WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
themeisle-companion
Published
2025-10-03
Title
Orbit Fox < 3.0.2 - Author+ Server-Side Request Forgery
Slug
themeisle-companion
Published
2025-11-03
Title
Orbit Fox Companion < 3.0.3 - Authenticated (Author+) Stored Cross-Site Scripting via Post Taxonomy
Slug
themeisle-companion
Published
2026-06-17
Title
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More < 3.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter
Slug
themeisle-companion
Published
2026-07-24
Title
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More < 3.0.8 - Authenticated (Author+) Stored Cross-Site Scripting
Slug
themeisle-companion
Published
2026-07-27
Title
Orbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG Upload
Slug
themeisle-companion
Published
2026-09-07
Title
Orbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget
Slug
themeloom-widgets
Published
2025-09-10
Title
ThemeLoom Widgets <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
thememove-core
Published
2025-06-24
Title
ThemeMove Core <= 1.4.2 - Authenticated (Subscriber+) PHP Object Injection
Slug
themerain-core
Published
2025-10-24
Title
ThemeRain Core <= 1.1.9 - Missing Authorization
Slug
themereps-helper
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
themeruby-multi-authors
Published
2026-01-23
Title
ThemeRuby Multi Authors < 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes
Slug
themes4wp-youtube-external-subtitles
Published
2024-10-24
Title
Themes4WP YouTube External Subtitles <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
themesflat-addons-for-elementor
Published
2024-06-05
Title
Themesflat Addons For Elementor < 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets
Slug
themesflat-addons-for-elementor
Published
2024-06-05
Title
Themesflat Addons For Elementor < 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Tags
Slug
themesflat-addons-for-elementor
Published
2024-06-05
Title
Themesflat Addons For Elementor < 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via URLs
Slug
themesflat-addons-for-elementor
Published
2024-06-05
Title
Themesflat Addons For Elementor < 2.1.3 - Contributor+ Stored XSS via Widget Titles
Slug
themesflat-addons-for-elementor
Published
2024-09-24
Title
Themesflat Addons For Elementor < 2.2.2 - Contributor+ Stored XSS
Slug
themesflat-addons-for-elementor
Published
2024-09-24
Title
Themesflat Addons For Elementor < 2.2.2 - Contributor+ Information Exposure
Slug
themesflat-addons-for-elementor
Published
2024-10-15
Title
Themesflat Addons For Elementor < 2.2.2 - Contributor+ Stored XSS
Slug
themesflat-addons-for-elementor
Published
2024-12-02
Title
Themesflat Addons For Elementor < 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
themesflat-addons-for-elementor
Published
2025-01-07
Title
Themesflat Addons For Elementor < 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
themesflat-addons-for-elementor
Published
2025-03-31
Title
Themesflat Addons For Elementor < 2.3.2 - Contributor+ Stored XSS
Slug
themesflat-addons-for-elementor
Published
2025-04-18
Title
Themesflat Addons For Elementor < 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
themesflat-addons-for-elementor
Published
2026-03-23
Title
themesflat-addons-for-elementor < 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
themesflat-elementor
Published
2026-02-09
Title
Themesflat Elementor <= 1.0.1 - Unauthenticated PHP Object Injection