TangibleWP vulnerabilities
We track 4 vulnerabilities in TangibleWP products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 30, 2026.
Latest TangibleWP vulnerabilities
- 9.8 Critical severity
MyHome Core: Authentication Bypass by Alternate Name
The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This makes i
- 8.1 High severity
Listivo Core: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TangibleWP Listivo Core listivo-core allows PHP Local File Inclusion.This issue affects Listivo Core: from n/a through <= 2.3.77.
- 7.5 High severity
MyHome Core: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TangibleWP MyHome Core myhome-core allows PHP Local File Inclusion.This issue affects MyHome Core: from n/a through <= 4.1.0.
- 8.8 High severity
Vehica Core: Improper Privilege Management
The Vehica Core plugin for WordPress, used by the Vehica - Car Dealer & Listing WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 1.0.97. This is due to the plugin not properly validating user meta fields prior to upd