Themeisle
Vulnerability activity for Themeisle: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 5
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 9
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 9
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 5.4MediumOct 29, 2026Multiple Pages Generator by Themeisle XSSCVE-2026-119054Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and rendered unescaped through {{mpg_url}}, executing script in administrators' browsers.
- 4.7MediumOct 29, 2026Themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator XSSCVE-2026-110707The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:group/media:description (XML element in the imported feed)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injecte
- 7.2HighOct 16, 2026Themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator XSSCVE-2026-109207The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to control
- 9.1CriticalOct 10, 2026Themeisle PPOM – Product Addons & Custom Fields for WooCommerce Path traversal / file handlingCVE-2026-104801The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The relocated file is moved byte-identically into the publicly acce
- 6.4MediumOct 10, 2026Themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator XSSCVE-2026-104735The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title> in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injecte
- 6.9MediumOct 5, 2026Themeisle AI Chatbot for WordPress – Hyve Lite Auth bypass / access controlCVE-2026-97305Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2.
- 5.3MediumSep 30, 2026Themeisle MPG Information disclosureCVE-2026-97302Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.
- 6.5MediumSep 12, 2026Themeisle MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO SQL injectionCVE-2026-85198The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensi
- 5.3MediumSep 7, 2026Themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Auth bypass / access controlCVE-2026-4945The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the
Top products
- RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator3 CVEs in the last year
- PPOM – Product Addons & Custom Fields for WooCommerce1 CVE in the last year, 1 critical
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE1 CVE in the last year
- Multiple Pages Generator by Themeisle1 CVE in the last year
- MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO1 CVE in the last year
- MPG1 CVE in the last year
- AI Chatbot for WordPress – Hyve Lite1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.