Themeisle vulnerabilities
131 vulnerabilities
Known vulnerabilities in Themeisle products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 47 products.
Products
45 of 47- Orbit Fox15 vulnerabilities
- RSS Aggregator By Feedzy – Feed To Post, Autoblogging, News & Youtube Video Feeds Aggregator15 vulnerabilities
- Multiple Page Generator Plugin – MPG11 vulnerabilities
- Otter Blocks – Gutenberg Blocks, Page Builder For Gutenberg Editor & FSE11 vulnerabilities
- Multiple Page Generator10 vulnerabilities
- Otter Blocks10 vulnerabilities
- Rss Aggregator By Feedzy9 vulnerabilities
- Visualizer9 vulnerabilities
- Redirection For Contact Form 78 vulnerabilities
- PPOM – Product Addons & Custom Fields For Woocommerce5 vulnerabilities
- PPOM For Woocommerce4 vulnerabilities
- Product Addons \& Fields For Woocommerce4 vulnerabilities
- WP Full Stripe Free4 vulnerabilities
- Auto Featured Image (Auto Post Thumbnail)3 vulnerabilities
- Menu Icons By Themeisle3 vulnerabilities
- Orbit Fox By Themeisle3 vulnerabilities
- AI Chatbot For Wordpress – Hyve Lite2 vulnerabilities
- Hestia2 vulnerabilities
- Lightstart – Maintenance Mode, Coming Soon And Landing Page Builder2 vulnerabilities
- MPG2 vulnerabilities
- Otter Gutenberg Block2 vulnerabilities
- Stripe Payment Forms By WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions2 vulnerabilities
- Visualizer – Tables & Charts Manager With Built In AI Generator2 vulnerabilities
- Woody Code Snippets – Insert PHP, CSS, JS, And Header/Footer Scripts2 vulnerabilities
- Cloud Templates \& Patterns Collection1 vulnerabilities
- Cyr To Lat Reloaded – Transliteration Of Links And File Names1 vulnerabilities
- Cyrlitera1 vulnerabilities
- Disable Admin Notices – Hide Dashboard Notifications1 vulnerabilities
- Disable Admin Notices Individually1 vulnerabilities
- Disable Comments For Any Post Types (Remove Comments)1 vulnerabilities
- Feedzy1 vulnerabilities
- Google Maps Plugin By Intergeo1 vulnerabilities
- Lightstart1 vulnerabilities
- Masteriyo LMS PRO1 vulnerabilities
- MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO1 vulnerabilities
- Neve PRO1 vulnerabilities
- Orbitfox1 vulnerabilities
- Otter1 vulnerabilities
- Otter Blocks PRO1 vulnerabilities
- Robin Image Optimizer – Unlimited Image Optimization & Webp Converter1 vulnerabilities
- Social Slider Feed1 vulnerabilities
- Starter Sites & Templates By Neve1 vulnerabilities
- Woody Ad Snippets1 vulnerabilities
- Woody Code Snippets1 vulnerabilities
- Wp Maintenance Mode \& Coming Soon1 vulnerabilities
CVE-2026-109207themeislerss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregator
EPSS score0.31%
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control an external RSS feed that the target site has already configured for import; no WordPress account or special plugin configuration is needed beyond that condition.CVE-2021-24157themeisleorbit_fox+2EPSS score0.69%
Orbit Fox by ThemeIsle has a feature to add custom scripts to the header and footer of a page or post. There were no checks to verify that a user had the unfiltered_html capability prior to saving the script tags, thus allowing lower-level users to inject scripts that could potentially be malicious.CVE-2021-24158themeisleorbit_fox+2EPSS score0.90%
Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for lower-level users, however, they can still supply the user_role parameter to update the default role for registration.CVE-2025-13794themeisleauto featured image (auto post thumbnail)+1EPSS score0.30%
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bulk_action_generate_handler function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete or generate featured images on posts they do not own.CVE-2025-1065themeislevisualizer: tables and charts manager for wordpress+1EPSS score0.27%
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Import Data From File feature in all versions up to, and including, 3.11.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-55715themeisleotter - gutenberg block+1EPSS score0.37%
Insertion of Sensitive Information Into Sent Data vulnerability in Themeisle Otter - Gutenberg Block otter-blocks allows Retrieve Embedded Sensitive Data.This issue affects Otter - Gutenberg Block: from n/a through <= 3.1.0.CVE-2025-11691themeisleppom – product addons & custom fields for woocommerce+1EPSS score0.48%
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the PPOM_Meta::get_fields_by_id() function in all versions up to, and including, 33.0.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the Enable Legacy Price Calculations setting is enabled.CVE-2025-11128themeislerss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregator+1EPSS score0.29%
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.1.0 via the 'feedzy_sanitize_feeds' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.CVE-2025-11391themeisleppom – product addons & custom fields for woocommerce+1EPSS score1.00%
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image cropper functionality in all versions up to, and including, 33.0.15. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. While the vulnerable code is in the free version, this only affected users with the paid version of the software installed and activated.CVE-2025-11467themeislerss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregator+1EPSS score0.26%
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 5.1.1 via the feedzy_lazy_load function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.CVE-2025-0311themeisleorbit_fox+2EPSS score0.36%
The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table widget in all versions up to, and including, 2.10.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-9322themeislestripe payment forms by wp full pay – accept credit card payments, donations & subscriptions+1EPSS score0.35%
The Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions plugin for WordPress is vulnerable to SQL Injection via the 'wpfs-form-name' parameter in all versions up to, and including, 8.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.CVE-2025-9562themeisleredirection for contact form 7+1EPSS score0.31%
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's qs_date shortcode in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-14800themeisleredirection for contact form 7+1EPSS score0.39%
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_file_to_upload' function in all versions up to, and including, 3.2.7. This makes it possible for unauthenticated attackers to copy arbitrary files on the affected site's server. If 'allow_url_fopen' is set to 'On', it is possible to upload a remote file to the server.CVE-2025-53209themeislemasteriyo lms pro+1EPSS score0.27%
Incorrect Privilege Assignment vulnerability in Themeisle Masteriyo LMS PRO allows Privilege Escalation.
This issue affects Masteriyo LMS PRO: from n/a through 2.20.0.CVE-2025-53254themeislecyrlitera+1EPSS score0.16%
Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Cyrlitera cyrlitera allows Cross Site Request Forgery.This issue affects Cyrlitera: from n/a through <= 1.3.0.CVE-2025-53986themeislehestia+1EPSS score0.31%
Missing Authorization vulnerability in themeisle Hestia hestia allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hestia: from n/a through <= 3.2.10.CVE-2025-66069themeisleppom for woocommerce+1EPSS score0.22%
Missing Authorization vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PPOM for WooCommerce: from n/a through <= 33.0.16.CVE-2025-58789themeislewp full stripe free+1EPSS score0.36%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle WP Full Stripe Free wp-full-stripe-free allows SQL Injection.This issue affects WP Full Stripe Free: from n/a through <= 8.2.5.CVE-2025-58593themeisleorbit fox by themeisle+1EPSS score0.21%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fox by ThemeIsle themeisle-companion allows Stored XSS.This issue affects Orbit Fox by ThemeIsle: from n/a through <= 3.0.0.