# cve.now: Uxper

The newest entries naming Uxper as an affected vendor (up to 200), of 33 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-28150](https://cve.now/CVE-2026-28150.md): WordPress Golo Framework plugin \< 1.7.5 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-65525](https://cve.now/CVE-2026-65525.md): WordPress Civi Framework plugin \<= 2.2.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-65476](https://cve.now/CVE-2026-65476.md): WordPress Civi theme \<= 2.2.4 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-57799](https://cve.now/CVE-2026-57799.md): WordPress Nuss theme \<= 1.3.6 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2026-57794](https://cve.now/CVE-2026-57794.md): WordPress Golo Framework plugin \<= 1.7.3 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2026-27051](https://cve.now/CVE-2026-27051.md): WordPress Golo theme \<= 1.7.0 - Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2026-23973](https://cve.now/CVE-2026-23973.md): WordPress Golo theme \< 1.7.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-23975](https://cve.now/CVE-2026-23975.md): WordPress Golo theme \< 1.7.5 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2026-23974](https://cve.now/CVE-2026-23974.md): WordPress Golo theme \< 1.7.5 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-52739](https://cve.now/CVE-2025-52739.md): WordPress Sala theme \<= 1.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-62037](https://cve.now/CVE-2025-62037.md): WordPress Togo theme \< 1.0.4 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-62036](https://cve.now/CVE-2025-62036.md): WordPress Togo theme \< 1.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-62035](https://cve.now/CVE-2025-62035.md): WordPress Togo theme \< 1.0.4 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2025-62034](https://cve.now/CVE-2025-62034.md): WordPress Togo theme \< 1.0.4 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2025-62033](https://cve.now/CVE-2025-62033.md): WordPress Togo theme \< 1.0.4 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-54709](https://cve.now/CVE-2025-54709.md): WordPress Sala Theme \<= 1.1.6 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-54725](https://cve.now/CVE-2025-54725.md): WordPress Golo Theme \<= 1.7.0 - Broken Authentication Vulnerability (CVSS 9.8)
- [CVE-2025-54724](https://cve.now/CVE-2025-54724.md): WordPress Golo Theme \<= 1.7.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1)
- [CVE-2025-49891](https://cve.now/CVE-2025-49891.md): WordPress Uxper Booking Plugin \<= 1.3.3 - SQL Injection Vulnerability (CVSS 8.5)
- [CVE-2025-49892](https://cve.now/CVE-2025-49892.md): WordPress Uxper Booking Plugin \<= 1.3.3 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-49893](https://cve.now/CVE-2025-49893.md): WordPress Nuss Theme \<= 1.3.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1)
- [CVE-2025-49894](https://cve.now/CVE-2025-49894.md): WordPress Nuss Theme \<= 1.3.3 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-52803](https://cve.now/CVE-2025-52803.md): WordPress Sala theme \<= 1.1.3 - Broken Access Control Vulnerability (CVSS 7.5)
- [CVE-2025-52804](https://cve.now/CVE-2025-52804.md): WordPress Nuss theme \<= 1.3.7.1 - Broken Access Control Vulnerability (CVSS 7.5)
- [CVE-2025-4606](https://cve.now/CVE-2025-4606.md): Sala - Startup & SaaS WordPress Theme \<= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover (CVSS 9.8)
- [CVE-2025-52826](https://cve.now/CVE-2025-52826.md): WordPress Sala theme \<= 1.1.3 - PHP Object Injection Vulnerability (CVSS 8.8)
- [CVE-2025-52827](https://cve.now/CVE-2025-52827.md): WordPress Nuss theme \<= 1.3.3 - PHP Object Injection Vulnerability (CVSS 8.8)
- [CVE-2025-49511](https://cve.now/CVE-2025-49511.md): WordPress Civi Framework plugin \<= 2.1.6 - Cross Site Request Forgery (CSRF) to User Deactivation vulnerability (CVSS 7.1)
- [CVE-2025-4797](https://cve.now/CVE-2025-4797.md): Golo \<= 1.7.0 - Authentication Bypass to Account Takeover (CVSS 9.8)
- [CVE-2024-13773](https://cve.now/CVE-2024-13773.md): Civi - Job Board & Freelance Marketplace WordPress Theme \<= 2.1.4 - Sensitive Information Exposure (CVSS 7.3)
- [CVE-2024-13772](https://cve.now/CVE-2024-13772.md): Civi - Job Board & Freelance Marketplace WordPress Theme \<= 2.1.6.1 - Authentication Bypass (CVSS 5.6)
- [CVE-2024-13771](https://cve.now/CVE-2024-13771.md): Civi - Job Board & Freelance Marketplace WordPress Theme \<= 2.1.4 - Authentication Bypass via Password Update (CVSS 9.8)
- [CVE-2024-12876](https://cve.now/CVE-2024-12876.md): Golo - Directory & Listing, Travel WordPress Theme \<= 1.6.10 - Missing Authorization to Privilege Escalation via Unauthenticated Arbitrary User Password Change (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/uxper
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.