Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

themeisle — Vulnerabilities & Security Advisories 121

Browse all 121 CVE security advisories affecting themeisle. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Themeisle operates as a developer of WordPress plugins and themes, primarily offering free and premium tools for site optimization, SEO, and design. Its extensive portfolio has historically been associated with a significant volume of security vulnerabilities, currently totaling 86 recorded CVEs. These flaws predominantly involve cross-site scripting (XSS), SQL injection, and unauthenticated remote code execution (RCE), often stemming from insufficient input validation and weak access controls within plugin code. Notable incidents include critical RCE vulnerabilities in popular plugins like OceanWP and Zakra, which allowed attackers to execute arbitrary commands on compromised servers. The high frequency of these issues highlights systemic challenges in maintaining rigorous security standards across a large, diverse suite of open-source and commercial web components, necessitating frequent updates and strict adherence to secure coding practices to mitigate risks for end-users.

Top products by themeisle: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More Multiple Page Generator Plugin – MPG Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Redirection for Contact Form 7 Visualizer: Tables and Charts Manager for WordPress WP Full Stripe Free Visualizer PPOM – Product Addons & Custom Fields for WooCommerce PPOM for WooCommerce Orbit Fox by ThemeIsle Menu Icons by ThemeIsle Auto Featured Image (Auto Post Thumbnail) Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions Visualizer – Tables & Charts Manager with Built-in AI Generator Hestia AI Chatbot for WordPress – Hyve Lite Otter - Gutenberg Block MPG Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts Multiple Pages Generator by Themeisle Disable Admin Notices individually MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO Feedzy Cyr to Lat reloaded – transliteration of links and file names Google Maps Plugin by Intergeo Neve PRO Social Slider Feed Woody Code Snippets Masteriyo LMS PRO
CVE ID Title CVSS Severity Published
CVE-2026-120035 RSS Aggregator by Feedzy <= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Title — RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator CWE-79 5.4 Medium 2026-11-06
CVE-2026-120659 Redirection for Contact Form 7 <= 3.2.14 - Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy via 'wpcf7-redirect' Parameter — Redirection for Contact Form 7 CWE-862 5.3 Medium 2026-11-06
CVE-2026-119054 Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url — Multiple Pages Generator by Themeisle CWE-79 5.4 Medium 2026-10-29
CVE-2026-110707 RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element — RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator CWE-79 4.7 Medium 2026-10-29
CVE-2026-109207 RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL — RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator CWE-79 7.2 High 2026-10-16
CVE-2026-104801 PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter — PPOM – Product Addons & Custom Fields for WooCommerce CWE-22 9.1 Critical 2026-10-10
CVE-2026-104735 RSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title> — RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator CWE-79 6.4 Medium 2026-10-10
CVE-2026-97305 WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability — AI Chatbot for WordPress – Hyve Lite CWE-639 6.9 Medium 2026-10-05
CVE-2026-102002 Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget — Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE CWE-200 3.1 Low 2026-10-02
CVE-2026-62073 WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability — WP Full Stripe Free CWE-862 7.5 High 2026-10-01
CVE-2026-97302 WordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerability — MPG CWE-201 5.3 Medium 2026-09-30
CVE-2026-85198 MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path — MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO CWE-89 6.5 Medium 2026-09-12
CVE-2026-4945 Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass — Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE CWE-639 5.3 Medium 2026-09-07
CVE-2026-61960 WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability — WP Full Stripe Free CWE-79 7.1 High 2026-08-13
CVE-2026-66437 WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability — Feedzy CWE-918 4.9 Medium 2026-07-27
CVE-2026-65563 WordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerability — Orbit Fox by ThemeIsle CWE-79 5.9 Medium 2026-07-27
CVE-2026-15653 Visualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter — Visualizer – Tables & Charts Manager with Built-in AI Generator CWE-79 6.4 Medium 2026-07-24
CVE-2026-65537 WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability — Cyr to Lat reloaded – transliteration of links and file names CWE-862 4.3 Medium 2026-07-23
CVE-2026-65526 WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability — Visualizer CWE-89 8.5 High 2026-07-23
CVE-2026-61970 WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 5.0.4 - Server Side Request Forgery (SSRF) vulnerability — Auto Featured Image (Auto Post Thumbnail) CWE-918 4.9 Medium 2026-07-13
CVE-2026-13252 RSS Aggregator by Feedzy <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aspectRatio' Attribute — RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator CWE-79 6.4 Medium 2026-07-02
CVE-2026-13468 Visualizer <= 4.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint — Visualizer – Tables & Charts Manager with Built-in AI Generator CWE-862 7.5 High 2026-07-01
CVE-2026-12432 Stripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter — Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions CWE-862 5.3 Medium 2026-06-27
CVE-2026-57618 WordPress Neve PRO theme <= 3.1.2 - Cross Site Scripting (XSS) vulnerability — Neve PRO CWE-79 6.5 Medium 2026-06-26
CVE-2026-56050 WordPress PPOM for WooCommerce plugin <= 33.0.18 - Broken Access Control vulnerability — PPOM for WooCommerce CWE-284 6.5 Medium 2026-06-25
CVE-2026-11358 Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter — Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More CWE-79 4.4 Medium 2026-06-18
CVE-2026-42378 WordPress WP Full Stripe Free plugin <= 8.4.1 - Broken Authentication vulnerability — WP Full Stripe Free CWE-288 6.5 Medium 2026-06-15
CVE-2026-39507 WordPress Social Slider Feed plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability — Social Slider Feed CWE-79 7.1 High 2026-06-15
CVE-2026-23970 WordPress Redirection for Contact Form 7 plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability — Redirection for Contact Form 7 CWE-79 7.1 High 2026-06-15
CVE-2017-20251 WordPress Insert PHP Plugin < 3.3.1 PHP Code Injection via REST API — Woody Code Snippets CWE-94 9.8 Critical 2026-06-09

This page lists every published CVE security advisory associated with themeisle. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.