Kalium 3 | Creative WordPress & WooCommerce Theme

Kalium 3 | Creative WordPress & WooCommerce Theme has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 5 are fixed as of September 2026. Their average CVSS score is 6.2, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high. 2025 was the busiest year with 4 disclosures.

The most common weakness is Missing Authorization, behind 2 of the records (40%). Other recurring categories include Code Injection, Cross-Site Request Forgery (CSRF).

Every one of the 5 issues recorded for Kalium 3 | Creative WordPress & WooCommerce Theme has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, most of them (3) reported by Ananda Dhakal.

Strategic Overview

Avg CVSSMedium

6.2/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Kalium 3 | Creative WordPress & WooCommerce Theme vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2025-49926

Kalium <= 3.25 - Unauthenticated Arbitrary Code Execution

Read the full analysis

Vulnerability Records

5 records


2026-01-15 01:00	Kalium <= 3.29 - Missing Authorization to Unauthenticated Mail Relay via kalium_vc_contact_form_request Kalium 3 <= 3.29	`CVE-2025-12895`	5.3 Medium	Ahmed Rayen Ayari	Yes
2025-08-21 00:00	Kalium <= 3.18.3 - Missing Authorization Kalium 3 <= 3.18.3	`CVE-2025-53348`	5.3 Medium	Ananda Dhakal	Yes
2025-08-14 00:00	Kalium <= 3.18.3 - Cross-Site Request Forgery Kalium 3 <= 3.18.3	`CVE-2025-53347`	4.3 Medium	Ananda Dhakal	Yes
2025-06-19 00:00	Kalium <= 3.25 - Unauthenticated Arbitrary Code Execution Kalium 3 <= 3.25	`CVE-2025-49926`	9.8 Critical	Tran Nguyen Bao Khanh	Yes
2025-01-04 00:00	Kalium <= 3.18.3 - Reflected Cross-Site Scripting Kalium 3 <= 3.18.3	`CVE-2025-53349`	6.1 Medium	Ananda Dhakal	Yes

Showing 1–5 of 5 reports