Themeisle vulnerabilities
123 CVEs and advisories name Themeisle as an affected vendor, newest first. Follow it as a feed.
- CVE-2017-20251WordPress Insert PHP Plugin < 3.3.1 PHP Code Injection via REST API
- CVE-2026-8976RSS Aggregator by Feedzy <= 5.1.7 - Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions
- CVE-2025-53209WordPress Masteriyo LMS PRO plugin <= 2.20.0 - Privilege Escalation Vulnerability
- CVE-2026-8689Visualizer: Tables and Charts Manager for WordPress <= 3.11.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Chart Creation and Modification via renderChartPages() and uploadData() Functions
- CVE-2026-42749WordPress Disable Comments for Any Post Types (Remove comments) plugin <= 1.3.0 - Broken Authentication vulnerability
- CVE-2026-24573WordPress Visualizer plugin < 4.0.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-2892Otter Blocks <= 3.1.4 - Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie
- CVE-2026-25366WordPress Woody ad snippets plugin <= 2.7.1 - Remote Code Execution (RCE) vulnerability
- CVE-2026-2410Disable Admin Notices – Hide Dashboard Notifications <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update
- CVE-2026-1319Robin Image Optimizer <= 2.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Alternative Text Field
- CVE-2026-1755Menu Icons by ThemeIsle <= 0.13.20 - Authenticated (Author+) Stored Cross-Site Scripting
- CVE-2025-14800Redirection for Contact Form 7 <= 3.2.7 - Unauthenticated Arbitrary File Copy via move_file_to_upload
- CVE-2025-13794Auto Featured Image <= 4.2.1 - Missing Authorization to Authenticated (Contributor+) Post Thumbnail Modification
- CVE-2025-11467RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 5.1.1 - Unauthenticated Blind Server-Side Request Forgery
- CVE-2025-12483Visualizer: Tables and Charts Manager for WordPress <= 3.11.12 - Authenticated (Contributor+) SQL Injection
- CVE-2025-66069WordPress PPOM for WooCommerce plugin <= 33.0.16 - Broken Access Control vulnerability
- CVE-2025-12045Orbit Fox Companion <= 3.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Taxonomy
- CVE-2025-9322Stripe Payment Forms <= 8.3.1 - Unauthenticated SQL Injection
- CVE-2025-11128Feedzy RSS Feeds Lite <= 5.1.0 - Authenticated (Subscriber+) Server-Side Request Forgery
- CVE-2025-11691PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated SQL Injection
- CVE-2025-11391PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Upload
- CVE-2025-9562Redirection for Contact Form 7 <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcode
- CVE-2025-58789WordPress WP Full Stripe Free Plugin <= 8.2.5 - SQL Injection Vulnerability
- CVE-2025-58593WordPress Orbit Fox by ThemeIsle Plugin <= 3.0.0 - Cross Site Scripting (XSS) Vulnerability
- CVE-2025-55715WordPress Otter - Gutenberg Block Plugin <= 3.1.0 - Sensitive Data Exposure Vulnerability
- CVE-2025-8141Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated Arbitrary File Deletion
- CVE-2025-8289Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection via PHAR Deserialization
- CVE-2025-8145Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection
- CVE-2025-53986WordPress Hestia theme <= 3.2.10 - Broken Access Control Vulnerability
- CVE-2025-53254WordPress Cyrlitera plugin <= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability