Vulnerabilities in bdthemes

96 results
Vexday analysis

Com 66 CVEs catalogadas, o histórico de vulnerabilidades do vendor bdthemes apresenta taxa de exploração ativa abaixo da média geral do catálogo, sem nenhum registro no CISA KEV e ausência de provas de conceito públicas, o que sugere risco operacional imediato relativamente contido. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão comum em componentes de front-end e que exige atenção contínua em ambientes com múltiplos usuários autenticados. Há 4 vulnerabilidades de severidade crítica no acervo e 3 CVEs surgiram nos últimos 90 dias, indicando cadência ativa de descobertas que justifica monitoramento regular. A CVE mais perigosa atualmente ativa, CVE-2025-8100, registra EPSS de 0,0312, valor baixo, mas que deve ser acompanhado dado o histórico recente de crescimento no volume de vulnerabilidades.

CVE-2024-9867MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Map WidgetEPSS 0.3%CVE-2024-9868MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age GateEPSS 0.3%CVE-2024-47629MEDIUMWordPress Ultimate Store Kit Elementor Addons plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47392MEDIUMWordPress Element Pack Elementor Addons plugin <= 5.7.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-39667MEDIUMWordPress Element Pack Elementor Addons plugin <= 5.6.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-3997MEDIUMPrime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pagepiling WidgetEPSS 0.3%CVE-2024-43342MEDIUMWordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-9075MEDIUMZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns <= 2.3.10 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2024-10310MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Custom Gallery WidgetEPSS 0.2%CVE-2026-24362MEDIUMWordPress Ultimate Post Kit plugin <= 4.0.21 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2024-9058MEDIUMElement Pack Elementor Addons <= 5.10.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Lightbox WidgetEPSS 0.2%CVE-2025-7644MEDIUMPixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-11536MEDIUMElement Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request ForgeryEPSS 0.2%CVE-2025-24584MEDIUMWordPress Ultimate Store Kit Elementor Addons plugin <= 2.3.0 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-40745HIGHWordPress Element Pack Elementor Addons plugin <= 8.4.2 - SQL Injection vulnerabilityEPSS 0.2%CVE-2026-65502MEDIUMWordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerabilityEPSS 0.2%CVE-2026-57413MEDIUMWordPress Instant Image Generator plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.2%CVE-2024-12043MEDIUMPrime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.16.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-12134MEDIUMZoloBlocks <= 2.3.11 - Missing Authorization to Unauthenticated Popup Enable/DisableEPSS 0.2%CVE-2026-65503MEDIUMWordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%