# cve.now: Themeisle

The newest entries naming Themeisle as an affected vendor (up to 200), of 123 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121519](https://cve.now/CVE-2026-121519.md): Social Slider Feed \<= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' Parameter (CVSS 6.4)
- [CVE-2026-120035](https://cve.now/CVE-2026-120035.md): RSS Aggregator by Feedzy \<= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Title (CVSS 5.4)
- [CVE-2026-120659](https://cve.now/CVE-2026-120659.md): Redirection for Contact Form 7 \<= 3.2.14 - Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File… (CVSS 5.3)
- [CVE-2026-119054](https://cve.now/CVE-2026-119054.md): Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url (CVSS 5.1)
- [CVE-2026-110707](https://cve.now/CVE-2026-110707.md): RSS Aggregator by Feedzy \<= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element (CVSS 4.7)
- [CVE-2026-109207](https://cve.now/CVE-2026-109207.md): RSS Aggregator by Feedzy \<= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL (CVSS 7.2)
- [CVE-2026-104801](https://cve.now/CVE-2026-104801.md): PPOM \<= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom\[fields\]\[\<data\_name\>\]\[n\]\[org\]' Parameter (CVSS 9.1)
- [CVE-2026-104735](https://cve.now/CVE-2026-104735.md): RSS Aggregator by Feedzy \<= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS \<title\> (CVSS 6.4)
- [CVE-2026-97305](https://cve.now/CVE-2026-97305.md): WordPress AI Chatbot for WordPress – Hyve Lite plugin \<= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.9)
- [CVE-2026-102002](https://cve.now/CVE-2026-102002.md): Otter Blocks \<= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget (CVSS 3.1)
- [CVE-2026-62073](https://cve.now/CVE-2026-62073.md): WordPress WP Full Stripe Free plugin \<= 8.5.6 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-97302](https://cve.now/CVE-2026-97302.md): WordPress MPG plugin \<= 4.2.3 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2026-85198](https://cve.now/CVE-2026-85198.md): MPG \<= 4.2.1 - Unauthenticated SQL Injection via URL Path (CVSS 6.5)
- [CVE-2026-4945](https://cve.now/CVE-2026-4945.md): Otter Blocks \<= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass (CVSS 5.3)
- [CVE-2026-61960](https://cve.now/CVE-2026-61960.md): WordPress WP Full Stripe Free plugin \<= 8.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-66437](https://cve.now/CVE-2026-66437.md): WordPress Feedzy plugin \<= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9)
- [CVE-2026-65563](https://cve.now/CVE-2026-65563.md): WordPress Orbit Fox by ThemeIsle plugin \<= 3.0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2026-15653](https://cve.now/CVE-2026-15653.md): Visualizer \<= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter (CVSS 6.4)
- [CVE-2026-65537](https://cve.now/CVE-2026-65537.md): WordPress Cyr to Lat reloaded – transliteration of links and file names plugin \<= 1.3.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-65526](https://cve.now/CVE-2026-65526.md): WordPress Visualizer plugin \<= 4.0.1 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-61970](https://cve.now/CVE-2026-61970.md): WordPress Auto Featured Image (Auto Post Thumbnail) plugin \<= 5.0.4 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9)
- [CVE-2026-13252](https://cve.now/CVE-2026-13252.md): RSS Aggregator by Feedzy \<= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aspectRatio' Attribute (CVSS 6.4)
- [CVE-2026-13468](https://cve.now/CVE-2026-13468.md): Visualizer \<= 4.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint (CVSS 7.5)
- [CVE-2026-12432](https://cve.now/CVE-2026-12432.md): Stripe Payment Forms by WP Full Pay \<= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter (CVSS 5.3)
- [CVE-2026-57618](https://cve.now/CVE-2026-57618.md): WordPress Neve PRO theme \<= 3.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-56050](https://cve.now/CVE-2026-56050.md): WordPress PPOM for WooCommerce plugin \<= 33.0.18 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-11358](https://cve.now/CVE-2026-11358.md): Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More \<= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter (CVSS 4.4)
- [CVE-2026-42378](https://cve.now/CVE-2026-42378.md): WordPress WP Full Stripe Free plugin \<= 8.4.1 - Broken Authentication vulnerability (CVSS 6.5)
- [CVE-2026-39507](https://cve.now/CVE-2026-39507.md): WordPress Social Slider Feed plugin \<= 2.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-23970](https://cve.now/CVE-2026-23970.md): WordPress Redirection for Contact Form 7 plugin \<= 3.2.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2017-20251](https://cve.now/CVE-2017-20251.md): WordPress Insert PHP Plugin \< 3.3.1 PHP Code Injection via REST API (CVSS 9.3)
- [CVE-2026-8976](https://cve.now/CVE-2026-8976.md): RSS Aggregator by Feedzy \<= 5.1.7 - Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions (CVSS 4.3)
- [CVE-2025-53209](https://cve.now/CVE-2025-53209.md): WordPress Masteriyo LMS PRO plugin \<= 2.20.0 - Privilege Escalation Vulnerability (CVSS 9.8)
- [CVE-2026-8689](https://cve.now/CVE-2026-8689.md): Visualizer: Tables and Charts Manager for WordPress \<= 3.11.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Chart Creation and Modification via renderChartPages() and uploadData() Functions (CVSS 4.3)
- [CVE-2026-42749](https://cve.now/CVE-2026-42749.md): WordPress Disable Comments for Any Post Types (Remove comments) plugin \<= 1.3.0 - Broken Authentication vulnerability (CVSS 7.1)
- [CVE-2026-24573](https://cve.now/CVE-2026-24573.md): WordPress Visualizer plugin \< 4.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-2892](https://cve.now/CVE-2026-2892.md): Otter Blocks \<= 3.1.4 - Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie (CVSS 7.5)
- [CVE-2026-25366](https://cve.now/CVE-2026-25366.md): WordPress Woody ad snippets plugin \<= 2.7.1 - Remote Code Execution (RCE) vulnerability (CVSS 9.9)
- [CVE-2026-2410](https://cve.now/CVE-2026-2410.md): Disable Admin Notices – Hide Dashboard Notifications \<= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update (CVSS 4.3)
- [CVE-2026-1319](https://cve.now/CVE-2026-1319.md): Robin Image Optimizer \<= 2.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Alternative Text Field (CVSS 6.4)
- [CVE-2026-1755](https://cve.now/CVE-2026-1755.md): Menu Icons by ThemeIsle \<= 0.13.20 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-14800](https://cve.now/CVE-2025-14800.md): Redirection for Contact Form 7 \<= 3.2.7 - Unauthenticated Arbitrary File Copy via move\_file\_to\_upload (CVSS 8.1)
- [CVE-2025-13794](https://cve.now/CVE-2025-13794.md): Auto Featured Image \<= 4.2.1 - Missing Authorization to Authenticated (Contributor+) Post Thumbnail Modification (CVSS 4.3)
- [CVE-2025-11467](https://cve.now/CVE-2025-11467.md): RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator \<= 5.1.1 - Unauthenticated Blind Server-Side Request Forgery (CVSS 5.8)
- [CVE-2025-12483](https://cve.now/CVE-2025-12483.md): Visualizer: Tables and Charts Manager for WordPress \<= 3.11.12 - Authenticated (Contributor+) SQL Injection (CVSS 6.5)
- [CVE-2025-66069](https://cve.now/CVE-2025-66069.md): WordPress PPOM for WooCommerce plugin \<= 33.0.16 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-12045](https://cve.now/CVE-2025-12045.md): Orbit Fox Companion \<= 3.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Taxonomy (CVSS 6.4)
- [CVE-2025-9322](https://cve.now/CVE-2025-9322.md): Stripe Payment Forms \<= 8.3.1 - Unauthenticated SQL Injection (CVSS 7.5)
- [CVE-2025-11128](https://cve.now/CVE-2025-11128.md): Feedzy RSS Feeds Lite \<= 5.1.0 - Authenticated (Subscriber+) Server-Side Request Forgery (CVSS 5.0)
- [CVE-2025-11691](https://cve.now/CVE-2025-11691.md): PPOM – Product Addons & Custom Fields for WooCommerce \<= 33.0.15 - Unauthenticated SQL Injection (CVSS 7.5)
- [CVE-2025-11391](https://cve.now/CVE-2025-11391.md): PPOM – Product Addons & Custom Fields for WooCommerce \<= 33.0.15 - Unauthenticated Arbitrary File Upload (CVSS 9.8)
- [CVE-2025-9562](https://cve.now/CVE-2025-9562.md): Redirection for Contact Form 7 \<= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs\_date Shortcode (CVSS 6.4)
- [CVE-2025-58789](https://cve.now/CVE-2025-58789.md): WordPress WP Full Stripe Free Plugin \<= 8.2.5 - SQL Injection Vulnerability (CVSS 7.6)
- [CVE-2025-58593](https://cve.now/CVE-2025-58593.md): WordPress Orbit Fox by ThemeIsle Plugin \<= 3.0.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-55715](https://cve.now/CVE-2025-55715.md): WordPress Otter - Gutenberg Block Plugin \<= 3.1.0 - Sensitive Data Exposure Vulnerability (CVSS 7.5)
- [CVE-2025-8141](https://cve.now/CVE-2025-8141.md): Redirection for Contact Form 7 \<= 3.2.4 - Unauthenticated Arbitrary File Deletion (CVSS 8.8)
- [CVE-2025-8289](https://cve.now/CVE-2025-8289.md): Redirection for Contact Form 7 \<= 3.2.4 - Unauthenticated PHP Object Injection via PHAR Deserialization (CVSS 7.5)
- [CVE-2025-8145](https://cve.now/CVE-2025-8145.md): Redirection for Contact Form 7 \<= 3.2.4 - Unauthenticated PHP Object Injection (CVSS 8.8)
- [CVE-2025-53986](https://cve.now/CVE-2025-53986.md): WordPress Hestia theme \<= 3.2.10 - Broken Access Control Vulnerability (CVSS 5.3)
- [CVE-2025-53254](https://cve.now/CVE-2025-53254.md): WordPress Cyrlitera plugin \<= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-22659](https://cve.now/CVE-2025-22659.md): WordPress Orbit Fox by ThemeIsle plugin \<= 2.10.44 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-1065](https://cve.now/CVE-2025-1065.md): Visualizer: Tables and Charts Manager for WordPress \<= 3.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Import Data From File (CVSS 6.4)
- [CVE-2024-10705](https://cve.now/CVE-2024-10705.md): Multiple Page Generator Plugin – MPG \<= 4.0.5 - Authenticated (Editor+) Server-Side Request Forgery via fileUrl (CVSS 5.4)
- [CVE-2025-24666](https://cve.now/CVE-2025-24666.md): WordPress Hyve Lite plugin \<= 1.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2025-24668](https://cve.now/CVE-2025-24668.md): WordPress PPOM for WooCommerce plugin \<= 33.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-13183](https://cve.now/CVE-2024-13183.md): Orbit Fox by ThemeIsle \<= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title\_tag Parameter (CVSS 6.4)
- [CVE-2025-0311](https://cve.now/CVE-2025-0311.md): Orbit Fox by ThemeIsle \<= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget (CVSS 6.4)
- [CVE-2024-37467](https://cve.now/CVE-2024-37467.md): WordPress Hestia theme \<= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2023-39920](https://cve.now/CVE-2023-39920.md): WordPress Redirection for Contact Form 7 plugin \<= 2.9.2 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2024-11219](https://cve.now/CVE-2024-11219.md): Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 3.0.6 - Unauthetnicated Path Traversal to Arbitrary Image View (CVSS 5.3)
- [CVE-2024-52420](https://cve.now/CVE-2024-52420.md): WordPress Disable Admin Notices individually plugin \<= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-51671](https://cve.now/CVE-2024-51671.md): WordPress Otter Blocks plugin \<= 3.0.3 - Broken Access Control vulnerability (CVSS 2.7)
- [CVE-2024-10672](https://cve.now/CVE-2024-10672.md): Multiple Page Generator Plugin – MPG \<= 4.0.2 - Authenticated (Editor+) Directory Traversal to Limited File Deletion (CVSS 2.7)
- [CVE-2024-10367](https://cve.now/CVE-2024-10367.md): Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4)
- [CVE-2024-7424](https://cve.now/CVE-2024-7424.md): Multiple Page Generator Plugin – MPG \<= 4.0.1 - Missing Authorization (CVSS 5.4)
- [CVE-2024-47325](https://cve.now/CVE-2024-47325.md): WordPress Multiple Page Generator Plugin – MPG plugin \<= 3.4.7 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2022-4974](https://cve.now/CVE-2022-4974.md): Freemius SDK \<= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- [CVE-2024-7778](https://cve.now/CVE-2024-7778.md): Orbit Fox by ThemeIsle \<= 2.10.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4)
- [CVE-2024-2484](https://cve.now/CVE-2024-2484.md): Orbit Fox by ThemeIsle \<= 2.10.34 - Authenticated (Contributor+) Stored Cross-Site Scripting via Services and Post Type Grid Widgets (CVSS 6.4)
- [CVE-2024-3105](https://cve.now/CVE-2024-3105.md): Woody code snippets – Insert Header Footer Code, AdSense Ads \<= 2.5.0 -Authenticated (Contributor+) Remote Code Execution (CVSS 9.9)
- [CVE-2024-35728](https://cve.now/CVE-2024-35728.md): WordPress Product Addons & Fields for WooCommerce plugin \<= 32.0.20 - Content Injection vulnerability (CVSS 5.3)
- [CVE-2024-35682](https://cve.now/CVE-2024-35682.md): WordPress Otter Blocks PRO plugin \<= 2.6.11 - Authenticated Sensitive Data Exposure vulnerability (CVSS 4.3)
- [CVE-2024-35736](https://cve.now/CVE-2024-35736.md): WordPress Visualizer plugin \<= 3.11.1 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2023-7073](https://cve.now/CVE-2023-7073.md): Auto Featured Image (Auto Post Thumbnail) \<= 4.1.7 - Authenticated (Author+) Server-Side Request Forgery (CVSS 6.4)
- [CVE-2024-4635](https://cve.now/CVE-2024-4635.md): Menu Icons by ThemeIsle \<= 0.13.13 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload (CVSS 6.4)
- [CVE-2024-3750](https://cve.now/CVE-2024-3750.md): Visualizer: Tables and Charts Manager for WordPress \<= 3.10.15 - Missing Authorization to Arbitrary SQL Execution (CVSS 8.8)
- [CVE-2024-3725](https://cve.now/CVE-2024-3725.md): Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' (CVSS 6.4)
- [CVE-2024-3962](https://cve.now/CVE-2024-3962.md): Product Addons & Fields for WooCommerce \<= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom\_upload\_file (CVSS 9.8)
- [CVE-2023-6805](https://cve.now/CVE-2023-6805.md): RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator \<= 4.4.7 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF) (CVSS 6.4)
- [CVE-2024-31301](https://cve.now/CVE-2024-31301.md): WordPress Multiple Page Generator Plugin – MPG plugin \<= 3.4.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2024-3344](https://cve.now/CVE-2024-3344.md): Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 2.6.8 - Authenticated (Author+) Limited File Upload to Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-3343](https://cve.now/CVE-2024-3343.md): Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes (CVSS 6.4)
- [CVE-2024-2226](https://cve.now/CVE-2024-2226.md): Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2023-6877](https://cve.now/CVE-2023-6877.md): RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator \<= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Error Message (CVSS 6.4)
- [CVE-2024-27951](https://cve.now/CVE-2024-27951.md): WordPress Multiple Page Generator Plugin \<= 3.4.0 - Auth. Remote Code Execution (RCE) vulnerability (CVSS 9.1)
- [CVE-2024-2841](https://cve.now/CVE-2024-2841.md): Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-30235](https://cve.now/CVE-2024-30235.md): WordPress Multiple Page Generator Plugin – MPG plugin \<= 3.4.0 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-27958](https://cve.now/CVE-2024-27958.md): WordPress Visualizer plugin \<= 3.10.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-1499](https://cve.now/CVE-2024-1499.md): Orbit Fox by ThemeIsle \<= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-1497](https://cve.now/CVE-2024-1497.md): Orbit Fox by ThemeIsle \<= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via form widget addr2\_width attribute (CVSS 6.4)
- [CVE-2024-2126](https://cve.now/CVE-2024-2126.md): Orbit Fox by ThemeIsle \<= 2.10.32 - Authenticated (Contributor+) Stored Cross-Site Scripiting via Registration Form Widget (CVSS 6.4)
- [CVE-2024-1323](https://cve.now/CVE-2024-1323.md): Orbit Fox by ThemeIsle \<= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-1317](https://cve.now/CVE-2024-1317.md): RSS Aggregator by Feedzy \<= 4.4.2 - Authenticated(Contributor+) SQL Injection (CVSS 8.8)
- [CVE-2024-1318](https://cve.now/CVE-2024-1318.md): RSS Aggregator by Feedzy \<= 4.4.2 - Missing Authorization to Arbitrary Page Creation and Publication (CVSS 6.5)
- [CVE-2024-0508](https://cve.now/CVE-2024-0508.md): Orbit Fox by ThemeIsle \<= 2.10.27 - Authenticated(Contributor+) Stored Cross-site Scripting via Pricing Table Elementor Widget (CVSS 6.4)
- [CVE-2024-1092](https://cve.now/CVE-2024-1092.md): RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator \<= 4.4.1 - Missing Authorization (CVSS 4.3)
- [CVE-2024-1162](https://cve.now/CVE-2024-1162.md): Orbit Fox by ThemeIsle \<= 2.10.29 - Cross-Site Request Forgery (CVSS 4.3)
- [CVE-2024-1047](https://cve.now/CVE-2024-1047.md): ThemeIsle SDK \<= Various Versions - Missing Authorization (CVSS 5.3)
- [CVE-2023-7019](https://cve.now/CVE-2023-7019.md): LightStart – Maintenance Mode, Coming Soon and Landing Page Builder \<= 2.6.8 - Missing Authorization (CVSS 4.3)
- [CVE-2023-6781](https://cve.now/CVE-2023-6781.md): Orbit Fox Companion \<= 2.10.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields (CVSS 6.4)
- [CVE-2023-6798](https://cve.now/CVE-2023-6798.md): RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator \<= 4.3.2 - Missing Authorization (CVSS 5.4)
- [CVE-2023-6801](https://cve.now/CVE-2023-6801.md): RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator \<= 4.3.2 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2023-47529](https://cve.now/CVE-2023-47529.md): WordPress Cloud Templates & Patterns collection Plugin \<= 1.2.2 is vulnerable to Sensitive Data Exposure (CVSS 5.3)
- [CVE-2023-33927](https://cve.now/CVE-2023-33927.md): WordPress Multiple Page Generator Plugin – MPG Plugin \<= 3.3.19 is vulnerable to SQL Injection (CVSS 7.6)
- [CVE-2020-36759](https://cve.now/CVE-2020-36759.md): Woody code snippets \<= 2.3.9 - Cross-Site Request Forgery Bypass (CVSS 4.3)
- [CVE-2020-36758](https://cve.now/CVE-2020-36758.md): RSS Aggregator by Feedzy \<= 3.4.2 - Cross-Site Request Forgery Bypass (CVSS 4.3)
- [CVE-2023-4887](https://cve.now/CVE-2023-4887.md): Google Maps Plugin by Intergeo \<= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2023-2607](https://cve.now/CVE-2023-2607.md): Multiple Page Generator Plugin \<= 3.3.17 - Authenticated (Administrator+) SQL Injection (CVSS 7.2)
- [CVE-2023-2608](https://cve.now/CVE-2023-2608.md): Multiple Page Generator Plugin \<= 3.3.17 - Cross-Site Request Forgery to SQL Injection (CVSS 3.1)
- [CVE-2023-23708](https://cve.now/CVE-2023-23708.md): WordPress Visualizer Plugin \<= 3.9.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2022-46848](https://cve.now/CVE-2022-46848.md): WordPress Visualizer Plugin \<= 3.9.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2022-47143](https://cve.now/CVE-2022-47143.md): WordPress Multiple Page Generator Plugin – MPG Plugin \<= 3.3.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2022-2444](https://cve.now/CVE-2022-2444.md): Visualizer: Tables and Charts Manager for WordPress \<= 3.7.9 - Authenticated (Contributor+) PHAR Deserialization (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/themeisle
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.