Skip to content
OpenAdvisories

Product · EnvoThemes

Envo Extra

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-32386

    WordPress Envo Extra plugin <= 1.9.13 - Broken Access Control vulnerability

    Missing Authorization vulnerability in EnvoThemes Envo Extra envo-extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envo Extra: from n/a through <= 1.9.13.

    EnvoThemes Envo Extra
  • Medium 6.5
    CVE-2025-66066

    WordPress Envo Extra plugin <= 1.9.11 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvoThemes Envo Extra envo-extra allows Stored XSS.This issue affects Envo Extra: from n/a through <= 1.9.11.

    EnvoThemes Envo Extra
  • Medium 4.3
    CVE-2025-47471

    WordPress Envo Extra plugin <= 1.9.9 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in EnvoThemes Envo Extra envo-extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envo Extra: from n/a through <= 1.9.9.

    EnvoThemes Envo Extra
  • Medium 4.3
    CVE-2024-10770

    Envo Extra <= 1.9.3 - Authenticated (Contributor+) Post Disclosure

    The Envo Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.3 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authentica…

    EnvoThemes Envo Extra Web / CMS
  • Medium 6.4
    CVE-2024-5645

    Envo Extra <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget

    The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_css_id’ parameter within the Button widget in all versions up to, and including, 1.8.23 due to insufficient input sanitization and output escaping. This makes it …

    EnvoThemes Envo Extra Web / CMS
  • Medium 6.4
    CVE-2024-4385

    Envo Extra <= 1.8.16 - Authenticated (Contributor+) Cross-Site Scripting

    The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 1.8.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, w…

    EnvoThemes Envo Extra Web / CMS
  • Medium 6.5
    CVE-2024-32456

    WordPress Envo Extra plugin <= 1.8.11 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvoThemes Envo Extra allows Stored XSS.This issue affects Envo Extra: from n/a through 1.8.11.

    EnvoThemes Envo Extra