Themesgrove vulnerabilities

Products

• All-in-one Addons For Elementor 6
• Widgetkit 4
• Wp Smartpay 2

Newest

• themesgrove widgetkit pro WordPress WidgetKit Pro plugin <= 1.13.1 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-46494 7.1 HighJanuary 7, 2026
• convers lab wp smartpay WordPress Download Manager and Payment Form plugin <= 2.8.2 - Price Manipulation vulnerability CVE-2025-32689 7.5 HighSeptember 9, 2025
• shamsbd71 all-in-one addons for elementor – widgetkit, themesgrove all-in-one addons for elementor +1 more All-in-One Addons for Elementor – WidgetKit <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via button+modal Widget CVE-2025-2330 6.4 MediumJuly 2, 2025
• convers lab wp smartpay WordPress WP SmartPay plugin <= 2.7.13 - Account Takeover vulnerability CVE-2025-25171 8.8 HighJune 27, 2025
• abu huraira bin aman widgetkit WordPress WidgetKit plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability CVE-2025-49074 6.5 MediumJune 6, 2025
• themesgrove download manager and payment form wordpress plugin – wp smartpay Download Manager and Payment Form WordPress Plugin – WP SmartPay 1.1.0 - 2.7.13 - Authenticated (Subscriber+) Information Exposure CVE-2025-3851 4.3 MediumMay 7, 2025
• shamsbd71 all-in-one addons for elementor – widgetkit, themesgrove all-in-one addons for elementor +1 more All-in-One Addons for Elementor – WidgetKit <= 2.5.5 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates CVE-2024-10321 4.3 MediumMarch 8, 2025
• themesgrove all-in-one addons for elementor, widgetkit +1 more WordPress All-in-One Addons for Elementor – WidgetKit plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability CVE-2024-37428 6.5 MediumJuly 22, 2024
• themesgrove widgetkit WordPress All-in-One Addons for Elementor – WidgetKit plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability CVE-2024-34548 6.5 MediumMay 8, 2024
• themesgrove widgetkit WordPress WidgetKit plugin <= 2.5.0 - Broken Access Control vulnerability CVE-2024-33908 5.3 MediumMay 6, 2024
• shamsbd71 all-in-one addons for elementor – widgetkit, themesgrove all-in-one addons for elementor +1 more All-in-One Addons for Elementor – WidgetKit <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Widgets CVE-2024-2137 6.4 MediumApril 12, 2024
• themesgrove onepage builder WordPress Onepage Builder – Easiest Landing Page Builder For WordPress Plugin <= 2.4.1 is vulnerable to SQL Injection CVE-2023-38391 6.7 MediumNovember 3, 2023
• themesgrove all-in-one addons for elementor All-in-One Addons for Elementor - WidgetKit < 2.4.4 - Admin+ Stored XSS CVE-2022-4256 4.8 MediumJanuary 2, 2023
• shamsbd71 all-in-one addons for elementor – widgetkit, themesgrove all-in-one addons for elementor +1 more All-in-One Addons for Elementor - WidgetKit < 2.3.10 - Contributor+ Stored XSS CVE-2021-24267 5.4 MediumMay 5, 2021