Favethemes — Vulnerabilities & Security Advisories 29

Favethemes operates as a commercial provider of WordPress themes and plugins, primarily targeting e-commerce and general website development through its extensive marketplace. Security audits reveal a persistent pattern of critical vulnerabilities within its codebase, with twenty-nine Common Vulnerabilities and Exposures (CVEs) currently documented. The most prevalent flaw classes include Remote Code Execution (RCE), Cross-Site Scripting (XSS), and SQL Injection, often stemming from insufficient input validation and improper sanitization of user-supplied data. Additionally, the company has faced issues related to broken access control, allowing unauthorized privilege escalation for lower-level user roles. These defects frequently enable attackers to execute arbitrary commands or steal sensitive session cookies. While Favethemes generally responds to reported issues, the high volume of historical CVEs indicates systemic weaknesses in their development lifecycle, posing significant risks to sites relying on their unpatched or outdated components.