Undsgn uncode vulnerabilities

Latest Undsgn uncode CVEs

Newest publication first

1. CVE-2025-48107 WordPress Uncode theme < 2.9.4.4 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2025-09-26

   High·CVSS 7.1 EPSS 0.25%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in undsgn Uncode uncode allows Reflected XSS.This issue affects Uncode: from n/a through < 2.9.4.4.

2. CVE-2024-13691 Uncode <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary File Read in uncode_recordMedia

   Published 2025-02-18

   Medium·CVSS 6.5 EPSS 0.40%

   The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_recordMedia' function in all versions up to, and including, 2.9.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

3. CVE-2024-13667 Uncode <= 2.9.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via mle-description

   Published 2025-02-18

   Medium·CVSS 5.4 EPSS 0.25%

   The Uncode theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mle-description’ parameter in all versions up to, and including, 2.9.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subsc...

4. CVE-2024-13681 Uncode <= 2.9.1.6 - Unauthenticated Arbitrary File Read in uncode_admin_get_oembed

   Published 2025-02-18

   High·CVSS 7.5 EPSS 0.63%

   The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_admin_get_oembed' function in all versions up to, and including, 2.9.1.6. This makes it possible for unauthenticated attackers to read arbitrary files on the se...

5. CVE-2023-51515 WordPress Uncode Core plugin <= 2.8.8 - Privilege Escalation vulnerability

   Published 2024-04-12

   High·CVSS 8.8 EPSS 0.55%

   Missing Authorization vulnerability in Undsgn Uncode Core allows Privilege Escalation.This issue affects Uncode Core: from n/a through 2.8.8.

6. CVE-2023-51501 WordPress Uncode Core Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-12-28

   Medium·CVSS 6.1 EPSS 0.35%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Undsgn Uncode - Creative & WooCommerce WordPress Theme allows Reflected XSS.This issue affects Uncode - Creative & WooCommerce WordPress Theme: from n/a through 2.8.6.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.