Themify vulnerabilities

Products

• Builder 6
• Woocommerce Product Filter 6
• Portfolio Post 5
• Ultra 5
• Ultra 5
• Shortcodes 3
• Post Type Builder (ptb) 2
• Edmin 2
• Folo 2

Newest

• themify popup, themifyme themify popup +1 more WordPress Themify Popup plugin <= 1.4.3 - PHP Object Injection vulnerability CVE-2026-56037 8.8 HighJuly 2, 2026
• themify folo WordPress Themify Folo theme <= 1.9.6 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-31013 7.1 HighJune 17, 2026
• themefy bloggie, themify photobox, rezo +6 more +8 more Arbitrary File Upload Vulnerability in WordPress themes by Themify CVE-2025-30996 9.9 CriticalJanuary 6, 2026
• themify shopo WordPress Shopo <= 1.1.4 - Arbitrary File Upload Vulnerability CVE-2025-31048 9.9 CriticalJanuary 5, 2026
• themify edmin WordPress Themify Edmin theme <= 2.0.0 - PHP Object Injection Vulnerability CVE-2025-31047 8.8 HighJanuary 5, 2026
• themify builder, themifyme themify builder +1 more Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting CVE-2024-13319 6.1 MediumJanuary 22, 2025
• themify builder, themifyme themify builder +1 more WordPress Themify Builder plugin <= 7.6.3 - Local File Inclusion vulnerability CVE-2024-56216 6.5 MediumDecember 31, 2024
• themify store locator, themifyme themify store locator +1 more Themify Store Locator <= 1.1.9 - Cross-Site Request Forgery CVE-2024-12414 4.3 MediumDecember 13, 2024
• themify builder, themifyme themify builder +1 more WordPress Themify Builder plugin <= 7.6.5 - Cross Site Scripting (XSS) vulnerability CVE-2024-52423 6.5 MediumNovember 18, 2024
• themify woocommerce product filter, themifyme themify – woocommerce product filter +1 more WordPress Themify plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability CVE-2024-44046 5.9 MediumOctober 6, 2024
• themify builder, themifyme themify builder +1 more Themify Builder <= 7.6.2 - Reflected Cross-Site Scripting CVE-2024-9385 6.1 MediumOctober 5, 2024
• themify builder, themifyme themify builder +1 more Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication CVE-2024-7836 4.3 MediumAugust 22, 2024
• themify shortcodes, themifyme themify shortcodes +1 more WordPress Themify Shortcodes plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability CVE-2024-43133 6.5 MediumAugust 12, 2024
• themify product filter, woocommerce product filter, themifyme themify – woocommerce product filter +2 more Themify - WooCommerce Product Filter <= 1.4.9 - Unauthenticated SQL Injection via conditions Parameter CVE-2024-6027 9.8 CriticalJune 21, 2024
• themify ultra WordPress Themify Ultra theme <= 7.3.5 - Multiple Broken Access Control vulnerability CVE-2023-46146 8.3 HighJune 19, 2024
• themify ultra WordPress Themify Ultra theme <= 7.3.5 - Authenticated Arbitrary Settings Change vulnerability CVE-2023-46148 8.8 HighJune 19, 2024
• themify builder, themifyme themify builder +1 more Themify Builder < 7.5.8 - Open Redirect CVE-2024-3032 6.1 MediumJune 13, 2024
• themify ultra WordPress Themify Ultra theme <= 7.3.5 - Authenticated Privilege Escalation vulnerability CVE-2023-46145 8.8 HighMay 17, 2024
• themify shortcodes, themifyme themify shortcodes +1 more Themify Shortcodes <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify_button Shortcode CVE-2024-4567 6.4 MediumMay 9, 2024
• themify post type builder (ptb) WordPress Post Type Builder (PTB) plugin <= 2.0.8 - Auth. Arbitrary Post/Page Creation vulnerability CVE-2024-31366 7.1 HighApril 9, 2024
• themify post type builder (ptb) WordPress Post Type Builder (PTB) plugin < 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-31365 7.1 HighApril 9, 2024
• themify woocommerce product filter, unknown themify +1 more WooCommerce Product Filter < 1.4.4 - Admin+ Stored XSS CVE-2024-2278 6.1 MediumApril 1, 2024
• themify woocommerce product filter, unknown themify +1 more WooCommerce Product Filter < 1.4.4 - Reflected XSS CVE-2024-2263 4.8 MediumApril 1, 2024
• themify woocommerce product filter, unknown themify +1 more WooCommerce Product Filter < 1.4.4 - Filter Deletion via CSRF CVE-2024-2262 4.7 MediumApril 1, 2024
• themify event post, themifyme themify event post +1 more WordPress Themify Event Post plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability CVE-2024-30440 5.9 MediumMarch 29, 2024
• themify shortcodes, themifyme themify shortcodes +1 more Themify Shortcodes <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-2732 5.4 MediumMarch 26, 2024
• themify builder, themifyme themify builder +1 more WordPress Themify Builder Plugin <= 7.0.5 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2024-24872 4.3 MediumFebruary 21, 2024
• themify icons, themifyme themify icons +1 more WordPress Themify Icons Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS) CVE-2023-51693 6.5 MediumFebruary 1, 2024
• themify ultra WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to Arbitrary File Upload CVE-2023-46149 9.9 CriticalDecember 20, 2023
• themify ultra WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to PHP Object Injection CVE-2023-46147 7.4 HighDecember 20, 2023
• themify conditional menus Conditional Menus < 1.2.1 - Reflected XSS CVE-2023-2654 6.1 MediumJune 19, 2023
• themify portfolio post, themifyme themify portfolio post +1 more WordPress Themify Portfolio Post Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS) CVE-2022-32970 4.1 MediumMay 10, 2023
• themify portfolio post, themifyme themify portfolio post +1 more Themify Portfolio Post < 1.2.2 - Contributor+ Stored XSS CVE-2023-0362 5.4 MediumFebruary 13, 2023
• themify shortcodes, themifyme themify shortcodes +1 more Themify Shortcodes < 2.0.8 - Contributor+ Stored XSS via Shortcode CVE-2022-4787 5.4 MediumJanuary 30, 2023
• themify portfolio post, themifyme themify portfolio post +1 more Themify Portfolio Post < 1.2.1 - Contributor+ Stored XSS CVE-2022-4464 5.4 MediumJanuary 16, 2023
• themify woocommerce product filter, unknown themify – woocommerce product filter +1 more Themify - WooCommerce Product Filter < 1.3.8 - Reflected Cross-Site Scripting CVE-2022-1532 6.1 MediumJune 13, 2022
• themify post type builder search addon, unknown themify-ptb-search +1 more Themify - Post Type Builder Search Addon < 1.4.0 - Reflected Cross-Site Scripting CVE-2022-1047 6.1 MediumMay 9, 2022
• themify portfolio post, themifyme themify portfolio post +1 more Themify Portfolio Post < 1.1.7 - Reflected Cross-Site Scripting CVE-2022-0200 5.4 MediumFebruary 14, 2022
• themify framework Elemin allows remote attackers to upload and execute arbitrary PHP code via the Themify framework... CVE-2013-20002 9.8 CriticalJune 17, 2021
• themify portfolio post, themifyme themify portfolio post +1 more Themify Portfolio Post < 1.1.6 - Authenticated Stored Cross-Site Scripting CVE-2021-24129 5.4 MediumMarch 18, 2021