Themeisle vulnerabilities

Products

• Redirection For Contact Form 7 17
• Rss Aggregator By Feedzy – Feed To Post, Autoblogging, News & Youtube Video Feeds Aggregator 16
• Orbit Fox 15
• Orbit Fox: Duplicate Page, Menu Icons, Svg Support, Cookie Notice, Custom Fonts & More 14
• Visualizer 14
• Multiple Page Generator Plugin – Mpg 11
• Otter Blocks – Gutenberg Blocks, Page Builder For Gutenberg Editor & Fse 11
• Multiple Page Generator 10
• Otter Blocks 10
• Rss Aggregator By Feedzy 9
• Visualizer: Tables And Charts Manager For Wordpress 8
• Auto Featured Image (auto Post Thumbnail) 7
• Wp Full Stripe Free 7
• Orbit Fox By Themeisle 6
• Mpg 5
• Ppom For Woocommerce 5
• Ppom – Product Addons & Custom Fields For Woocommerce 5
• Product Addons \& Fields For Woocommerce 4
• Menu Icons By Themeisle 3
• Ai Chatbot For Wordpress – Hyve Lite 2
• Hestia 2
• Lightstart – Maintenance Mode, Coming Soon And Landing Page Builder 2
• Otter - Gutenberg Block 2
• Product Addons & Fields For Woocommerce 2
• Stripe Payment Forms By Wp Full Pay – Accept Credit Card Payments, Donations & Subscriptions 2
• Visualizer – Tables & Charts Manager With Built-in Ai Generator 2
• Woody Ad Snippets 2
• Woody Code Snippets – Insert Php, Css, Js, And Header/footer Scripts 2

Newest

• themeisle multiple pages generator by themeisle Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url CVE-2026-119054 5.1 MediumOctober 29, 2026
• themeisle rss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregator RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element CVE-2026-110707 4.7 MediumOctober 29, 2026
• themeisle redirection for contact form 7 Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox CVE-2026-111574 7.5 HighOctober 21, 2026
• themeisle rss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregator RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL CVE-2026-109207 7.2 HighOctober 16, 2026
• themeisle ppom – product addons & custom fields for woocommerce PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter CVE-2026-104801 9.1 CriticalOctober 10, 2026
• themeisle rss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregator RSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title> CVE-2026-104735 6.4 MediumOctober 10, 2026
• themeisle mpg MPG < 4.2.3 - Editor+ SQLi via Project Import CVE-2026-104953 6.8 MediumOctober 7, 2026
• themeisle ai chatbot for wordpress – hyve lite WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-97305 6.9 MediumOctober 5, 2026
• themeisle mpg MPG < 4.2.3 - Editor+ Arbitrary File Read via Project Import CVE-2026-103293 6.8 MediumOctober 3, 2026
• themeisle otter blocks – gutenberg blocks, page builder for gutenberg editor & fse Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget CVE-2026-102002 3.1 LowOctober 2, 2026
• themeisle wp full stripe free WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability CVE-2026-62073 7.5 HighOctober 1, 2026
• themeisle mpg WordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerability CVE-2026-97302 5.3 MediumSeptember 30, 2026
• themeisle visualizer Visualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data Source CVE-2026-86784 6.8 MediumSeptember 16, 2026
• themeisle mpg – multiple page generator, bulk landing pages & programmatic seo MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path CVE-2026-85198 6.5 MediumSeptember 12, 2026
• themeisle visualizer Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR CVE-2026-86782 5.5 MediumSeptember 11, 2026
• themeisle visualizer Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChart CVE-2026-86779 2.7 LowSeptember 11, 2026
• themeisle otter blocks – gutenberg blocks, page builder for gutenberg editor & fse Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass CVE-2026-4945 5.3 MediumSeptember 7, 2026
• themeisle redirection for contact form 7 Redirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Shortcode Execution via Action Setting Mail-Tags CVE-2026-80439 4.8 MediumSeptember 6, 2026
• themeisle visualizer Visualizer < 4.0.7 - Contributor+ Cross-User Chart Configuration Disclosure CVE-2026-19726 6.5 MediumAugust 16, 2026
• themeisle wp full stripe free WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-61960 7.1 HighAugust 13, 2026
• themeisle visualizer Visualizer: Tables and Charts Manager < 4.0.6 - Contributor+ Server-Side Request Forgery via JSON Import CVE-2026-14939 6.8 MediumAugust 4, 2026
• themeisle feedzy WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-66437 4.9 MediumJuly 27, 2026
• themeisle orbit fox by themeisle WordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerability CVE-2026-65563 5.9 MediumJuly 27, 2026
• themeisle mpg Multiple Page Generator Plugin – MPG < 4.1.8 - Reflected XSS via mpg_shortcode CVE-2026-13726 7.1 HighJuly 27, 2026
• themeisle visualizer – tables & charts manager with built-in ai generator Visualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter CVE-2026-15653 6.4 MediumJuly 24, 2026
• themeisle cyr to lat reloaded – transliteration of links and file names WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability CVE-2026-65537 4.3 MediumJuly 23, 2026
• themeisle visualizer WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability CVE-2026-65526 8.5 HighJuly 23, 2026
• themeisle auto featured image (auto post thumbnail) WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 5.0.4 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-61970 4.9 MediumJuly 13, 2026
• themeisle rss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregator RSS Aggregator by Feedzy <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aspectRatio' Attribute CVE-2026-13252 6.4 MediumJuly 2, 2026
• themeisle visualizer – tables & charts manager with built-in ai generator Visualizer <= 4.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint CVE-2026-13468 7.5 HighJuly 1, 2026
• themeisle stripe payment forms by wp full pay – accept credit card payments, donations & subscriptions Stripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter CVE-2026-12432 Public exploit 5.3 MediumJune 27, 2026
• themeisle neve pro WordPress Neve PRO theme <= 3.1.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-57618 6.5 MediumJune 26, 2026
• themeisle ppom for woocommerce WordPress PPOM for WooCommerce plugin <= 33.0.18 - Broken Access Control vulnerability CVE-2026-56050 6.5 MediumJune 25, 2026
• themeisle orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter CVE-2026-11358 4.4 MediumJune 18, 2026
• themeisle wp full stripe free WordPress WP Full Stripe Free plugin <= 8.4.1 - Broken Authentication vulnerability CVE-2026-42378 6.5 MediumJune 15, 2026
• themeisle social slider feed WordPress Social Slider Feed plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-39507 7.1 HighJune 15, 2026
• themeisle redirection for contact form 7 WordPress Redirection for Contact Form 7 plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability CVE-2026-23970 7.1 HighJune 15, 2026
• themeisle woody code snippets WordPress Insert PHP Plugin < 3.3.1 PHP Code Injection via REST API CVE-2017-20251 Public exploit 9.3 CriticalJune 9, 2026
• themeisle rss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregator RSS Aggregator by Feedzy <= 5.1.7 - Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions CVE-2026-8976 4.3 MediumJune 5, 2026
• themeisle masteriyo lms pro WordPress Masteriyo LMS PRO plugin <= 2.20.0 - Privilege Escalation Vulnerability CVE-2025-53209 9.8 CriticalJune 2, 2026
• themeisle visualizer: tables and charts manager for wordpress Visualizer: Tables and Charts Manager for WordPress <= 3.11.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Chart Creation and Modification via renderChartPages() and uploadData()… CVE-2026-8689 4.3 MediumMay 28, 2026
• themeisle disable comments for any post types (remove comments) WordPress Disable Comments for Any Post Types (Remove comments) plugin <= 1.3.0 - Broken Authentication vulnerability CVE-2026-42749 7.1 HighMay 27, 2026
• themeisle visualizer WordPress Visualizer plugin < 4.0.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-24573 6.5 MediumMay 20, 2026
• themeisle otter blocks – gutenberg blocks, page builder for gutenberg editor & fse Otter Blocks <= 3.1.4 - Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie CVE-2026-2892 7.5 HighApril 30, 2026
• themeisle woody ad snippets WordPress Woody ad snippets plugin <= 2.7.1 - Remote Code Execution (RCE) vulnerability CVE-2026-25366 9.9 CriticalMarch 25, 2026
• themeisle disable admin notices – hide dashboard notifications Disable Admin Notices – Hide Dashboard Notifications <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update CVE-2026-2410 4.3 MediumFebruary 25, 2026
• themeisle robin image optimizer – unlimited image optimization & webp converter Robin Image Optimizer <= 2.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Alternative Text Field CVE-2026-1319 6.4 MediumFebruary 5, 2026
• themeisle menu icons by themeisle Menu Icons by ThemeIsle <= 0.13.20 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2026-1755 6.4 MediumFebruary 3, 2026
• themeisle redirection for contact form 7 Redirection for Contact Form 7 <= 3.2.7 - Unauthenticated Arbitrary File Copy via move_file_to_upload CVE-2025-14800 8.1 HighDecember 21, 2025
• themeisle auto featured image (auto post thumbnail) Auto Featured Image <= 4.2.1 - Missing Authorization to Authenticated (Contributor+) Post Thumbnail Modification CVE-2025-13794 4.3 MediumDecember 16, 2025
• Show olderLoading…