Skip to content
OpenAdvisories

Vendor

themeisle

122 known vulnerabilities.

Products

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator 17 Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More 14 Multiple Page Generator Plugin – MPG 11 Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE 11 Visualizer: Tables and Charts Manager for WordPress 8 Redirection for Contact Form 7 8 PPOM – Product Addons & Custom Fields for WooCommerce 5 PPOM for WooCommerce 4 Visualizer 4 WP Full Stripe Free 4 Orbit Fox by ThemeIsle 3 Auto Featured Image (Auto Post Thumbnail) 3 Menu Icons by ThemeIsle 3 Visualizer – Tables & Charts Manager with Built-in AI Generator 2 Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts 2 Otter - Gutenberg Block 2 MPG 2 LightStart – Maintenance Mode, Coming Soon and Landing Page Builder 2 Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions 2 Hestia 2 AI Chatbot for WordPress – Hyve Lite 2 Masteriyo LMS PRO 1 Cyr to Lat reloaded – transliteration of links and file names 1 Woody ad snippets 1 Neve PRO 1 Woody Code Snippets 1 Social Slider Feed – Social Media Feed & Gallery Widgets 1 Starter Sites & Templates by Neve 1 Otter Blocks PRO 1 Multiple Pages Generator by Themeisle 1 Cyrlitera 1 Feedzy 1 Social Slider Feed 1 Google Maps Plugin by Intergeo 1 Disable Comments for Any Post Types (Remove comments) 1 Disable Admin Notices individually 1 Robin Image Optimizer – Unlimited Image Optimization & WebP Converter 1 Cloud Templates & Patterns collection 1 Disable Admin Notices – Hide Dashboard Notifications 1 MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO 1
All Critical High Medium Low Exploited only Public exploit

26 results · Clear filters · Feed

  • High 7.2
    CVE-2026-109207

    RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL

    The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insu…

    themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Web / CMS
  • High 7.5
    CVE-2026-62073

    WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.

    themeisle WP Full Stripe Free
  • High 7.1
    CVE-2026-61960

    WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.

    themeisle WP Full Stripe Free
  • High 8.5
    CVE-2026-65526

    WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1.

    themeisle Visualizer
  • High 7.5
    CVE-2026-13468

    Visualizer <= 4.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint

    The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform a…

    themeisle Visualizer – Tables & Charts Manager with Built-in AI Generator Web / CMS
  • High 7.1
    CVE-2026-39507

    WordPress Social Slider Feed plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions.

    themeisle Social Slider Feed
  • High 7.1
    CVE-2026-23970

    WordPress Redirection for Contact Form 7 plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions.

    themeisle Redirection for Contact Form 7
  • High 7.1
    CVE-2026-42749

    WordPress Disable Comments for Any Post Types (Remove comments) plugin <= 1.3.0 - Broken Authentication vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeisle Disable Comments for Any Post Types (Remove comments) comments-plus allows Password Recovery Exploitation.This issue affects Disable Comments for Any Post Types (Remove commen…

    themeisle Disable Comments for Any Post Types (Remove comments)
  • High 7.5
    CVE-2026-2892

    Otter Blocks <= 3.1.4 - Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie

    The Otter Blocks plugin for WordPress is vulnerable to Purchase Verification Bypass in all versions up to, and including, 3.1.4. This is due to the 'get_customer_data' method relying on an unsigned 'o_stripe_data' cookie to determine Stripe product ownership …

    themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Web / CMS
  • High 8.1
    CVE-2025-14800

    Redirection for Contact Form 7 <= 3.2.7 - Unauthenticated Arbitrary File Copy via move_file_to_upload

    The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_file_to_upload' function in all versions up to, and including, 3.2.7. This makes it possible for unauthenticated a…

    themeisle Redirection for Contact Form 7 Web / CMS
  • High 7.5
    CVE-2025-9322

    Stripe Payment Forms <= 8.3.1 - Unauthenticated SQL Injection

    The Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions plugin for WordPress is vulnerable to SQL Injection via the 'wpfs-form-name' parameter in all versions up to, and including, 8.3.1 due to insufficient escaping on…

    themeisle Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions Web / CMS
  • High 7.5
    CVE-2025-11691

    PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated SQL Injection

    The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the PPOM_Meta::get_fields_by_id() function in all versions up to, and including, 33.0.15 due to insufficient escaping on the user supplied parame…

    themeisle PPOM – Product Addons & Custom Fields for WooCommerce Web / CMS
  • High 7.6
    CVE-2025-58789 Public exploit

    WordPress WP Full Stripe Free Plugin <= 8.2.5 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle WP Full Stripe Free wp-full-stripe-free allows SQL Injection.This issue affects WP Full Stripe Free: from n/a through <= 8.2.5.

    themeisle WP Full Stripe Free
  • High 7.5
    CVE-2025-55715

    WordPress Otter - Gutenberg Block Plugin <= 3.1.0 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Themeisle Otter - Gutenberg Block otter-blocks allows Retrieve Embedded Sensitive Data.This issue affects Otter - Gutenberg Block: from n/a through <= 3.1.0.

    themeisle Otter - Gutenberg Block
  • High 7.5
    CVE-2025-8289

    Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection via PHAR Deserialization

    The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the delete_associated_files function. This makes it possible for unauthenticate…

    themeisle Redirection for Contact Form 7 Web / CMS
  • High 8.8
    CVE-2025-8141

    Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated Arbitrary File Deletion

    The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_associated_files function in all versions up to, and including, 3.2.4. This makes it possible for unauthent…

    themeisle Redirection for Contact Form 7 Web / CMS
  • High 8.8
    CVE-2025-8145

    Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection

    The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the get_lead_fields function. This makes it possible for unauthenticated attack…

    themeisle Redirection for Contact Form 7 Web / CMS
  • High 7.5
    CVE-2023-39920

    WordPress Redirection for Contact Form 7 plugin <= 2.9.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Themeisle Redirection for Contact Form 7 wpcf7-redirect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Redirection for Contact Form 7: from n/a through <= 2.9.2.

    themeisle Redirection for Contact Form 7
  • High 8.5
    CVE-2024-47325

    WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.7 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle MPG multiple-pages-generator-by-porthas allows SQL Injection.This issue affects MPG: from n/a through <= 3.4.7.

    themeisle MPG
  • High 8.5
    CVE-2024-35736

    WordPress Visualizer plugin <= 3.11.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer.This issue affects Visualizer: from n/a through 3.11.1.

    themeisle Visualizer
  • High 8.8
    CVE-2024-3750

    Visualizer: Tables and Charts Manager for WordPress <= 3.10.15 - Missing Authorization to Arbitrary SQL Execution

    The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on the getQueryData() function in all versions up to, and including, 3.10.15. This …

    themeisle Visualizer: Tables and Charts Manager for WordPress Web / CMS
  • High 7.1
    CVE-2024-27958

    WordPress Visualizer plugin <= 3.10.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Visualizer allows Reflected XSS.This issue affects Visualizer: from n/a through 3.10.5.

    themeisle Visualizer
  • High 8.8
    CVE-2024-1317

    RSS Aggregator by Feedzy <= 4.4.2 - Authenticated(Contributor+) SQL Injection

    The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to SQL Injection via the ‘search_key’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the…

    themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Web / CMS
  • High 7.6
    CVE-2023-33927

    WordPress Multiple Page Generator Plugin – MPG Plugin <= 3.3.19 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Multiple Page Generator Plugin – MPG multiple-pages-generator-by-porthas allows SQL Injection.This issue affects Multiple Page Generator Plugin – M…

    themeisle Multiple Page Generator Plugin – MPG
  • High 7.2
    CVE-2023-2607

    Multiple Page Generator Plugin <= 3.3.17 - Authenticated (Administrator+) SQL Injection

    The Multiple Page Generator Plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to insufficient escaping on the user supplied parameter and lack of sufficient prepara…

    themeisle Multiple Page Generator Plugin – MPG Web / CMS
  • High 8.8
    CVE-2022-2444

    Visualizer: Tables and Charts Manager for WordPress <= 3.7.9 - Authenticated (Contributor+) PHAR Deserialization

    The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 'remote_data' parameter in versions up to, and including 3.7.9. This makes it possible for authenticated attackers with co…

    themeisle Visualizer: Tables and Charts Manager for WordPress Web / CMS