Don-themes vulnerabilities

We track 8 vulnerabilities in Don-themes products across 6 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on March 25, 2026.

8vulnerabilities

2critical

6high

0exploited

8.1average CVSS score

Latest Don-themes vulnerabilities

7.1 High severity
Molla: Improper Neutralization of Input During Web Page Generation
CVE-2026-32529Mar 25, 2026Don-themes
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in don-themes Molla molla allows Reflected XSS.This issue affects Molla: from n/a through < 1.5.19.
7.1 High severity
Riode: Improper Neutralization of Input During Web Page Generation
CVE-2026-32528Mar 25, 2026Don-themes
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in don-themes Riode riode allows Reflected XSS.This issue affects Riode: from n/a through < 1.6.29.
8.1 High severity
Wolmart: Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2026-22385Mar 5, 2026Don-themes
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in don-themes Wolmart wolmart allows PHP Local File Inclusion.This issue affects Wolmart: from n/a through <= 1.9.6.
8.1 High severity
Molla: Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2025-69339Mar 5, 2026Don-themes
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in don-themes Molla molla allows PHP Local File Inclusion.This issue affects Molla: from n/a through <= 1.5.16.
9.3 Critical severity
Riode Core: Improper Neutralization of Special Elements used in an SQL Command
CVE-2025-69338Mar 5, 2026Don-themes
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in don-themes Riode Core riode-core allows Blind SQL Injection.This issue affects Riode Core: from n/a through <= 1.6.26.
9.3 Critical severity
Wolmart Core: Improper Neutralization of Special Elements used in an SQL Command
CVE-2025-69337Feb 20, 2026Don-themes
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in don-themes Wolmart Core wolmart-core allows Blind SQL Injection.This issue affects Wolmart Core: from n/a through <= 1.9.6.
8.1 High severity
Riode: Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2025-60071Dec 18, 2025Don-themes
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in don-themes Riode riode allows PHP Local File Inclusion.This issue affects Riode: from n/a through <= 1.6.23.
7.3 High severity
Wolmart | Multi-Vendor Marketplace WooCommerce…: Improper Control of Generation of Code
CVE-2024-13793May 8, 2025Don-themes
The Wolmart | Multi-Vendor Marketplace WooCommerce Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.8.11. This is due to the software allowing users to execute an action that does not properly val