Skip to content
OpenAdvisories

Vendor

themelooks

14 known vulnerabilities.

Products

Enter Addons – Ultimate Template Builder for Elementor 5 Enter Addons 5 mFolio Lite 2 FoodBook Lite – Online Food Ordering System 1 FoodBook 1
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-11802

    FoodBook Lite <= 1.5.6 - Missing Authorization to Unauthenticated User Registration via 'registration_action' AJAX Action

    The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The registration() function, accessible via the wp_ajax_nopriv_registration_action AJAX action, lacks any …

    themelooks FoodBook Lite – Online Food Ordering System Web / CMS
  • Medium 4.3
    CVE-2026-25014

    WordPress Enter Addons plugin <= 2.3.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in themelooks Enter Addons enteraddons allows Cross Site Request Forgery.This issue affects Enter Addons: from n/a through <= 2.3.2.

    themelooks Enter Addons
  • Medium 6.4
    CVE-2025-8687

    Enter Addons <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown and Image Comparison Widgets

    The Enter Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown and Image Comparison widgets in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping on user supplied …

    themelooks Enter Addons – Ultimate Template Builder for Elementor Web / CMS
  • Medium 5.3
    CVE-2025-60125

    WordPress FoodBook Plugin <= 4.7.6 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in themelooks FoodBook foodbook allows Retrieve Embedded Sensitive Data.This issue affects FoodBook: from n/a through <= 4.7.6.

    themelooks FoodBook
  • Medium 6.5
    CVE-2025-31847

    WordPress mFolio Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelooks mFolio Lite mfolio-lite allows DOM-Based XSS.This issue affects mFolio Lite: from n/a through <= 1.2.3.

    themelooks mFolio Lite
  • Medium 6.5
    CVE-2024-56252

    WordPress Enter Addons plugin <= 2.1.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelooks Enter Addons enteraddons allows Stored XSS.This issue affects Enter Addons: from n/a through <= 2.1.9.

    themelooks Enter Addons
  • Medium 4.3
    CVE-2024-10868

    Enter Addons – Ultimate Template Builder for Elementor <= 2.1.9 - Authenticated (Contributor+) Post Disclosure

    The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.9 via the Advanced Tabs widget due to insufficient restrictions on which posts can be included. Thi…

    themelooks Enter Addons – Ultimate Template Builder for Elementor Web / CMS
  • Medium 6.5
    CVE-2024-47625

    WordPress Enter Addons – Ultimate Template Builder for Elementor plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelooks Enter Addons enteraddons allows Stored XSS.This issue affects Enter Addons: from n/a through <= 2.1.8.

    themelooks Enter Addons
  • Medium 6.4
    CVE-2024-7611

    Enter Addons – Ultimate Template Builder for Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Events Card Widget

    The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute of the Events Card widget in all versions up to, and including, 2.1.8 due to insufficient input sanitization a…

    themelooks Enter Addons – Ultimate Template Builder for Elementor Web / CMS
  • Medium 6.5
    CVE-2024-43225

    WordPress Enter Addons plugin <= 2.1.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeLooks Enter Addons allows Stored XSS.This issue affects Enter Addons: from n/a through 2.1.7.

    themelooks Enter Addons
  • Medium 6.5
    CVE-2024-37263

    WordPress Enter Addons – Ultimate Template Builder for Elementor plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeLooks Enter Addons enteraddons allows Stored XSS.This issue affects Enter Addons: from n/a through 2.1.6.

    themelooks Enter Addons
  • Medium 6.4
    CVE-2024-3831

    Enter Addons – Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading widget

    The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading widget in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This ma…

    themelooks Enter Addons – Ultimate Template Builder for Elementor Web / CMS
  • Medium 6.4
    CVE-2024-3680

    Enter Addons – Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animation Title widget img tag

    The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animation Title widget's img tag in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output…

    themelooks Enter Addons – Ultimate Template Builder for Elementor Web / CMS