Laborator
8 CVEs across 7 Laborator products. Browse Laborator vulnerabilities, severities, and proof-of-concept exploits.
Laborator products with known CVEs
Laborator CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2025-12886 | High | 7.2 | 2026-03-28 | The Oxygen Theme theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.8 via the laborator_calc_route AJAX… |
CVE-2025-69299 | High | 7.2 | 2026-02-20 | Server-Side Request Forgery (SSRF) vulnerability in Laborator Oxygen oxygen allows Server Side Request Forgery.This issue affects Oxygen: from n/a through <= 6… |
CVE-2025-12895 | Medium | 5.3 | 2026-01-15 | The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the… |
CVE-2025-53349 | High | 7.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Laborator Kalium kalium allows Reflected XSS.This issue a… |
CVE-2025-49926 | High | 7.2 | 2025-10-22 | Improper Control of Generation of Code ('Code Injection') vulnerability in Laborator Kalium kalium allows Code Injection.This issue affects Kalium: from n/a th… |
CVE-2025-53348 | Medium | 5.3 | 2025-09-09 | Missing Authorization vulnerability in Laborator Kalium kalium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kaliu… |
CVE-2025-53347 | Medium | 4.3 | 2025-08-14 | Cross-Site Request Forgery (CSRF) vulnerability in Laborator Kalium kalium allows Cross Site Request Forgery.This issue affects Kalium: from n/a through <= 3.1… |
CVE-2024-12781 | Medium | 4.3 | 2025-01-07 | The Aurum - WordPress & WooCommerce Shopping Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on… |
CVE-2020-24075 | Medium | 6.1 | 2023-08-11 | Cross Site Scripting (XSS) vulnerability in Name Input Field in Contact Us form in Laborator Kalium before 3.0.4, allows remote attackers to execute arbitrary… |
CVE-2020-23576 | Medium | 5.4 | 2020-08-27 | Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab. |
CVE-2020-14010 | Medium | 6.1 | 2020-06-10 | The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) parameter. |
CVE-2020-13890 | Medium | 5.4 | 2020-06-06 | The Neon theme 2.0 before 2020-06-03 for Bootstrap allows XSS via an Add Task Input operation in a dashboard. |
CVE-2019-20141 | Medium | 6.1 | 2019-12-30 | An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter. |