Curly - A Stylish WordPress Theme for Hairdressers and Hair Salons

Curly - A Stylish WordPress Theme for Hairdressers and Hair Salons has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.2, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 1 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Authorization Bypass Through User-Controlled Key, behind 1 of the records (50%). Other recurring categories include PHP Remote File Inclusion.

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

All of these findings were reported by Tran Nguyen Bao Khanh.

01234567891001.01.2026Today01.01.20264.3Curly <= 3.3 - Authenticated (Subscriber+) Insecure Direct Object Reference CVSS 4.3 · 01.01.202606.01.20268.1Curly < 3.3 - Unauthenticated Local File Inclusion CVSS 8.1 · 06.01.2026

Strategic Overview

Avg CVSSMedium
6.2/ 10
Patch Coverage50%
Open

1

Fixed

1

Get automatic notifications for all Curly - A Stylish WordPress Theme for Hairdressers and Hair Salons vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2026-22393

Curly <= 3.3 - Authenticated (Subscriber+) Insecure Direct Object Reference

Read the full analysis

Vulnerability Records

2 records
Showing 1–2 of 2 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C