Bearsthemes vulnerabilities
We track 6 vulnerabilities in Bearsthemes products across 4 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on February 26, 2026.
Latest Bearsthemes vulnerabilities
- 8.8 High severity
Worry Proof Backup: Improper Limitation of a Pathname to a Restricted Directory
The Worry Proof Backup plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.2.4 via the backup upload functionality. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload a
- 9.8 Critical severity
Goza - Nonprofit Charity WordPress Theme: Missing Authorization
The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to unauthorized arbitrary file uploads due to a missing capability check on the 'beplus_import_pack_install_plugin' function in all versions up to, and including, 3.2.2. This makes
- 9.1 Critical severity
Goza - Nonprofit Charity WordPress Theme: External Control of File Name or Path
The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 3.2.2. This makes it possi
- 9.8 Critical severity
Bears Backup: Improper Control of Generation of Code
The Bears Backup plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.0. This is due to the bbackup_ajax_handle() function not having a capability check, nor validating user supplied input passed directly to cal
- 9.8 Critical severity
Alone – Charity Multipurpose Non-profit…: Missing Authorization
The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() function in all versions up to, and including, 7.8.3. This makes
- 9.1 Critical severity
Alone – Charity Multipurpose Non-profit…: External Control of File Name or Path
The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 7.8.5. This