Skip to content
OpenAdvisories

Vendor

Extend Themes

45 known vulnerabilities.

Products

Colibri Page Builder 20 Kubio AI Page Builder 11 Colibri WP 2 Materialis 2 Mesmerize 2 Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads 1 EmpowerWP 1 Pathway 1 Hugo WP 1 Althea WP 1 Elevate WP 1 Vireo 1 Brite 1 Vertice 1 Skyline WP 1 Calliope 1 Teluro 1 Kubio AI Website Builder 1 Highlight 1 Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.2
    CVE-2026-107758

    Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments

    The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthe…

    Extend Themes Colibri Page Builder Web / CMS
  • High 7.1
    CVE-2026-94167

    WordPress Kubio AI Page Builder plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder kubio allows Reflected XSS.This issue affects Kubio AI Page Builder: from n/a through 2.9.3.

    Extend Themes Kubio AI Page Builder
  • High 7.2
    CVE-2026-100107

    Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)

    The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthen…

    Extend Themes Kubio AI Page Builder Web / CMS
  • High 7.5
    CVE-2026-78268

    WordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads plugin <= 1.2.0 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget &amp; AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versions.

    Extend Themes Lead Generation Contact Widget &amp; AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads
  • High 7.2
    CVE-2023-2188

    Colibri Page Builder <= 1.0.227 - Authenticated (Administrator+) SQL Injection via post_id

    The Colibri Page Builder for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 1.0.227 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer…

    Extend Themes Colibri Page Builder
  • High 8.8
    CVE-2019-25142

    Mesmerize <= 1.6.89 & Materialis <= 1.0.172 - Authenticated Arbitrary Options Update

    The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172 (Materialis). This is due to 'companion_disable_popup' function only checking the nonce while sendin…

    Extend Themes Materialis Mesmerize