BZOTheme vulnerabilities

We track 9 vulnerabilities in BZOTheme products across 9 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on January 22, 2026.

9vulnerabilities

0critical

9high

0exploited

8.1average CVSS score

Latest BZOTheme vulnerabilities

8.1 High severity
Mella: Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2025-67616Jan 22, 2026BZOTheme
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Mella mella allows PHP Local File Inclusion.This issue affects Mella: from n/a through <= 1.2.29.
8.1 High severity
Monki: Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2025-53436Dec 18, 2025BZOTheme
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Monki monki allows PHP Local File Inclusion.This issue affects Monki: from n/a through <= 2.0.5.
8.1 High severity
PrintXtore: Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2025-28946Jun 27, 2025BZOTheme
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme PrintXtore bw-printxtore allows PHP Local File Inclusion.This issue affects PrintXtore: from n/a through < 1.7.8.
8.1 High severity
Zenny: Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2025-24769Jun 27, 2025BZOTheme
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Zenny bw-zenny allows PHP Local File Inclusion.This issue affects Zenny: from n/a through <= 1.7.5.
8.1 High severity
Zagg - Electronics & Accessories WooCommerce…: Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2025-4200Jun 14, 2025BZOTheme
The Zagg - Electronics & Accessories WooCommerce WordPress Theme theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.1 via the load_view() function that is called via at least three AJAX actions: 'load_more_post'
8.1 High severity
GiftXtore: Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2025-28888Jun 9, 2025BZOTheme
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme GiftXtore bw-giftxtore allows PHP Local File Inclusion.This issue affects GiftXtore: from n/a through < 1.7.7.
8.1 High severity
Petito: Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2025-27362Jun 9, 2025BZOTheme
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Petito bw-petito allows PHP Local File Inclusion.This issue affects Petito: from n/a through < 1.6.6.
8.1 High severity
CraftXtore: Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2025-24770Jun 9, 2025BZOTheme
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme CraftXtore bw-craftxtore allows PHP Local File Inclusion.This issue affects CraftXtore: from n/a through <= 1.7.
8.1 High severity
Fitrush: Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2023-26005Jun 9, 2025BZOTheme
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Fitrush allows PHP Local File Inclusion. This issue affects Fitrush: from n/a through 1.3.4.