https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-21T16:31:50.337943+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2019-25142 CVE-2019-25142 — Mesmerize <= 1.6.89 & Materialis <= 1.0.172 - Authenticated Arbitrary Options Update 2026-10-21T16:31:50.339407+00:00

Affected: extendthemes Materialis, extendthemes Mesmerize

The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172 (Materialis). This is due to 'companion_disable_popup' function only checking the nonce while sending user input to the 'update_option' function. This makes it possible for authenticated attackers to change otherwise restricted options.