Skip to content
OpenAdvisories

Vendor

themeisle

122 known vulnerabilities.

Products

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator 17 Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More 14 Multiple Page Generator Plugin – MPG 11 Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE 11 Visualizer: Tables and Charts Manager for WordPress 8 Redirection for Contact Form 7 8 PPOM – Product Addons & Custom Fields for WooCommerce 5 PPOM for WooCommerce 4 Visualizer 4 WP Full Stripe Free 4 Orbit Fox by ThemeIsle 3 Auto Featured Image (Auto Post Thumbnail) 3 Menu Icons by ThemeIsle 3 Visualizer – Tables & Charts Manager with Built-in AI Generator 2 Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts 2 Otter - Gutenberg Block 2 MPG 2 LightStart – Maintenance Mode, Coming Soon and Landing Page Builder 2 Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions 2 Hestia 2 AI Chatbot for WordPress – Hyve Lite 2 Masteriyo LMS PRO 1 Cyr to Lat reloaded – transliteration of links and file names 1 Woody ad snippets 1 Neve PRO 1 Woody Code Snippets 1 Social Slider Feed – Social Media Feed & Gallery Widgets 1 Starter Sites & Templates by Neve 1 Otter Blocks PRO 1 Multiple Pages Generator by Themeisle 1 Cyrlitera 1 Feedzy 1 Social Slider Feed 1 Google Maps Plugin by Intergeo 1 Disable Comments for Any Post Types (Remove comments) 1 Disable Admin Notices individually 1 Robin Image Optimizer – Unlimited Image Optimization & WebP Converter 1 Cloud Templates & Patterns collection 1 Disable Admin Notices – Hide Dashboard Notifications 1 MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO 1
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-104801

    PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter

    The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible …

    themeisle PPOM – Product Addons & Custom Fields for WooCommerce Web / CMS
  • Critical 9.8
    CVE-2017-20251 Public exploit

    WordPress Insert PHP Plugin < 3.3.1 PHP Code Injection via REST API

    WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests…

    themeisle Woody Code Snippets
  • Critical 9.8
    CVE-2025-53209

    WordPress Masteriyo LMS PRO plugin <= 2.20.0 - Privilege Escalation Vulnerability

    Incorrect Privilege Assignment vulnerability in Themeisle Masteriyo LMS PRO allows Privilege Escalation. This issue affects Masteriyo LMS PRO: from n/a through 2.20.0.

    themeisle Masteriyo LMS PRO
  • Critical 9.9
    CVE-2026-25366

    WordPress Woody ad snippets plugin <= 2.7.1 - Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Themeisle Woody ad snippets insert-php allows Code Injection.This issue affects Woody ad snippets: from n/a through <= 2.7.1.

    themeisle Woody ad snippets
  • Critical 9.8
    CVE-2025-11391 Public exploit

    PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Upload

    The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image cropper functionality in all versions up to, and including, 33.0.15. This makes it possible…

    themeisle PPOM – Product Addons & Custom Fields for WooCommerce Web / CMS
  • Critical 9.9
    CVE-2024-3105 Public exploit

    Woody code snippets – Insert Header Footer Code, AdSense Ads <= 2.5.0 -Authenticated (Contributor+) Remote Code Execution

    The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insert_php' shortcode. This is due to the plugin not restricting the usage of the…

    themeisle Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts Web / CMS
  • Critical 9.8
    CVE-2024-3962

    Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file

    The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppom_upload_file function in all versions up to, and including, 32.0.18. This makes it possible for unauthentic…

    themeisle PPOM – Product Addons & Custom Fields for WooCommerce Web / CMS
  • Critical 9.1
    CVE-2024-27951

    WordPress Multiple Page Generator Plugin <= 3.4.0 - Auth. Remote Code Execution (RCE) vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Themeisle Multiple Page Generator Plugin – MPG allows Upload a Web Shell to a Web Server.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.0.

    themeisle Multiple Page Generator Plugin – MPG