Tonn

20242025

Critical

High

Medium

Low

Global Rank

#78

of 3,238 researchers

Vulns

86

Critical47

High35

Medium4

Low0

Affected Assets

69

59plugins10themes

Avg CVSS

9.1

Average score of vulnerabilities

Researcher Submissions

86 records


2025-11-24 14:03	Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback Sneeit Framework <= 8.3	`CVE-2025-6389`	9.8 Critical	Tonn	Yes
2025-10-30 18:34	WordPress User Extra Fields <= 16.7 - Authenticated (Subscriber+) Arbitrary File Deletion via save_fields Function WordPress User Extra Fields <= 16.7	`CVE-2025-7846`	8.8 High	Tonn	Yes
2025-10-30 00:00	Zombify <= 1.7.5 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read Zombify <= 1.7.5	`CVE-2025-8385`	6.8 Medium	Tonn	Yes
2025-10-23 00:00	WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload WooCommerce Designer Pro <= 1.9.26	`CVE-2025-6440`	9.8 Critical	Tonn	No
2025-10-10 20:34	WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Deletion WooCommerce Designer Pro <= 1.9.26	`CVE-2025-6439`	9.8 Critical	Tonn	No
2025-10-02 19:26	Spirit Framework <= 1.2.14 - Authentication Bypass to Account Takeover and Privilege Escalation Spirit Framework <= 1.2.14	`CVE-2025-6388`	9.8 Critical	Tonn	Yes
2025-09-05 00:00	AdForest <= 6.0.9 - Authentication Bypass to Admin AdForest <= 6.0.9	`CVE-2025-8359`	9.8 Critical	Tonn	Yes
2025-08-25 19:03	Event List <= 2.0.4 - Authenticated (Subscriber+) Privilege Escalation Event List <= 2.0.4	`CVE-2025-6366`	8.8 High	Tonn	Yes
2025-07-28 16:22	Elementor <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Elementor Website Builder <= 3.29.0	`CVE-2025-3075`	6.4 Medium	Tonn	Yes
2025-07-11 16:27	Nokri - Job Board WordPress Theme <= 1.6.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover Nokri <= 1.6.3	`CVE-2025-1313`	8.8 High	Tonn	Yes

Showing 1–10 of 86 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C