BoomBox Theme Extensions vulnerabilities

2 known vulnerabilities in BoomBox Theme Extensions from PX-lab. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  BoomBox Theme Extensions: Weak Password Recovery Mechanism for Forgotten Password

  CVE-2024-12295Mar 19, 2025PX-lab

  The BoomBox Theme Extensions plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.8.0. This is due to the plugin not properly validating a user's identity prior to updating their password throu

• 8.8 High severity

  BoomBox Theme Extensions: Improper Control of Filename for Include/Require Statement in PHP Program

  CVE-2024-12859Feb 3, 2025PX-lab

  The BoomBox Theme Extensions plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8.0 via the 'boombox_listing' shortcode 'type' attribute. This makes it possible for authenticated attackers, with contributor-level