Soledad

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Themes   >   Soledad

Information

Software Type Theme
Software Slug soledad
Software Status Active
Software Author pencidesign
Software Website soledad.pencidesign.net
Software Active Installs 56,985
Software Record Last Updated August 20, 2025

18 Vulnerabilities

Submit a Vulnerability
Soledad <= 8.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2026-27069
Jan 10, 2026
Researcher: João Pedro Soares de Alcântara
Soledad <= 8.7.0 - Authenticated (Contributor+) Local File Inclusion
7.5
CVE-2025-68066
Oct 28, 2025
Researcher: João Pedro Soares de Alcântara
Soledad < = 8.6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
8.8
CVE-2025-64188
Oct 23, 2025
Researcher: Denver Jackson
Soledad <= 8.6.8 - Authenticated (Contributor+) Local File Inclusion
7.5
CVE-2025-59588
Sep 22, 2025
Researcher: João Pedro Soares de Alcântara
Soledad <= 8.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-59589
Sep 22, 2025
Researcher: João Pedro Soares de Alcântara
Soledad <= 8.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pcsml_smartlists_h'
6.4
CVE-2025-8143
Aug 15, 2025
Researcher: stealthcopter
Soledad <= 8.6.7 - Authenticated (Contributor+) Local File Inclusion via 'header_layout'
8.8
CVE-2025-8142
Aug 15, 2025
Researcher: stealthcopter
Soledad <= 8.6.7 - Unauthenticated Arbitrary Shortcode Execution
7.3
CVE-2025-8105
Aug 15, 2025
Researcher: stealthcopter
Soledad <= 8.5.9 - Unauthenticated Limited Local File Inclusion
8.1
CVE-2024-11289
Dec 5, 2024
Researcher: Foxyyy
Soledad <= 8.4.5 - Missing Authorization
4.3
CVE-2024-31367
Apr 9, 2024
Researcher: Rafie Muhammad
Soledad <= 8.4.5 - Missing Authorization
5.3
CVE-2024-31368
Apr 9, 2024
Researcher: Rafie Muhammad
Soledad <= 8.4.5 - Cross-Site Request Forgery
4.3
CVE-2024-31369
Apr 9, 2024
Researcher: Rafie Muhammad
Soledad <= 8.4.1 - Authenticated (Contributor+) SQL Injection
8.8
CVE-2023-49825
Dec 5, 2023
Researcher: Rafie Muhammad
Soledad <= 8.4.1 - Unauthenticated PHP Object Injection
9.8
CVE-2023-49826
Dec 5, 2023
Researcher: Rafie Muhammad
Soledad <= 8.4.1 - Reflected Cross-Site Scripting
6.1
CVE-2023-49827
Dec 5, 2023
Researcher: Rafie Muhammad
Soledad <= 8.2.5 - Missing Authorization
5.4
CVE-2022-42479
Nov 1, 2022
Researcher: Dave Jong
Soledad <= 8.2.5 - Authenticated (Subscriber+) Cross-Site Scripting
6.4
CVE-2022-41788
Oct 30, 2022
Researcher: Dave Jong
Soledad <= 8.2.4 - Reflected Cross-Site Scripting
6.1
CVE-2022-3209
Sep 13, 2022
Researcher: Truoc Phan
Title Status CVE ID CVSS Researchers Date
Soledad <= 8.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Unpatched CVE-2026-27069 6.4 João Pedro Soares de Alcântara January 10, 2026
Soledad <= 8.7.0 - Authenticated (Contributor+) Local File Inclusion Unpatched CVE-2025-68066 7.5 João Pedro Soares de Alcântara October 28, 2025
Soledad < = 8.6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update Patched CVE-2025-64188 8.8 Denver Jackson October 23, 2025
Soledad <= 8.6.8 - Authenticated (Contributor+) Local File Inclusion Patched CVE-2025-59588 7.5 João Pedro Soares de Alcântara September 22, 2025
Soledad <= 8.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2025-59589 6.4 João Pedro Soares de Alcântara September 22, 2025
Soledad <= 8.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pcsml_smartlists_h' Patched CVE-2025-8143 6.4 stealthcopter August 15, 2025
Soledad <= 8.6.7 - Authenticated (Contributor+) Local File Inclusion via 'header_layout' Patched CVE-2025-8142 8.8 stealthcopter August 15, 2025
Soledad <= 8.6.7 - Unauthenticated Arbitrary Shortcode Execution Patched CVE-2025-8105 7.3 stealthcopter August 15, 2025
Soledad <= 8.5.9 - Unauthenticated Limited Local File Inclusion Patched CVE-2024-11289 8.1 Foxyyy December 5, 2024
Soledad <= 8.4.5 - Missing Authorization Patched CVE-2024-31367 4.3 Rafie Muhammad April 9, 2024
Soledad <= 8.4.5 - Missing Authorization Patched CVE-2024-31368 5.3 Rafie Muhammad April 9, 2024
Soledad <= 8.4.5 - Cross-Site Request Forgery Patched CVE-2024-31369 4.3 Rafie Muhammad April 9, 2024
Soledad <= 8.4.1 - Authenticated (Contributor+) SQL Injection Patched CVE-2023-49825 8.8 Rafie Muhammad December 5, 2023
Soledad <= 8.4.1 - Unauthenticated PHP Object Injection Patched CVE-2023-49826 9.8 Rafie Muhammad December 5, 2023
Soledad <= 8.4.1 - Reflected Cross-Site Scripting Patched CVE-2023-49827 6.1 Rafie Muhammad December 5, 2023
Soledad <= 8.2.5 - Missing Authorization Patched CVE-2022-42479 5.4 Dave Jong November 1, 2022
Soledad <= 8.2.5 - Authenticated (Subscriber+) Cross-Site Scripting Patched CVE-2022-41788 6.4 Dave Jong October 30, 2022
Soledad <= 8.2.4 - Reflected Cross-Site Scripting Patched CVE-2022-3209 6.1 Truoc Phan September 13, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation