Extendthemes vulnerabilities
34 CVEs and advisories name Extendthemes as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-115816Kubio AI Page Builder <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via kubio/shortcode Block via Product Review
- CVE-2026-109191Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML
- CVE-2026-107758Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments
- CVE-2026-100107Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)
- CVE-2026-14472Kubio AI Page Builder <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content
- CVE-2026-16779Kubio AI Page Builder <= 2.8.5 - Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration Reversion via kubio_restore_front_page AJAX Action
- CVE-2026-5427Kubio AI Page Builder <= 2.7.2 - Missing Authorization to Authenticated (Contributor+) Limited File Upload via Kubio Block Attributes
- CVE-2025-62751WordPress Vireo theme <= 1.0.24 - Broken Access Control vulnerability
- CVE-2025-11747Colibri Page Builder <= 1.0.345 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2025-11376Colibri Page Builder <= 1.0.335 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2025-9560Colibri Page Builder <= 1.0.334 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_newsletter Shortcode
- CVE-2025-8487Kubio AI Page Builder <= 2.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation
- CVE-2025-2294Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion
- CVE-2024-13516Kubio AI Page Builder <= 2.3.5 - Reflected Cross-Site Scripting
- CVE-2024-37458WordPress Highlight theme <= 1.0.29 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-37431WordPress Mesmerize theme <= 1.6.120 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-5020Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library
- CVE-2024-39661WordPress Kubio AI Page Builder plugin <= 2.2.4 - Authenticated Cross Site Scripting (XSS) vulnerability
- CVE-2023-3204Materialis <= 1.1.24 - Missing Authorization to Limited Arbitrary Options Update
- CVE-2024-4451Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_video_player Shortcode
- CVE-2024-5038Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-3340Colibri Page Builder <= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri-gallery-slideshow' Shortcode
- CVE-2024-3337Colibri Page Builder <= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri_breadcrumb_element' Shortcode
- CVE-2024-3338Colibri Page Builder <= 1.0.262 - Authenticated (Author+) Stored Cross-Site Scripting
- CVE-2024-2839Colibri Page Builder <= 1.0.263 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-28004WordPress Colibri Page Builder plugin <= 1.0.248 - Broken Access Control vulnerability
- CVE-2024-1870Colibri Page Builder <= 1.0.260 - Missing Authorization
- CVE-2024-1360Colibri WP <= 1.0.94 - Cross-Site Request Forgery to Limited Plugin Installation
- CVE-2024-1362Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via cp_shortcode_refresh
- CVE-2024-1361Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via extend_builder