Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

themeisle — Vulnerabilities & Security Advisories 121

Browse all 121 CVE security advisories affecting themeisle. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Themeisle operates as a developer of WordPress plugins and themes, primarily offering free and premium tools for site optimization, SEO, and design. Its extensive portfolio has historically been associated with a significant volume of security vulnerabilities, currently totaling 86 recorded CVEs. These flaws predominantly involve cross-site scripting (XSS), SQL injection, and unauthenticated remote code execution (RCE), often stemming from insufficient input validation and weak access controls within plugin code. Notable incidents include critical RCE vulnerabilities in popular plugins like OceanWP and Zakra, which allowed attackers to execute arbitrary commands on compromised servers. The high frequency of these issues highlights systemic challenges in maintaining rigorous security standards across a large, diverse suite of open-source and commercial web components, necessitating frequent updates and strict adherence to secure coding practices to mitigate risks for end-users.

Top products by themeisle: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More Multiple Page Generator Plugin – MPG Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Redirection for Contact Form 7 Visualizer: Tables and Charts Manager for WordPress WP Full Stripe Free Visualizer PPOM – Product Addons & Custom Fields for WooCommerce PPOM for WooCommerce Orbit Fox by ThemeIsle Menu Icons by ThemeIsle Auto Featured Image (Auto Post Thumbnail) Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions Visualizer – Tables & Charts Manager with Built-in AI Generator Hestia AI Chatbot for WordPress – Hyve Lite Otter - Gutenberg Block MPG Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts Multiple Pages Generator by Themeisle Disable Admin Notices individually MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO Feedzy Cyr to Lat reloaded – transliteration of links and file names Google Maps Plugin by Intergeo Neve PRO Social Slider Feed Woody Code Snippets Masteriyo LMS PRO
CVE ID Title CVSS Severity Published
CVE-2026-8976 RSS Aggregator by Feedzy <= 5.1.7 - Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions — RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator CWE-862 4.3 Medium 2026-06-05
CVE-2025-53209 WordPress Masteriyo LMS PRO plugin <= 2.20.0 - Privilege Escalation Vulnerability — Masteriyo LMS PRO CWE-266 9.8 Critical 2026-06-02
CVE-2026-8689 Visualizer: Tables and Charts Manager for WordPress <= 3.11.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Chart Creation and Modification via renderChartPages() and uploadData() Functions — Visualizer: Tables and Charts Manager for WordPress CWE-862 4.3 Medium 2026-05-28
CVE-2026-42749 WordPress Disable Comments for Any Post Types (Remove comments) plugin <= 1.3.0 - Broken Authentication vulnerability — Disable Comments for Any Post Types (Remove comments) CWE-288 7.1 High 2026-05-27
CVE-2026-24573 WordPress Visualizer plugin < 4.0.0 - Cross Site Scripting (XSS) vulnerability — Visualizer CWE-79 6.5 Medium 2026-05-20
CVE-2026-2892 Otter Blocks <= 3.1.4 - Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie — Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE CWE-285 7.5 High 2026-04-30
CVE-2026-25366 WordPress Woody ad snippets plugin <= 2.7.1 - Remote Code Execution (RCE) vulnerability — Woody ad snippets CWE-94 9.9 Critical 2026-03-25
CVE-2026-2410 Disable Admin Notices – Hide Dashboard Notifications <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update — Disable Admin Notices – Hide Dashboard Notifications CWE-352 4.3 Medium 2026-02-25
CVE-2026-1319 Robin Image Optimizer <= 2.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Alternative Text Field — Robin Image Optimizer – Unlimited Image Optimization & WebP Converter CWE-79 6.4 Medium 2026-02-05
CVE-2026-1755 Menu Icons by ThemeIsle <= 0.13.20 - Authenticated (Author+) Stored Cross-Site Scripting — Menu Icons by ThemeIsle CWE-79 6.4 Medium 2026-02-03
CVE-2025-14800 Redirection for Contact Form 7 <= 3.2.7 - Unauthenticated Arbitrary File Copy via move_file_to_upload — Redirection for Contact Form 7 CWE-434 8.1 High 2025-12-21
CVE-2025-13794 Auto Featured Image <= 4.2.1 - Missing Authorization to Authenticated (Contributor+) Post Thumbnail Modification — Auto Featured Image (Auto Post Thumbnail) CWE-862 4.3 Medium 2025-12-16
CVE-2025-11467 RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 5.1.1 - Unauthenticated Blind Server-Side Request Forgery — RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator CWE-918 5.8 Medium 2025-12-11
CVE-2025-12483 Visualizer: Tables and Charts Manager for WordPress <= 3.11.12 - Authenticated (Contributor+) SQL Injection — Visualizer: Tables and Charts Manager for WordPress CWE-89 6.5 Medium 2025-12-02
CVE-2025-66069 WordPress PPOM for WooCommerce plugin <= 33.0.16 - Broken Access Control vulnerability — PPOM for WooCommerce CWE-862 4.3 Medium 2025-11-21
CVE-2025-12045 Orbit Fox Companion <= 3.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Taxonomy — Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More CWE-79 6.4 Medium 2025-11-04
CVE-2025-9322 Stripe Payment Forms <= 8.3.1 - Unauthenticated SQL Injection — Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions CWE-89 7.5 High 2025-10-25
CVE-2025-11128 Feedzy RSS Feeds Lite <= 5.1.0 - Authenticated (Subscriber+) Server-Side Request Forgery — RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator CWE-918 5.0 Medium 2025-10-23
CVE-2025-11691 PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated SQL Injection — PPOM – Product Addons & Custom Fields for WooCommerce CWE-89 7.5 High 2025-10-18
CVE-2025-11391 PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Upload — PPOM – Product Addons & Custom Fields for WooCommerce CWE-434 9.8 Critical 2025-10-18
CVE-2025-9562 Redirection for Contact Form 7 <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcode — Redirection for Contact Form 7 CWE-79 6.4 Medium 2025-10-18
CVE-2025-58789 WordPress WP Full Stripe Free Plugin <= 8.2.5 - SQL Injection Vulnerability — WP Full Stripe Free CWE-89 7.6 High 2025-09-05
CVE-2025-58593 WordPress Orbit Fox by ThemeIsle Plugin <= 3.0.0 - Cross Site Scripting (XSS) Vulnerability — Orbit Fox by ThemeIsle CWE-79 6.5 Medium 2025-09-03
CVE-2025-55715 WordPress Otter - Gutenberg Block Plugin <= 3.1.0 - Sensitive Data Exposure Vulnerability — Otter - Gutenberg Block CWE-201 7.5 High 2025-08-20
CVE-2025-8141 Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated Arbitrary File Deletion — Redirection for Contact Form 7 CWE-22 8.8 High 2025-08-20
CVE-2025-8145 Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection — Redirection for Contact Form 7 CWE-502 8.8 High 2025-08-20
CVE-2025-8289 Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection via PHAR Deserialization — Redirection for Contact Form 7 CWE-502 7.5 High 2025-08-20
CVE-2025-53986 WordPress Hestia theme <= 3.2.10 - Broken Access Control Vulnerability — Hestia CWE-862 5.3 Medium 2025-07-16
CVE-2025-53254 WordPress Cyrlitera plugin <= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability — Cyrlitera CWE-352 4.3 Medium 2025-06-27
CVE-2025-22659 WordPress Orbit Fox by ThemeIsle plugin <= 2.10.44 - Cross Site Scripting (XSS) vulnerability — Orbit Fox by ThemeIsle CWE-79 6.5 Medium 2025-03-27

This page lists every published CVE security advisory associated with themeisle. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.