Vulnerability · Published Jan 6, 2026 · Assigned by Patchstack

CVE-2025-30996Arbitrary File Upload Vulnerability in WordPress themes by Themify

Critical 9.9

In plain English

A critical-severity unrestricted file upload in Bloggie from Themify. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.5%top 56.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themify Bloggie, Themify Photobox, Themify Wigi, Themify Rezo, Themify Slide allows Upload a Web Shell to a Web Server.This issue affects Themify Sidepane WordPress Theme: from n/a through 1.9.8; Themify Newsy: from n/a through 1.9.9; Themify Folo: from n/a through 1.9.6; Themify Edmin: from n/a through 2.0.0; Bloggie: from n/a through 2.0.8; Photobox: from n/a through 2.0.1; Wigi: from n/a through 2.0.1; Rezo: from n/a through 1.9.7; Slide: from n/a through 1.7.5.

Affected products (as reported)

Vendor	Product	Versions
Themify	Themify Sidepane WordPress Theme	n/a – through 1.9.8
Themify	Themify Newsy	n/a – through 1.9.9
Themify	Themify Folo	n/a – through 1.9.6
Themify	Themify Edmin	n/a – through 2.0.0
Themify	Bloggie	n/a – through 2.0.8
Themify	Photobox	n/a – through 2.0.1
Themify	Wigi	n/a – through 2.0.1
Themify	Rezo	n/a – through 1.9.7
Themify	Slide	n/a – through 1.7.5

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References