Themeisle vulnerabilities
123 CVEs and advisories name Themeisle as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-22659WordPress Orbit Fox by ThemeIsle plugin <= 2.10.44 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-1065Visualizer: Tables and Charts Manager for WordPress <= 3.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Import Data From File
- CVE-2024-10705Multiple Page Generator Plugin – MPG <= 4.0.5 - Authenticated (Editor+) Server-Side Request Forgery via fileUrl
- CVE-2025-24666WordPress Hyve Lite plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-24668WordPress PPOM for WooCommerce plugin <= 33.0.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-13183Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter
- CVE-2025-0311Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget
- CVE-2024-37467WordPress Hestia theme <= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2023-39920WordPress Redirection for Contact Form 7 plugin <= 2.9.2 - Broken Access Control vulnerability
- CVE-2024-11219Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.6 - Unauthetnicated Path Traversal to Arbitrary Image View
- CVE-2024-52420WordPress Disable Admin Notices individually plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-51671WordPress Otter Blocks plugin <= 3.0.3 - Broken Access Control vulnerability
- CVE-2024-10672Multiple Page Generator Plugin – MPG <= 4.0.2 - Authenticated (Editor+) Directory Traversal to Limited File Deletion
- CVE-2024-10367Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-7424Multiple Page Generator Plugin – MPG <= 4.0.1 - Missing Authorization
- CVE-2024-47325WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.7 - SQL Injection vulnerability
- CVE-2022-4974Freemius SDK <= 2.4.2 - Missing Authorization Checks
- CVE-2024-7778Orbit Fox by ThemeIsle <= 2.10.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-2484Orbit Fox by ThemeIsle <= 2.10.34 - Authenticated (Contributor+) Stored Cross-Site Scripting via Services and Post Type Grid Widgets
- CVE-2024-3105Woody code snippets – Insert Header Footer Code, AdSense Ads <= 2.5.0 -Authenticated (Contributor+) Remote Code Execution
- CVE-2024-35728WordPress Product Addons & Fields for WooCommerce plugin <= 32.0.20 - Content Injection vulnerability
- CVE-2024-35682WordPress Otter Blocks PRO plugin <= 2.6.11 - Authenticated Sensitive Data Exposure vulnerability
- CVE-2024-35736WordPress Visualizer plugin <= 3.11.1 - SQL Injection vulnerability
- CVE-2023-7073Auto Featured Image (Auto Post Thumbnail) <= 4.1.7 - Authenticated (Author+) Server-Side Request Forgery
- CVE-2024-4635Menu Icons by ThemeIsle <= 0.13.13 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
- CVE-2024-3750Visualizer: Tables and Charts Manager for WordPress <= 3.10.15 - Missing Authorization to Arbitrary SQL Execution
- CVE-2024-3725Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag'
- CVE-2024-3962Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file
- CVE-2023-6805RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.7 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF)
- CVE-2024-31301WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.0 - Cross Site Request Forgery (CSRF) vulnerability