CVE-2025-30996 | Unrestricted Upload of File with Dangerous Type vulnerabilit… | CVSS 9.9 CRITICAL

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themify Bloggie, Themify Photobox, Themify Wigi, Themify Rezo, Themify Slide allows Upload a Web Shell to a Web Server.This issue affects Themify Sidepane WordPress Theme: from n/a through 1.9.8; Themify Newsy: from n/a through 1.9.9; Themify Folo: from n/a through 1.9.6; Themify Edmin: from n/a through 2.0.0; Bloggie: from n/a through 2.0.8; Photobox: from n/a through 2.0.1; Wigi: from n/a through 2.0.1; Rezo: from n/a through 1.9.7; Slide: from n/a through 1.7.5.

Metadata

CVE ID: CVE-2025-30996
State: PUBLISHED
Assigner: Patchstack
Reserved: 2025-03-26 09:22 UTC
Published: 2026-01-06 20:56 UTC
Last updated: 2026-04-28 16:12 UTC
Primary CWE: CWE-434
CWE-434 Unrestricted Upload of File with Dangerous Type
Vendor / Product: Themify / Themify Sidepane WordPress Theme
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (9)

Vendor	Product	Platform	Versions
Themify	Bloggie	—	n/a ≤ 2.0.8
Themify	Photobox	—	n/a ≤ 2.0.1
Themify	Rezo	—	n/a ≤ 1.9.7
Themify	Slide	—	n/a ≤ 1.7.5
Themify	Themify Edmin	—	n/a ≤ 2.0.0
Themify	Themify Folo	—	n/a ≤ 1.9.6
Themify	Themify Newsy	—	n/a ≤ 1.9.9
Themify	Themify Sidepane WordPress Theme	—	n/a ≤ 1.9.8
Themify	Wigi	—	n/a ≤ 2.0.1

Weakness (CWE)

CWE	Source	Description
CWE-434	cna	CWE-434 Unrestricted Upload of File with Dangerous Type

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (9)