WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
theme-switcher-reloaded
Published
2025-08-25
Title
Theme Switcher Reloaded <= 1.1 - Reflected Cross-Site Scripting
Slug
theme-test-drive
Published
2015-11-23
Title
Theme Test Drive <= 2.9 - Authenticated File Upload & XSS
Slug
theme-tuner
Published
2012-01-23
Title
Theme Tuner < 0.8 - Remote File Inclusion
Slug
theme-tweaker-lite
Published
2023-02-20
Title
Theme Tweaker <= 5.20 - Cross-Site Request Forgery
Slug
themebeez-toolkit
Published
2025-12-26
Title
Themebeez Toolkit <= 1.3.5 - Missing Authorization
Slug
themedy-toolbox
Published
2024-09-26
Title
Themedy Toolbox < 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
Slug
themedy-toolbox
Published
2024-10-31
Title
Themedy Toolbox <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
themeegg-toolkit
Published
2025-03-11
Title
ThemeEgg ToolKit <= 1.2.9 - Authenticated (Administrator+) Arbitrary File Upload
Slug
themefuse-maintenance-mode
Published
2024-11-01
Title
ThemeFuse Maintenance Mode <= 1.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
themegrill-demo-importer
Published
2020-02-16
Title
ThemeGrill Demo Importer < 1.6.3 - Auth Bypass & Database Wipe
Slug
themegrill-demo-importer
Published
2026-03-06
Title
ThemeGrill Demo Importer < 2.0.0.7 - Missing Authorization
Slug
themehunk-megamenu-plus
Published
2024-09-24
Title
Easy Mega Menu Plugin for WordPress – ThemeHunk < 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Settings Updates
Slug
themehunk-megamenu-plus
Published
2024-10-07
Title
Easy Mega Menu Plugin for WordPress – ThemeHunk < 1.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
themehunk-megamenu-plus
Published
2025-06-05
Title
ThemeHunk <= 1.1.2- Missing Authorization
Slug
themeisle-companion
Published
2018-12-07
Title
Orbit Fox by ThemeIsle <= 2.6.3 -Does not properly Authenticate REST API Calls
Slug
themeisle-companion
Published
2021-01-12
Title
Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Stored Cross Site Scripting
Slug
themeisle-companion
Published
2021-01-12
Title
Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege Escalation
Slug
themeisle-companion
Published
2023-05-02
Title
Orbit Fox < 2.10.24 - Author+ Server-Side Request Forgery
Slug
themeisle-companion
Published
2024-01-05
Title
Orbit Fox Companion < 2.10.27 - Contributor+ Stored XSS
Slug
themeisle-companion
Published
2024-01-15
Title
Orbit Fox by ThemeIsle < 2.10.28 - Contributor+ Stored XSS
Slug
themeisle-companion
Published
2024-02-01
Title
Orbit Fox by ThemeIsle < 2.10.30 - Connected API Keys Update via CSRF
Slug
themeisle-companion
Published
2024-02-01
Title
Orbit Fox by ThemeIsle < 2.10.29 - Unauthenticated Connected API Keys Update
Slug
themeisle-companion
Published
2024-02-26
Title
Orbit Fox by ThemeIsle < 2.10.32 - Contributor+ Stored XSS via Post Type Grid Widget
Slug
themeisle-companion
Published
2024-02-26
Title
Orbit Fox by ThemeIsle < 2.10.31 - Contributor+ Stored XSS via Form Widget
Slug
themeisle-companion
Published
2024-02-26
Title
Orbit Fox by ThemeIsle < 2.10.31 - Contributor+ Stored XSS via Pricing Table Widget