CVE-2024-13797: The PressMart - Modern Elementor WooCommerce WordPress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.16. This is due to the softwar

high Affects pressmart (WordPress theme). Feed 2026.10.29.1, updated 2026-10-28; published 2025-02-18; advisory modified 2026-06-17.

The PressMart - Modern Elementor WooCommerce WordPress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.16. This is due to the softwar

Package: pressmart (WordPress theme) WordPress
Affected versions: <1.2.17
Fixed in: 1.2.17
Severity: high CVSS 7.3
Exploitation: not on CISA KEV · EPSS 1% (45.8th percentile)
Published: 2025-02-18
Source: nvd

References

CWE-94

NVD record pressmart (WordPress theme) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2017-9841 KEV critical Code Injection in PHPUnit same weakness: CWE-94
CVE-2021-3129 KEV critical Unauthenticated remote code execution via insecure file handling in debug mode same weakness: CWE-94
CVE-2025-32432 KEV critical Craft CMS Allows Remote Code Execution same weakness: CWE-94
CVE-2018-7602 KEV critical A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and same weakness: CWE-94
CVE-2024-56145 KEV critical Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled same weakness: CWE-94
CVE-2025-54068 KEV critical Livewire is vulnerable to remote command execution during component property update hydrat same weakness: CWE-94