Skip to content
OpenAdvisories

Vendor

Xylus Themes

11 known vulnerabilities.

Products

WP Event Aggregator 3 WP Smart Import 2 WordPress Importer 2 WP Bulk Delete 2 XT Event Widget for Social Events 1 Import Social Events 1
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 8.1
    CVE-2025-47453

    WordPress WP Smart Import plugin <= 1.1.3 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Xylus Themes WP Smart Import wp-smart-import allows PHP Local File Inclusion.This issue affects WP Smart Import: from n/a through <= 1.1.3.

    Xylus Themes WP Smart Import
  • High 7.5
    CVE-2025-47531

    WordPress XT Event Widget for Social Events plugin <= 1.1.7 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Xylus Themes XT Event Widget for Social Events xt-facebook-events allows PHP Local File Inclusion.This issue affects XT Event Widget for S…

    Xylus Themes XT Event Widget for Social Events
  • High 7.1
    CVE-2025-24700

    WordPress WP Event Aggregator Plugin <= 1.8.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator wp-event-aggregator allows Reflected XSS.This issue affects WP Event Aggregator: from n/a through <= 1.8.2.

    Xylus Themes WP Event Aggregator
  • High 7.1
    CVE-2024-47352

    WordPress WP Bulk Delete plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Bulk Delete wp-bulk-delete allows Stored XSS.This issue affects WP Bulk Delete: from n/a through <= 1.3.1.

    Xylus Themes WP Bulk Delete
  • High 7.1
    CVE-2024-30201

    WordPress WP Smart Import plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WordPress Importer allows Reflected XSS.This issue affects WordPress Importer: from n/a through 1.0.4.

    Xylus Themes WordPress Importer Web / CMS