Ovatheme
16 CVEs across 12 Ovatheme products. Browse Ovatheme vulnerabilities, severities, and proof-of-concept exploits.
Ovatheme products with known CVEs
Ovatheme CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-27400 | High | 8.6 | 2026-06-17 | Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions. |
CVE-2026-27093 | High | 8.1 | 2026-03-19 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Tripgo tripgo allows PHP Loca… |
CVE-2025-69090 | High | 8.1 | 2026-03-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Remons remons allows PHP Loca… |
CVE-2025-67963 | High | 8.6 | 2026-01-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ovatheme Movie Booking movie-booking allows Path Traversal.This… |
CVE-2025-49994 | High | 8.1 | 2026-01-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Athens athens allows PHP Loca… |
CVE-2025-7663 | Medium | 6.5 | 2025-11-08 | The Ovatheme Events Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the /class-ovae… |
CVE-2025-8561 | Medium | 6.4 | 2025-10-15 | The Ova Advent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.1.7 due to… |
CVE-2025-6553 | Critical | 9.8 | 2025-10-11 | The Ovatheme Events Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the process_checkout() function… |
CVE-2025-54716 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Ireca ireca allows PHP Local… |
CVE-2025-53576 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Ovatheme Events ova-events al… |
CVE-2025-53204 | High | 8.1 | 2025-08-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme eventlist eventlist allows PH… |
CVE-2025-52823 | High | 8.5 | 2025-08-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ovatheme Cube Portfolio cubeportfolio allows SQL Injectio… |
CVE-2025-52814 | High | 8.1 | 2025-06-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme BRW ova-brw allows PHP Local… |
CVE-2025-32510 | Critical | 10.0 | 2025-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in ovatheme Ovatheme Events Manager ova-events-manager allows Using Malicious Files.This issue af… |
CVE-2025-49314 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ovatheme BRW ova-brw allows Stored XSS.This issue affects… |
CVE-2025-49313 | High | 7.5 | 2025-06-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme BRW ova-brw allows PHP Local… |