Elated-themes vulnerabilities

Products

• Frappe 98
• Search & Go 3
• Aperitif 2
• Askka 2
• Laurent 2
• Måne 2
• Neobeat 2
• Roisin 2
• Sweet Jane 2
• The Aisle 2
• Töbel 2

Newest

• elated-themes frappe Frappe before 16.35.0 Broken Access Control in File List/Report Queries CVE-2026-124443 5.3 MediumNovember 8, 2026
• elated-themes frappe Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload CVE-2026-119145 9.4 CriticalOctober 29, 2026
• elated-themes frappe Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields CVE-2026-119144 8.7 HighOctober 29, 2026
• elated-themes academist core WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability CVE-2026-112820 8.1 HighOctober 22, 2026
• elated-themes frappe Frappe before 16.33.0 Blind SQL Injection via get_events CVE-2026-114664 7.1 HighOctober 22, 2026
• elated-themes frappe Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication CVE-2026-111388 5.3 MediumOctober 16, 2026
• elated-themes frappe Frappe: Possibility of SQL injection in reportview CVE-2026-55823 8.7 HighOctober 13, 2026
• elated-themes frappe Frappe: Open Redirect via Unsanitized OAuth State Param. CVE-2026-66057 5.1 MediumOctober 13, 2026
• elated-themes frappe Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit CVE-2026-109603 4.8 MediumOctober 12, 2026
• elated-themes frappe Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters CVE-2026-109602 5.1 MediumOctober 12, 2026
• elated-themes frappe Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML CVE-2026-109601 7.1 HighOctober 12, 2026
• elated-themes frappe Frappe before 16.31.0 Improper Access Control in Document Follow Notifications CVE-2026-109600 6.9 MediumOctober 12, 2026
• elated-themes frappe Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification CVE-2026-109599 5.3 MediumOctober 12, 2026
• elated-themes frappe Frappe before 16.33.0 Broken Authorization via send_sms Endpoint CVE-2026-109598 5.3 MediumOctober 12, 2026
• elated-themes frappe Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters CVE-2025-71431 6.3 MediumOctober 12, 2026
• elated-themes frappe Frappe before 15.91.1 Stored XSS via Leaderboard User Names CVE-2025-71430 5.1 MediumOctober 12, 2026
• elated-themes frappe Frappe before 15.4.0 XSS via Printview Parameters CVE-2024-58391 5.3 MediumOctober 12, 2026
• elated-themes frappe Frappe before 15.41.0 Privilege Escalation via Document Action CVE-2024-58390 8.7 HighOctober 12, 2026
• elated-themes frappe Frappe before 13.46.3 Improper Access Control for Email Templates CVE-2023-54412 7.1 HighOctober 12, 2026
• elated-themes frappe Frappe before 13.32.0 Weak Authentication via Print View Key CVE-2023-54411 8.2 HighOctober 12, 2026
• elated-themes frappe Frappe before 13.22.0 Improper Authorization via Document Rename CVE-2023-54410 5.3 MediumOctober 12, 2026
• elated-themes frappe Frappe before 13.46.1 XSS via html2text Weak Sanitization CVE-2023-54409 5.9 MediumOctober 12, 2026
• elated-themes frappe Frappe before 14.31.0 HTML Injection via Weak Escaping CVE-2023-54408 5.1 MediumOctober 12, 2026
• elated-themes frappe Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks CVE-2023-54407 6.9 MediumOctober 12, 2026
• elated-themes frappe Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts CVE-2023-54406 6.9 MediumOctober 12, 2026
• elated-themes ambient WordPress Ambient theme <= 1.7 - Local File Inclusion vulnerability CVE-2026-66566 8.1 HighOctober 10, 2026
• elated-themes frappe Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages. CVE-2023-51769 6.1 MediumSeptember 14, 2026
• elated-themes frappe Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint CVE-2026-82634 7.1 HighAugust 30, 2026
• elated-themes frappe Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description CVE-2026-81731 5.1 MediumAugust 27, 2026
• elated-themes frappe Frappe: Access control bypass via REST API dot-notation fields on linked doctypes CVE-2026-66003 7.1 HighAugust 26, 2026
• elated-themes mane, måne +1 more Måne <= 1.7 - Unauthenticated Local File Inclusion CVE-2026-78478 8.1 HighAugust 25, 2026
• elated-themes måne WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability CVE-2026-66670 8.1 HighAugust 24, 2026
• elated-themes verdure core WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability CVE-2026-66671 8.1 HighAugust 24, 2026
• elated-themes frappe Frappe: User Enumeration via PDDR CVE-2026-66002 6.9 MediumAugust 20, 2026
• elated-themes frappe Frappe: Improper Authorization in OAuth2 Consent Endpoint CVE-2026-66001 8.5 HighAugust 20, 2026
• elated-themes frappe Frappe: Mass assignment via set_value CVE-2026-62315 7.1 HighAugust 20, 2026
• elated-themes frappe Frappe: Unauthenticated Workflow approval via confirm_action CVE-2026-63654 6.9 MediumAugust 20, 2026
• elated-themes frappe Frappe: Missing authorization in toggle_like and mark_as_seen CVE-2026-53569 5.3 MediumAugust 20, 2026
• elated-themes frappe Frappe: Unrestricted access to Document Follow APIs CVE-2026-66000 2.3 LowAugust 7, 2026
• elated-themes frappe Frappe: Unrestricted access to a Document Follow API CVE-2026-66058 5.3 MediumAugust 7, 2026
• elated-themes frappe Frappe: Field-level permission bypass via Document Follow CVE-2026-66059 5.3 MediumAugust 7, 2026
• elated-themes frappe Frappe: Stored XSS in Column Headers via Data Import CVE-2026-49391 5.1 MediumAugust 6, 2026
• elated-themes frappe Frappe: Lack of Permissions in restore/bulk_restore CVE-2026-47765 7.1 HighAugust 6, 2026
• elated-themes frappe Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain CVE-2026-47194 8.6 HighAugust 6, 2026
• elated-themes frappe Frappe Has Broken Access Control in its Workspace Save API CVE-2026-47185 5.1 MediumAugust 6, 2026
• elated-themes vino WordPress Vino theme <= 1.9 - Local File Inclusion vulnerability CVE-2026-65481 7.5 HighJuly 23, 2026
• elated-themes flow WordPress Flow theme <= 1.8 - Local File Inclusion vulnerability CVE-2026-57793 7.5 HighJuly 13, 2026
• elated-themes frappe Frappe: TarSlip RCE in Package Import CVE-2026-55852 8.6 HighJuly 10, 2026
• elated-themes frappe Frappe: Path Traversal via /backups Route CVE-2026-42219 6.9 MediumJuly 10, 2026
• elated-themes frappe Frappe: Auth. bypass via update_page CVE-2026-49394 7.1 HighJuly 10, 2026
• Show olderLoading…