Skip to content
OpenAdvisories

Vendor

imithemes

16 known vulnerabilities.

Products

Eventer - WordPress Event & Booking Manager Plugin 6 Eventer 4 Real Spaces - WordPress Properties Directory Theme 2 NativeChurch 2 IMITHEMES Listing 1 Gaea 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2014-125133

    NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php

    NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequen…

    imithemes NativeChurch Web / CMS
  • High 7.1
    CVE-2026-27408

    WordPress NativeChurch theme < 4.9.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes NativeChurch nativechurch allows Reflected XSS.This issue affects NativeChurch: from n/a before 4.9.5.

    imithemes NativeChurch
  • High 7.1
    CVE-2026-32518

    WordPress Gaea theme < 3.8 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes Gaea gaea allows Reflected XSS.This issue affects Gaea: from n/a through < 3.8.

    imithemes Gaea
  • High 8.8
    CVE-2025-8218

    Real Spaces - WordPress Properties Directory Theme <= 3.5 - Authenticated (Subscriber+) Privilege Escalation to Administrator via 'change_role_member'

    The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'change_role_member' parameter in all versions up to, and including, 3.5. This is due to a lack of restriction in the profile update role.…

    imithemes Real Spaces - WordPress Properties Directory Theme Web / CMS
  • High 8.8
    CVE-2025-0959

    Eventer - WordPress Event & Booking Manager Plugin <= 3.9.9.2 - Authenticated (Subscriber+) SQL Injection via reg_id

    The Eventer - WordPress Event & Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via the reg_id parameter in all versions up to, and including, 3.9.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficien…

    imithemes Eventer - WordPress Event & Booking Manager Plugin Web / CMS
  • High 7.1
    CVE-2025-22635

    WordPress Eventer - WordPress Event & Booking Manager Plugin plugin < 3.9.9 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes Eventer eventer allows Reflected XSS.This issue affects Eventer: from n/a through < 3.9.9.

    imithemes Eventer
  • High 7.5
    CVE-2024-11135

    Eventer <= 3.9.8 - Unauthenticated SQL Injection via eventer_get_attendees

    The Eventer plugin for WordPress is vulnerable to SQL Injection via the 'event' parameter in the 'eventer_get_attendees' function in all versions up to, and including, 3.9.8 due to insufficient escaping on the user supplied parameter and lack of sufficient pr…

    imithemes Eventer - WordPress Event & Booking Manager Plugin Web / CMS