Paper/Archive/CVE-2025-30996

CVE-2025-30996

Themify Themify Sidepane WordPress Theme — Arbitrary File Upload Vulnerability in WordPress themes by Themify

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 43.5.435 × 208.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themify Bloggie, Themify Photobox, Themify Wigi, Themify Rezo, Themify Slide allows Upload a Web Shell to a Web Server.This issue affects Themify Sidepane WordPress Theme: from n/a through 1.9.8; Themify Newsy: from n/a through 1.9.9; Themify Folo: from n/a through 1.9.6; Themify Edmin: from n/a through 2.0.0; Bloggie: from n/a through 2.0.8; Photobox: from n/a through 2.0.1; Wigi: from n/a through 2.0.1; Rezo: from n/a through 1.9.7; Slide: from n/a through 1.7.5.

Affected

ProductAffectedFixed inSource

Themify Sidepane WordPress Themen/a – 1.9.8–CNA

Themify Newsyn/a – 1.9.9–CNA

Themify Folon/a – 1.9.6–CNA

Themify Edminn/a – 2.0.0–CNA

Bloggien/a – 2.0.8–CNA

Photoboxn/a – 2.0.1–CNA

Wigin/a – 2.0.1–CNA

Rezon/a – 1.9.7–CNA

Sliden/a – 1.7.5–CNA

Scores by source

Patchstack (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References