Aonetheme

11 CVEs across 3 Aonetheme products. Browse Aonetheme vulnerabilities, severities, and proof-of-concept exploits.

Aonetheme products with known CVEs

ProductCVEs
Service Finder Bookings6
Service Finder Booking3
Service Finder Sms System2
Aonetheme CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-28161High8.82026-08-13Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.
CVE-2026-28159Medium6.52026-08-13Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.
CVE-2025-6574High8.82025-11-01The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and excluding, 6.1. This is…
CVE-2025-5949High8.82025-11-01The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is…
CVE-2025-5948Critical9.82025-09-19The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is…
CVE-2025-5955High8.12025-09-19The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.0. This is due to the plugi…
CVE-2025-5947Critical9.82025-08-01The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all versions up to, and including, 6.0. Thi…
CVE-2025-5954Critical9.82025-08-01The Service Finder SMS System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This…
CVE-2025-23970Critical9.82025-07-04Incorrect Privilege Assignment vulnerability in aonetheme Service Finder Booking sf-booking allows Privilege Escalation.This issue affects Service Finder Booki…
CVE-2025-2470Critical9.82025-04-25The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation i…
CVE-2024-13442Critical9.82025-03-19The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.0. This is…