The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activello_activate_plugin' and 'activello_deactivate_plugin' functions in the 'inc/welcome-screen/class-activello-welcome.php' file missing capability and security checks/nonces. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins installed on a vulnerable site.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Activello Theme | — | Update activello theme to version 1.4.2, or a newer patched version | Dec 8, 2025 | Oct 1, 2020 |
| Brilliance Theme | — | Update brilliance theme to version 1.3.0, or a newer patched version | Dec 8, 2025 | Oct 1, 2020 |
| Newspaper X Theme | — | Update newspaper-x theme to version 1.3.2, or a newer patched version | Dec 8, 2025 | Oct 1, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub