Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

Themeisle — Vulnerabilities & Security Advisories 102

Browse all 102 CVE security advisories affecting Themeisle. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Themeisle operates as a developer of WordPress plugins and themes, primarily offering free and premium tools for site optimization, SEO, and design. Its extensive portfolio has historically been associated with a significant volume of security vulnerabilities, currently totaling 86 recorded CVEs. These flaws predominantly involve cross-site scripting (XSS), SQL injection, and unauthenticated remote code execution (RCE), often stemming from insufficient input validation and weak access controls within plugin code. Notable incidents include critical RCE vulnerabilities in popular plugins like OceanWP and Zakra, which allowed attackers to execute arbitrary commands on compromised servers. The high frequency of these issues highlights systemic challenges in maintaining rigorous security standards across a large, diverse suite of open-source and commercial web components, necessitating frequent updates and strict adherence to secure coding practices to mitigate risks for end-users.

Top products by Themeisle: Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Multiple Page Generator Plugin – MPG Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Visualizer: Tables and Charts Manager for WordPress Redirection for Contact Form 7 PPOM for WooCommerce Auto Featured Image (Auto Post Thumbnail) PPOM – Product Addons & Custom Fields for WooCommerce Visualizer Menu Icons by ThemeIsle Otter - Gutenberg Block Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts Hestia Orbit Fox by ThemeIsle WP Full Stripe Free Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions Social Slider Feed Visualizer – Tables & Charts Manager with Built-in AI Generator Woody Code Snippets Neve PRO Masteriyo LMS PRO Disable Comments for Any Post Types (Remove comments) Woody ad snippets Disable Admin Notices – Hide Dashboard Notifications Robin Image Optimizer – Unlimited Image Optimization & WebP Converter Cyrlitera AI Chatbot for WordPress – Hyve Lite Disable Admin Notices individually MPG
CVE IDTitleCVSSSeverityPublished
CVE-2025-11391 PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Upload — PPOM – Product Addons & Custom Fields for WooCommerceCWE-434 9.8 Critical2025-10-18
CVE-2025-9562 Redirection for Contact Form 7 <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcode — Redirection for Contact Form 7CWE-79 6.4 Medium2025-10-18
CVE-2025-58789 WordPress WP Full Stripe Free Plugin <= 8.2.5 - SQL Injection Vulnerability — WP Full Stripe FreeCWE-89 7.6 High2025-09-05
CVE-2025-58593 WordPress Orbit Fox by ThemeIsle Plugin <= 3.0.0 - Cross Site Scripting (XSS) Vulnerability — Orbit Fox by ThemeIsleCWE-79 6.5 Medium2025-09-03
CVE-2025-55715 WordPress Otter - Gutenberg Block Plugin <= 3.1.0 - Sensitive Data Exposure Vulnerability — Otter - Gutenberg BlockCWE-201 7.5 High2025-08-20
CVE-2025-8141 Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated Arbitrary File Deletion — Redirection for Contact Form 7CWE-22 8.8 High2025-08-20
CVE-2025-8145 Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection — Redirection for Contact Form 7CWE-502 8.8 High2025-08-20
CVE-2025-8289 Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection via PHAR Deserialization — Redirection for Contact Form 7CWE-502 7.5 High2025-08-20
CVE-2025-53986 WordPress Hestia theme <= 3.2.10 - Broken Access Control Vulnerability — HestiaCWE-862 5.3 Medium2025-07-16
CVE-2025-53254 WordPress Cyrlitera plugin <= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability — CyrliteraCWE-352 4.3 Medium2025-06-27
CVE-2025-22659 WordPress Orbit Fox by ThemeIsle plugin <= 2.10.44 - Cross Site Scripting (XSS) vulnerability — Orbit Fox by ThemeIsleCWE-79 6.5 Medium2025-03-27
CVE-2025-1065 Visualizer: Tables and Charts Manager for WordPress <= 3.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Import Data From File — Visualizer: Tables and Charts Manager for WordPressCWE-79 6.4 Medium2025-02-19
CVE-2024-10705 Multiple Page Generator Plugin – MPG <= 4.0.5 - Authenticated (Editor+) Server-Side Request Forgery via fileUrl — Multiple Page Generator Plugin – MPGCWE-918 5.4 Medium2025-01-26
CVE-2025-24666 WordPress Hyve Lite plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerability — AI Chatbot for WordPress – Hyve LiteCWE-79 5.9 Medium2025-01-24
CVE-2025-24668 WordPress PPOM for WooCommerce plugin <= 33.0.8 - Cross Site Scripting (XSS) vulnerability — PPOM for WooCommerceCWE-79 5.9 Medium2025-01-24
CVE-2024-13183 Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter — Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & MoreCWE-79 6.4 Medium2025-01-10
CVE-2025-0311 Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget — Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & MoreCWE-79 6.4 Medium2025-01-10
CVE-2024-37467 WordPress Hestia theme <= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerability — HestiaCWE-352 4.3 Medium2025-01-02
CVE-2023-39920 WordPress Redirection for Contact Form 7 plugin <= 2.9.2 - Broken Access Control vulnerability — Redirection for Contact Form 7CWE-862 7.5 High2024-12-13
CVE-2024-11219 Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.6 - Unauthetnicated Path Traversal to Arbitrary Image View — Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSECWE-22 5.3 Medium2024-11-27
CVE-2024-52420 WordPress Disable Admin Notices individually plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability — Disable Admin Notices individuallyCWE-352 4.3 Medium2024-11-19
CVE-2024-51671 WordPress Otter Blocks plugin <= 3.0.3 - Broken Access Control vulnerability — Otter - Gutenberg BlockCWE-862 2.7 Low2024-11-19
CVE-2024-10672 Multiple Page Generator Plugin – MPG <= 4.0.2 - Authenticated (Editor+) Directory Traversal to Limited File Deletion — Multiple Page Generator Plugin – MPGCWE-73 2.7 Low2024-11-12
CVE-2024-10367 Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload — Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSECWE-79 6.4 Medium2024-11-01
CVE-2024-7424 Multiple Page Generator Plugin – MPG <= 4.0.1 - Missing Authorization — Multiple Page Generator Plugin – MPGCWE-284 5.4 Medium2024-11-01
CVE-2024-47325 WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.7 - SQL Injection vulnerability — MPGCWE-89 8.5 High2024-10-20
CVE-2024-7778 Orbit Fox by ThemeIsle <= 2.10.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload — Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & MoreCWE-79 6.4 Medium2024-08-22
CVE-2024-2484 Orbit Fox by ThemeIsle <= 2.10.34 - Authenticated (Contributor+) Stored Cross-Site Scripting via Services and Post Type Grid Widgets — Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & MoreCWE-79 6.4 Medium2024-06-22
CVE-2024-3105 Woody code snippets – Insert Header Footer Code, AdSense Ads <= 2.5.0 -Authenticated (Contributor+) Remote Code Execution — Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer ScriptsCWE-94 9.9 Critical2024-06-15
CVE-2024-35728 WordPress Product Addons & Fields for WooCommerce plugin <= 32.0.20 - Content Injection vulnerability — PPOM for WooCommerceCWE-74 5.3 Medium2024-06-10

This page lists every published CVE security advisory associated with Themeisle. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.