Laborator

13 CVEs across 7 Laborator products. Browse Laborator vulnerabilities, severities, and proof-of-concept exploits.

Laborator products with known CVEs

ProductCVEs
Kalium5
Neon3
Aurum - WordPress & Woocommerce Shopping Theme1
Kalium 3 | Creative WordPress & Woocommerce Theme1
Oxygen1
Oxygen - Woocommerce WordPress Theme1
Xenon1
Laborator CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-12886High7.22026-03-28The Oxygen Theme theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.8 via the laborator_calc_route AJAX…
CVE-2025-69299High7.22026-02-20Server-Side Request Forgery (SSRF) vulnerability in Laborator Oxygen oxygen allows Server Side Request Forgery.This issue affects Oxygen: from n/a through <= 6…
CVE-2025-12895Medium5.32026-01-15The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the…
CVE-2025-53349High7.12025-11-06Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Laborator Kalium kalium allows Reflected XSS.This issue a…
CVE-2025-49926High7.22025-10-22Improper Control of Generation of Code ('Code Injection') vulnerability in Laborator Kalium kalium allows Code Injection.This issue affects Kalium: from n/a th…
CVE-2025-53348Medium5.32025-09-09Missing Authorization vulnerability in Laborator Kalium kalium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kaliu…
CVE-2025-53347Medium4.32025-08-14Cross-Site Request Forgery (CSRF) vulnerability in Laborator Kalium kalium allows Cross Site Request Forgery.This issue affects Kalium: from n/a through <= 3.1…
CVE-2024-12781Medium4.32025-01-07The Aurum - WordPress & WooCommerce Shopping Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on…
CVE-2020-24075Medium6.12023-08-11Cross Site Scripting (XSS) vulnerability in Name Input Field in Contact Us form in Laborator Kalium before 3.0.4, allows remote attackers to execute arbitrary…
CVE-2020-23576Medium5.42020-08-27Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab.
CVE-2020-14010Medium6.12020-06-10The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) parameter.
CVE-2020-13890Medium5.42020-06-06The Neon theme 2.0 before 2020-06-03 for Bootstrap allows XSS via an Add Task Input operation in a dashboard.
CVE-2019-20141Medium6.12019-12-30An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.