holithemes — Vulnerabilities & Security Advisories 3

Holithemes develops WordPress themes and website templates, primarily for small businesses and portfolio sites. Historically, their products have been vulnerable to multiple security issues including stored cross-site scripting (XSS), remote code execution (RCE), and privilege escalation vulnerabilities. These weaknesses often stem from insufficient input validation and improper access controls in theme customization options. The company currently has three CVEs on record, with vulnerabilities typically allowing attackers to execute arbitrary code, manipulate website content, or gain elevated access. Security researchers have noted that some Holithemes implementations contained hardcoded credentials and insecure direct object references, though no major public security incidents have been widely reported.