Skip to content
OpenAdvisories

Vendor

bdthemes

107 known vulnerabilities.

Products

Element Pack – Widgets, Templates & Addons for Elementor 29 Prime Slider – Addons For Elementor 18 Element Pack Elementor Addons 16 Ultimate Store Kit Elementor Addons 13 ZoloBlocks 5 Element Pack Pro 4 Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor 3 SigmaForms Pro – AI Generated Forms 3 Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons 2 ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns 2 Instant Image Generator 2 Ultimate Post Kit 2 Live Copy Paste for Elementor 2 Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons 2 Element Pack Elementor Addons and Templates 1 Element Pack Pro - Addon for Elementor Page Builder WordPress Plugin 1 Spin Wheel – Interactive spinning wheel that offers coupons 1 Ultimate Post Kit Addons for Elementor 1 Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery 1 Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator 1 Pixel Gallery Addons for Elementor 1 Smart Admin Assistant 1 Ultimate Store Kit – Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder 1 Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-78657

    SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field

    The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_files function in all versions up to, and including, 1.4.11. This makes it possible for una…

    bdthemes SigmaForms Pro – AI Generated Forms Web / CMS
  • Critical 9.8
    CVE-2026-14494

    Sigma Forms Pro <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field

    The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to all users d…

    bdthemes SigmaForms Pro – AI Generated Forms Web / CMS
  • Critical 9.0
    CVE-2026-52705

    WordPress SigmaForms Pro – AI Generated Forms plugin <= 1.4.5 - Arbitrary File Upload vulnerability

    Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions.

    bdthemes SigmaForms Pro – AI Generated Forms
  • Critical 9.8
    CVE-2025-39588

    WordPress Ultimate Store Kit Elementor Addons plugin <= 2.4.0 - Deserialization of untrusted data Vulnerability

    Deserialization of Untrusted Data vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Object Injection.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.4.0.

    bdthemes Ultimate Store Kit Elementor Addons
  • Critical 10.0
    CVE-2024-52377

    WordPress Instant Image Generator (One Click Image Uploads from Pixabay, Pexels and OpenAI) plugin <= 1.5.2 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in bdthemes Instant Image Generator ai-image allows Upload a Web Shell to a Web Server.This issue affects Instant Image Generator: from n/a through <= 1.5.2.

    bdthemes Instant Image Generator
  • Critical 9.8
    CVE-2024-8030

    Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.0.3 - Unauthenticated PHP Object Injection

    The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the _ultimate_store_kit…

    bdthemes Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor Web / CMS
  • Critical 9.8
    CVE-2024-5335

    Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 1.6.4 - Unauthenticated PHP Object Injection

    The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the _ultimate_store_kit…

    bdthemes Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor Web / CMS