# cve.now: Extendthemes The newest entries naming Extendthemes as an affected vendor (up to 200), of 34 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2026-115816](https://cve.now/CVE-2026-115816.md): Kubio AI Page Builder \<= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via kubio/shortcode Block via Product Review (CVSS 6.4) - [CVE-2026-109191](https://cve.now/CVE-2026-109191.md): Image Hub \<= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML (CVSS 4.3) - [CVE-2026-107758](https://cve.now/CVE-2026-107758.md): Colibri Page Builder \<= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments (CVSS 7.2) - [CVE-2026-100107](https://cve.now/CVE-2026-100107.md): Kubio AI Page Builder \<= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass) (CVSS 7.2) - [CVE-2026-14472](https://cve.now/CVE-2026-14472.md): Kubio AI Page Builder \<= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content (CVSS 6.4) - [CVE-2026-16779](https://cve.now/CVE-2026-16779.md): Kubio AI Page Builder \<= 2.8.5 - Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration Reversion via kubio\_restore\_front\_page AJAX Action (CVSS 4.3) - [CVE-2026-5427](https://cve.now/CVE-2026-5427.md): Kubio AI Page Builder \<= 2.7.2 - Missing Authorization to Authenticated (Contributor+) Limited File Upload via Kubio Block Attributes (CVSS 5.3) - [CVE-2025-62751](https://cve.now/CVE-2025-62751.md): WordPress Vireo theme \<= 1.0.24 - Broken Access Control vulnerability (CVSS 4.3) - [CVE-2025-11747](https://cve.now/CVE-2025-11747.md): Colibri Page Builder \<= 1.0.345 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4) - [CVE-2025-11376](https://cve.now/CVE-2025-11376.md): Colibri Page Builder \<= 1.0.335 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2025-9560](https://cve.now/CVE-2025-9560.md): Colibri Page Builder \<= 1.0.334 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri\_newsletter Shortcode (CVSS 6.4) - [CVE-2025-8487](https://cve.now/CVE-2025-8487.md): Kubio AI Page Builder \<= 2.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation (CVSS 5.4) - [CVE-2025-2294](https://cve.now/CVE-2025-2294.md): Kubio AI Page Builder \<= 2.5.1 - Unauthenticated Local File Inclusion (CVSS 9.8) - [CVE-2024-13516](https://cve.now/CVE-2024-13516.md): Kubio AI Page Builder \<= 2.3.5 - Reflected Cross-Site Scripting (CVSS 6.1) - [CVE-2024-37458](https://cve.now/CVE-2024-37458.md): WordPress Highlight theme \<= 1.0.29 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3) - [CVE-2024-37431](https://cve.now/CVE-2024-37431.md): WordPress Mesmerize theme \<= 1.6.120 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3) - [CVE-2024-5020](https://cve.now/CVE-2024-5020.md): Multiple Plugins \<= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library (CVSS 6.4) - [CVE-2024-39661](https://cve.now/CVE-2024-39661.md): WordPress Kubio AI Page Builder plugin \<= 2.2.4 - Authenticated Cross Site Scripting (XSS) vulnerability (CVSS 6.5) - [CVE-2023-3204](https://cve.now/CVE-2023-3204.md): Materialis \<= 1.1.24 - Missing Authorization to Limited Arbitrary Options Update (CVSS 6.5) - [CVE-2024-4451](https://cve.now/CVE-2024-4451.md): Colibri Page Builder \<= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri\_video\_player Shortcode (CVSS 6.4) - [CVE-2024-5038](https://cve.now/CVE-2024-5038.md): Colibri Page Builder \<= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4) - [CVE-2024-3340](https://cve.now/CVE-2024-3340.md): Colibri Page Builder \<= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri-gallery-slideshow' Shortcode (CVSS 5.4) - [CVE-2024-3337](https://cve.now/CVE-2024-3337.md): Colibri Page Builder \<= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri\_breadcrumb\_element' Shortcode (CVSS 6.4) - [CVE-2024-3338](https://cve.now/CVE-2024-3338.md): Colibri Page Builder \<= 1.0.262 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 4.4) - [CVE-2024-2839](https://cve.now/CVE-2024-2839.md): Colibri Page Builder \<= 1.0.263 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4) - [CVE-2024-28004](https://cve.now/CVE-2024-28004.md): WordPress Colibri Page Builder plugin \<= 1.0.248 - Broken Access Control vulnerability (CVSS 5.4) - [CVE-2024-1870](https://cve.now/CVE-2024-1870.md): Colibri Page Builder \<= 1.0.260 - Missing Authorization (CVSS 4.3) - [CVE-2024-1360](https://cve.now/CVE-2024-1360.md): Colibri WP \<= 1.0.94 - Cross-Site Request Forgery to Limited Plugin Installation (CVSS 4.3) - [CVE-2024-1362](https://cve.now/CVE-2024-1362.md): Colibri Page Builder \<= 1.0.253 - Cross-Site Request Fogery via cp\_shortcode\_refresh (CVSS 4.3) - [CVE-2024-1361](https://cve.now/CVE-2024-1361.md): Colibri Page Builder \<= 1.0.253 - Cross-Site Request Fogery via extend\_builder (CVSS 4.3) - [CVE-2023-6988](https://cve.now/CVE-2023-6988.md): Colibri Page Builder \<= 1.0.239 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4) - [CVE-2023-50833](https://cve.now/CVE-2023-50833.md): WordPress Colibri Page Builder Plugin \<= 1.0.239 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5) - [CVE-2023-2188](https://cve.now/CVE-2023-2188.md): Colibri Page Builder \<= 1.0.227 - Authenticated (Administrator+) SQL Injection via post\_id (CVSS 7.2) - [CVE-2019-25142](https://cve.now/CVE-2019-25142.md): Mesmerize \<= 1.6.89 & Materialis \<= 1.0.172 - Authenticated Arbitrary Options Update (CVSS 8.8) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/vendors/extendthemes Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.