 3
• Allmart 2
• Coven Core 1
• Crete Core 1
• Electio Core 1
• Emerce Core 1
• Medinik Core 1
• Nestbyte Core 1
• Nikstore Core 1
• Saasplate Core 1
• Uroan Core 1
• Woodly Core 1

Latest TeconceTheme CVEs

Newest publication first

1. CVE-2026-73388 WordPress Nikstore Core plugin <= 1.5 - SQL Injection vulnerability

   Published 2026-08-19

   Critical·CVSS 9.3 EPSS 0.40%

   Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions.

2. CVE-2026-32333 WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2026-08-18

   High·CVSS 7.1 EPSS 0.25%

   Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.

3. CVE-2026-39655 WordPress Mayosis Core plugin <= 5.4.7 - Broken Access Control vulnerability

   Published 2026-05-26

   Medium·CVSS 5.3 EPSS 0.23%

   Missing Authorization vulnerability in TeconceTheme Mayosis Core allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Mayosis Core: from n/a through 5.4.7.

4. CVE-2025-69366 WordPress Emerce Core plugin <= 1.8 - SQL Injection vulnerability

   Published 2026-02-20

   Critical·CVSS 9.3 EPSS 0.43%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Emerce Core emerce-core allows Blind SQL Injection.This issue affects Emerce Core: from n/a through <= 1.8.

5. CVE-2025-69365 WordPress Uroan Core plugin <= 1.4.4 - SQL Injection vulnerability

   Published 2026-02-20

   Critical·CVSS 9.3 EPSS 0.33%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Uroan Core uroan-core allows Blind SQL Injection.This issue affects Uroan Core: from n/a through <= 1.4.4.

6. CVE-2025-69309 WordPress Saasplate Core plugin <= 1.2.8 - SQL Injection vulnerability

   Published 2026-02-20

   Critical·CVSS 9.3 EPSS 0.33%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Saasplate Core saasplate-core allows Blind SQL Injection.This issue affects Saasplate Core: from n/a through <= 1.2.8.

7. CVE-2025-69310 WordPress Woodly Core plugin <= 1.4 - SQL Injection vulnerability

   Published 2026-02-20

   Critical·CVSS 9.3 EPSS 0.33%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Woodly Core woodly-core allows Blind SQL Injection.This issue affects Woodly Core: from n/a through <= 1.4.

8. CVE-2025-69308 WordPress Nestbyte Core plugin <= 1.2 - SQL Injection vulnerability

   Published 2026-02-20

   Critical·CVSS 9.3 EPSS 0.33%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Nestbyte Core nestbyte-core allows Blind SQL Injection.This issue affects Nestbyte Core: from n/a through <= 1.2.

9. CVE-2025-69307 WordPress Medinik Core plugin <= 1.3.6 - SQL Injection vulnerability

   Published 2026-02-20

   Critical·CVSS 9.3 EPSS 0.33%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Medinik Core medinik-core allows Blind SQL Injection.This issue affects Medinik Core: from n/a through <= 1.3.6.

10. CVE-2025-69306 WordPress Electio Core plugin <= 1.4 - SQL Injection vulnerability

    Published 2026-02-20

    Critical·CVSS 9.3 EPSS 0.33%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Electio Core electio-core allows Blind SQL Injection.This issue affects Electio Core: from n/a through <= 1.4.

11. CVE-2025-69305 WordPress Crete Core plugin <= 1.4.3 - SQL Injection vulnerability

    Published 2026-02-20

    Critical·CVSS 9.3 EPSS 0.43%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Crete Core crete-core allows Blind SQL Injection.This issue affects Crete Core: from n/a through <= 1.4.3.

12. CVE-2025-69304 WordPress Allmart plugin <= 1.1 - SQL Injection vulnerability

    Published 2026-02-20

    Critical·CVSS 9.3 EPSS 0.45%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Allmart allmart-core allows Blind SQL Injection.This issue affects Allmart: from n/a through <= 1.1.

13. CVE-2025-69295 WordPress Coven Core plugin <= 1.3 - SQL Injection vulnerability

    Published 2026-02-20

    Critical·CVSS 9.3 EPSS 0.48%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Coven Core coven-core allows Blind SQL Injection.This issue affects Coven Core: from n/a through <= 1.3.

14. CVE-2025-49418 WordPress Allmart plugin <= 1.0.0 - Server Side Request Forgery (SSRF) Vulnerability

    Published 2025-07-04

    High·CVSS 7.2 EPSS 0.22%

    Server-Side Request Forgery (SSRF) vulnerability in TeconceTheme Allmart allmart-core allows Server Side Request Forgery.This issue affects Allmart: from n/a through <= 1.0.0.

15. CVE-2025-1565 Mayosis Core <= 5.4.1 - Unauthenticated Arbitrary File Read

    Published 2025-04-25

    High·CVSS 7.5 EPSS 0.56%

    The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 via the library/wave-audio/peaks/remote_dl.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server,...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.