CveMateVulnerability intelligence

Thinkupthemes vulnerabilities

6 vulnerabilities

Known vulnerabilities in Thinkupthemes products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 6 products.

Products

6

Consulting1 vulnerabilities
Drift1 vulnerabilities
Melos1 vulnerabilities
Minamaze1 vulnerabilities
Renden1 vulnerabilities
Responsive Vector Maps1 vulnerabilities

CVE-2021-24947thinkupthemesresponsive_vector_maps+24y ago07-02-2022 15:47

The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server CVE-2025-63032thinkupthemesconsulting+19mo ago31-12-2025 11:50

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thinkupthemes Consulting consulting allows Stored XSS.This issue affects Consulting: from n/a through <= 1.5.0.CVE-2025-62991thinkupthemesminamaze+19mo ago31-12-2025 11:51

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thinkupthemes Minamaze minamaze allows Stored XSS.This issue affects Minamaze: from n/a through <= 1.10.1.CVE-2025-62136thinkupthemesmelos+19mo ago31-12-2025 09:00

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thinkupthemes Melos melos allows Stored XSS.This issue affects Melos: from n/a through <= 1.6.0.CVE-2025-12117thinkupthemesrenden+18mo ago19-02-2026 03:25

The Renden theme for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-12116thinkupthemesdrift+18mo ago19-02-2026 03:25

The Drift theme for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.