KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme

KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; 6 are fixed and 3 remain unpatched as of September 2026. Their average CVSS score is 6.7, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 4 high. 2025 was the busiest year with 8 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (22%). Other recurring categories include Missing Authorization, Code Injection.

6 of the records (67%) have a vendor fix, while 3 remain unpatched. The oldest unresolved one dates back to 2024.

4 independent researchers contributed these findings, most of them (4) reported by stealthcopter.

Strategic Overview

Avg CVSSMedium

6.7/ 10

Patch Coverage67%

Open

Fixed

Get automatic notifications for all KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme vulnerabilities before they are exploited.

Most severe open issueCVSS 8.8CVE-2025-6990

Kallyas <= 4.24.0 - Authenticated (Contributor+) Remote Code Execution

Read the full analysis

Vulnerability Records

9 records


2025-10-31 00:00	Kallyas <= 4.24.0 - Authenticated (Contributor+) Remote Code Execution KALLYAS - Creative eCommerce… <= 4.24.0	`CVE-2025-6990`	8.8 High	stealthcopter	No
2025-10-31 00:00	Kallyas <= 4.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting KALLYAS - Creative eCommerce… <= 4.23.0	`CVE-2025-6988`	6.4 Medium	stealthcopter	Yes
2025-10-16 00:00	Kallyas <= 4.22.0 - Authenticated (Contributor+) Stored Cross-Site Scripting kallyas <= 4.22.0	`CVE-2025-63061`	6.4 Medium	João Pedro Soares de Alcântara	No
2025-10-16 00:00	Kallyas <= 4.22.0 - Missing Authorization KALLYAS - Creative eCommerce… <= 4.22.0	`CVE-2025-62018`	5.3 Medium	Rafie Muhammad	Yes
2025-10-16 00:00	Kallyas <= 4.22.0 - Missing Authorization KALLYAS - Creative eCommerce… <= 4.22.0	`CVE-2025-62017`	4.3 Medium	Rafie Muhammad	Yes
2025-09-06 00:00	Kallyas <= 4.22.0 - Authenticated (Contributor+) Arbitrary File Upload KALLYAS - Creative eCommerce… <= 4.22.0	`CVE-2025-62016`	8.8 High	Rafie Muhammad	Yes
2025-07-25 19:04	Kallyas <= 4.21.0 - Authenticated (Contributor+) Arbitrary Folder Deletion KALLYAS - Creative eCommerce… <= 4.21.0	`CVE-2025-6989`	8.1 High	stealthcopter	Yes
2025-07-25 00:00	Kallyas <= 4.21.0 - Authenticated (Contributor+) Local File Inclusion KALLYAS - Creative eCommerce… <= 4.21.0	`CVE-2025-6991`	7.5 High	stealthcopter	Yes
2024-11-01 00:00	Kallyas <= 4.2 - Cross-Site Request Forgery kallyas <= 4.2	`CVE-2025-63060`	4.3 Medium	Ananda Dhakal	No

Showing 1–9 of 9 reports