Skip to content
OpenAdvisories

Vendor

themeisle

122 known vulnerabilities.

Products

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator 17 Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More 14 Multiple Page Generator Plugin – MPG 11 Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE 11 Visualizer: Tables and Charts Manager for WordPress 8 Redirection for Contact Form 7 8 PPOM – Product Addons & Custom Fields for WooCommerce 5 PPOM for WooCommerce 4 Visualizer 4 WP Full Stripe Free 4 Orbit Fox by ThemeIsle 3 Auto Featured Image (Auto Post Thumbnail) 3 Menu Icons by ThemeIsle 3 Visualizer – Tables & Charts Manager with Built-in AI Generator 2 Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts 2 Otter - Gutenberg Block 2 MPG 2 LightStart – Maintenance Mode, Coming Soon and Landing Page Builder 2 Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions 2 Hestia 2 AI Chatbot for WordPress – Hyve Lite 2 Masteriyo LMS PRO 1 Cyr to Lat reloaded – transliteration of links and file names 1 Woody ad snippets 1 Neve PRO 1 Woody Code Snippets 1 Social Slider Feed – Social Media Feed & Gallery Widgets 1 Starter Sites & Templates by Neve 1 Otter Blocks PRO 1 Multiple Pages Generator by Themeisle 1 Cyrlitera 1 Feedzy 1 Social Slider Feed 1 Google Maps Plugin by Intergeo 1 Disable Comments for Any Post Types (Remove comments) 1 Disable Admin Notices individually 1 Robin Image Optimizer – Unlimited Image Optimization & WebP Converter 1 Cloud Templates & Patterns collection 1 Disable Admin Notices – Hide Dashboard Notifications 1 MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-12432 Public exploit

    Stripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter

    The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the wpfs_update_failed_payment_status AJAX action. The handler is registered through both wp_ajax_ and wp_ajax_nopriv_ hooks and th…

    themeisle Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions Web / CMS
  • Critical 9.8
    CVE-2017-20251 Public exploit

    WordPress Insert PHP Plugin < 3.3.1 PHP Code Injection via REST API

    WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests…

    themeisle Woody Code Snippets
  • Critical 9.8
    CVE-2025-11391 Public exploit

    PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Upload

    The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image cropper functionality in all versions up to, and including, 33.0.15. This makes it possible…

    themeisle PPOM – Product Addons & Custom Fields for WooCommerce Web / CMS
  • High 7.6
    CVE-2025-58789 Public exploit

    WordPress WP Full Stripe Free Plugin <= 8.2.5 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle WP Full Stripe Free wp-full-stripe-free allows SQL Injection.This issue affects WP Full Stripe Free: from n/a through <= 8.2.5.

    themeisle WP Full Stripe Free
  • Critical 9.9
    CVE-2024-3105 Public exploit

    Woody code snippets – Insert Header Footer Code, AdSense Ads <= 2.5.0 -Authenticated (Contributor+) Remote Code Execution

    The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insert_php' shortcode. This is due to the plugin not restricting the usage of the…

    themeisle Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts Web / CMS
  • Medium 5.3
    CVE-2023-47529 Public exploit

    WordPress Cloud Templates & Patterns collection Plugin <= 1.2.2 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeIsle Cloud Templates & Patterns collection.This issue affects Cloud Templates & Patterns collection: from n/a through 1.2.2.

    themeisle Cloud Templates & Patterns collection