kallyas

kallyas has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; 6 are fixed and 4 remain unpatched as of October 2026. Their average CVSS score is 6.7, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 5 high. 2025 was the busiest year with 8 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (30%). Other recurring categories include Missing Authorization, Code Injection.

6 of the records (60%) have a vendor fix, while 4 remain unpatched. The oldest unresolved one dates back to 2024.

4 independent researchers contributed these findings, most of them (4) reported by Rafie Muhammad.

Strategic Overview

Avg CVSSMedium

6.7/ 10

Patch Coverage60%

Open

Fixed

Get automatic notifications for all kallyas vulnerabilities before they are exploited.

Most severe open issueCVSS 8.8CVE-2025-6990

Kallyas <= 4.24.0 - Authenticated (Contributor+) Remote Code Execution

Read the full analysis

Vulnerability Records

10 records


2026-10-21 00:00	KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme <= 4.25.0 - Unauthenticated Stored Cross-Site Scripting kallyas <= 4.25.0	`CVE-2026-112863`	7.2 High	Rafie Muhammad	No
2025-10-31 00:00	Kallyas <= 4.24.0 - Authenticated (Contributor+) Remote Code Execution KALLYAS - Creative eCommerce… <= 4.24.0	`CVE-2025-6990`	8.8 High	stealthcopter	No
2025-10-31 00:00	Kallyas <= 4.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting KALLYAS - Creative eCommerce… <= 4.23.0	`CVE-2025-6988`	6.4 Medium	stealthcopter	Yes
2025-10-16 00:00	Kallyas <= 4.22.0 - Authenticated (Contributor+) Stored Cross-Site Scripting kallyas <= 4.22.0	`CVE-2025-63061`	6.4 Medium	João Pedro Soares de Alcântara	No
2025-10-16 00:00	Kallyas <= 4.22.0 - Missing Authorization KALLYAS - Creative eCommerce… <= 4.22.0	`CVE-2025-62018`	5.3 Medium	Rafie Muhammad	Yes
2025-10-16 00:00	Kallyas <= 4.22.0 - Missing Authorization KALLYAS - Creative eCommerce… <= 4.22.0	`CVE-2025-62017`	4.3 Medium	Rafie Muhammad	Yes
2025-09-06 00:00	Kallyas <= 4.22.0 - Authenticated (Contributor+) Arbitrary File Upload KALLYAS - Creative eCommerce… <= 4.22.0	`CVE-2025-62016`	8.8 High	Rafie Muhammad	Yes
2025-07-25 19:04	Kallyas <= 4.21.0 - Authenticated (Contributor+) Arbitrary Folder Deletion KALLYAS - Creative eCommerce… <= 4.21.0	`CVE-2025-6989`	8.1 High	stealthcopter	Yes
2025-07-25 00:00	Kallyas <= 4.21.0 - Authenticated (Contributor+) Local File Inclusion KALLYAS - Creative eCommerce… <= 4.21.0	`CVE-2025-6991`	7.5 High	stealthcopter	Yes
2024-11-01 00:00	Kallyas <= 4.2 - Cross-Site Request Forgery kallyas <= 4.2	`CVE-2025-63060`	4.3 Medium	Ananda Dhakal	No

Showing 1–10 of 10 reports