themebon — Vulnerabilities & Security Advisories 5

Themebon develops WordPress themes and website templates primarily for small businesses and personal blogs. Historically, their products have been vulnerable to multiple remote code execution (RCE) and cross-site scripting (XSS) flaws, often stemming from insufficient input validation and improper sanitization. Themebon has accumulated five CVEs to date, with several critical vulnerabilities allowing attackers to execute arbitrary code or steal sensitive data. Their security posture has been inconsistent, with some vulnerabilities remaining unpatched for extended periods. The company has faced scrutiny for slow response times to reported issues, though no major public security incidents have been documented.