Athemes vulnerabilities
10 vulnerabilities
Known vulnerabilities in Athemes products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3 products.
Products
3- Sydney Toolbox5 vulnerabilities
- Athemes Addons For Elementor4 vulnerabilities
- Sydney1 vulnerabilities
MediumCVE-2025-22646athemes · athemes_addons_for_elementor +2 moreWordPress aThemes Addons for Elementor plugin <= 1.0.8 - Stored Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows Stored XSS.This issue affects aThemes Addons for Elementor: from n/a through <= 1.0.8.EPSS0.26%HighCVE-2025-32158athemes · athemes_addons_for_elementor +2 moreWordPress aThemes Addons for Elementor plugin <= 1.1.3 - Local File Inclusion vulnerabilityImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite.This issue affects aThemes Addons for Elementor: from n/a through <= 1.1.3.EPSS0.74%MediumCVE-2025-8999athemes · sydney +1 moreSydney <= 2.56 - Missing Authorization to Authenticated (Subscriber+) Limited Theme Options UpdateThe Sydney theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'activate_modules' function in all versions up to, and including, 2.56. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate or deactivate various theme modules.EPSS0.28%MediumCVE-2024-2936athemes · sydney_toolbox +2 moreSydney Toolbox <= 1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via _idThe Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id attribute of widgets in all versions up to, and including, 1.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.34%MediumCVE-2024-13547athemes · athemes_addons_for_elementor +2 moreaThemes Addons for Elementor <= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site ScriptingThe aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.25%MediumCVE-2024-1447athemes · sydney_toolbox +2 moreSydney Toolbox <= 1.25 - Authenticated (Contributor+) Stored Cross-Site ScriptingThe Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aThemes Slider button element in all versions up to, and including, 1.25 due to insufficient input sanitization and output escaping on user supplied link. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.43%MediumCVE-2024-51675athemes · athemes_addons_for_elementor +2 moreWordPress aThemes Addons for Elementor plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows DOM-Based XSS.This issue affects aThemes Addons for Elementor: from n/a through <= 1.0.7.EPSS0.26%MediumCVE-2024-4036athemes · sydney_toolbox +2 moreSydney Toolbox <= 1.30 - Authenticated (Contributor+) Stored Cross-Site ScriptingThe Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the style parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.60%MediumCVE-2024-4473athemes · sydney_toolbox +2 moreSydney Toolbox <= 1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via aThemes: Portfolio WidgetThe Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "aThemes: Portfolio" widget in all versions up to, and including, 1.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.28%MediumCVE-2024-3208athemes · sydney_toolbox +2 moreSydney Toolbox <= 1.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable GalleryThe Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versions up to, and including, 1.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.39%