Imithemes vulnerabilities

Products

• Eventer 13
• Eventer - Wordpress Event & Booking Manager Plugin 6
• Nativechurch 2
• Real Spaces - Wordpress Properties Directory Theme 2

Newest

• imithemes eventer WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-27394 7.1 HighOctober 29, 2026
• imithemes nativechurch NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php CVE-2014-125133 8.7 HighOctober 20, 2026
• imithemes eventer Eventer <= 4.4.2 - Unauthenticated SQL Injection via 'code' Parameter CVE-2026-9700 7.5 HighJuly 8, 2026
• imithemes eventer Eventer <= 4.4.2 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation CVE-2026-9701 9.8 CriticalJuly 8, 2026
• imithemes nativechurch WordPress NativeChurch theme < 4.9.5 - Cross Site Scripting (XSS) vulnerability CVE-2026-27408 7.1 HighJuly 2, 2026
• imithemes gaea WordPress Gaea theme < 3.8 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-32518 7.1 HighMarch 25, 2026
• imithemes real spaces - wordpress properties directory theme Real Spaces - WordPress Properties Directory Theme <= 3.6 - Unauthenticated Privilege Escalation to Administrator via 'imic_agent_register' CVE-2025-6758 Public exploit 9.8 CriticalAugust 19, 2025
• imithemes real spaces - wordpress properties directory theme Real Spaces - WordPress Properties Directory Theme <= 3.5 - Authenticated (Subscriber+) Privilege Escalation to Administrator via 'change_role_member' CVE-2025-8218 8.8 HighAugust 19, 2025
• imithemes eventer WordPress Eventer plugin < 3.9.9.1 - Content Injection vulnerability CVE-2025-39483 6.5 MediumAugust 14, 2025
• imithemes eventer WordPress Eventer plugin < 3.11.4 - SQL Injection vulnerability CVE-2025-39481 9.3 CriticalMay 16, 2025
• imithemes eventer WordPress Eventer plugin < 3.11.4 - Broken Access Control vulnerability CVE-2025-39482 4.3 MediumMay 16, 2025
• imithemes listing IMITHEMES Listing <= 3.3 - Unauthenticated Privilege Escalation via Unverified Password Reset CVE-2025-2253 9.8 CriticalMay 9, 2025
• imithemes eventer, eventer - wordpress event & booking manager plugin +1 more Eventer - WordPress Event & Booking Manager Plugin <= 3.9.9.2 - Authenticated (Subscriber+) SQL Injection via reg_id CVE-2025-0959 8.8 HighMarch 7, 2025
• imithemes eventer WordPress Eventer - WordPress Event & Booking Manager Plugin plugin < 3.9.9 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-22635 7.1 HighFebruary 23, 2025
• imithemes eventer, eventer - wordpress event & booking manager plugin +1 more Eventer <= 3.9.9 - Missing Authorization to Authenticated (Subscriber+) Bookings Export CVE-2024-11134 4.3 MediumFebruary 3, 2025
• imithemes eventer, eventer - wordpress event & booking manager plugin +1 more Eventer <= 3.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-11132 6.4 MediumFebruary 3, 2025
• imithemes eventer, eventer - wordpress event & booking manager plugin +1 more Eventer <= 3.9.9.5 - Missing Authorization to Unauthenticated Event Ticket Download CVE-2024-11133 5.3 MediumFebruary 3, 2025
• imithemes eventer, eventer - wordpress event & booking manager plugin +1 more Eventer <= 3.9.8 - Unauthenticated SQL Injection via eventer_get_attendees CVE-2024-11135 7.5 HighJanuary 28, 2025
• imithemes eventer, eventer - wordpress event & booking manager plugin +1 more Eventer <= 3.9.7 - Authenticated (Subscriber+) Arbitrary File Read CVE-2024-10799 6.5 MediumJanuary 17, 2025