CVE-2025-59134

HighCVSS 8.8/10Last modified Oct 5, 2026

Description

Incorrect Privilege Assignment vulnerability in Jthemes Sale! Immigration law, Visa services support, Migration Agent Consulting immiex allows Privilege Escalation.This issue affects Sale! Immigration law, Visa services support, Migration Agent Consulting: from n/a through <= 1.5.8.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266

Affected software

Vendor	Product	Versions
Jthemes	Sale! Immigration law, Visa services support, Migration Agent Consulting	<= 1.5.8

References

https://patchstack.com/database/Wordpress/Theme/immiex/vulnerability/wordpress-sale-immigration-law-visa-services-support-migration-agent-consulting-theme-1-5-8-privilege-escalation-vulnerability?_s_id=cve

Timeline

Published: Dec 18, 2025
Last modified: Oct 5, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-591355.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eleopard Behance Portfolio Manager por CVE-2025-591365.3Insertion of Sensitive Information Into Sent Data vulnerability in Efí Bank Gerencianet Oficial woo-gerencianet-official allows Retrieve Emb CVE-2025-591377.1Cross-Site Request Forgery (CSRF) vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS CVE-2025-591384.9Server-Side Request Forgery (SSRF) vulnerability in Jthemes Genemy genemy allows Server Side Request Forgery.This issue affects Genemy: from CVE-2025-591395.3Hono is a Web application framework that provides support for any JavaScript runtime. In versions prior to 4.9.7, a flaw in the `bodyLimit` CVE-2025-59147.8A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This fl CVE-2025-591408.8backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken over after a phishin CVE-2025-591418.8simple-swizzle swizzles function arguments. On 8 September 2025, the npm publishing account for simple-swizzle was taken over after a phishi CVE-2025-591428.8color-string is a parser and generator for CSS color strings. On 8 September 2025, the npm publishing account for color-string was taken ove CVE-2025-591438.8color is a Javascript color conversion and manipulation library. On 8 September 2025, the npm publishing account for color was taken over af CVE-2025-591448.8debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. V CVE-2025-591458.8color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing att