PureThemes vulnerabilities

We track 9 vulnerabilities in PureThemes products across 4 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on July 13, 2026.

9vulnerabilities

1critical

8high

0exploited

7.9average CVSS score

Latest PureThemes vulnerabilities

8.8 High severity
WorkScout-Core: Cross-Site Request Forgery
CVE-2026-57786Jul 13, 2026PureThemes
Cross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core workscout-core allows Authentication Bypass.This issue affects WorkScout-Core: from n/a through <= 1.7.08.
7.1 High severity
Listeo Core: Improper Neutralization of Input During Web Page Generation
CVE-2026-25461Mar 25, 2026PureThemes
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes Listeo Core listeo-core allows Reflected XSS.This issue affects Listeo Core: from n/a through <= 2.0.21.
7.1 High severity
WorkScout-Core: Improper Neutralization of Input During Web Page Generation
CVE-2025-67960Jan 22, 2026PureThemes
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout-Core workscout-core allows Reflected XSS.This issue affects WorkScout-Core: from n/a through <= 1.7.06.
7.1 High severity
WorkScout: Improper Neutralization of Input During Web Page Generation
CVE-2025-67959Jan 22, 2026PureThemes
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout workscout allows Reflected XSS.This issue affects WorkScout: from n/a through <= 4.1.07.
7.1 High severity
Listeo Core: Improper Neutralization of Input During Web Page Generation
CVE-2025-67932Jan 8, 2026PureThemes
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes Listeo Core listeo-core allows Reflected XSS.This issue affects Listeo Core: from n/a through < 2.0.19.
7.1 High severity
WorkScout-Core: Improper Neutralization of Input During Web Page Generation
CVE-2025-59571Oct 22, 2025PureThemes
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes WorkScout-Core workscout-core allows Reflected XSS.This issue affects WorkScout-Core: from n/a through < 1.7.06.
8.8 High severity
WorkScout-Core: Cross-Site Request Forgery
CVE-2025-59572Sep 22, 2025PureThemes
Cross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core workscout-core allows Cross Site Request Forgery.This issue affects WorkScout-Core: from n/a through < 1.7.06.
8.5 High severity
Listeo Core: Improper Neutralization of Special Elements used in an SQL Command
CVE-2025-49404Aug 28, 2025PureThemes
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in purethemes Listeo Core listeo-core allows SQL Injection.This issue affects Listeo Core: from n/a through < 2.0.7.
9.8 Critical severity
Realteo: Improper Privilege Management
CVE-2025-2232Mar 14, 2025PureThemes
The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, and including, 1.2.8. This is due to insufficient role restrictions in the 'do_register_user' function.