Vulnerabilities in themeisle
123 resultsCVE-2026-109207HIGHRSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URLEPSS 0.3%CVE-2026-110707MEDIUMRSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed ElementEPSS 0.3%CVE-2025-13794MEDIUMAuto Featured Image <= 4.2.1 - Missing Authorization to Authenticated (Contributor+) Post Thumbnail ModificationEPSS 0.3%CVE-2025-22659MEDIUMWordPress Orbit Fox by ThemeIsle plugin <= 2.10.44 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-11128MEDIUMFeedzy RSS Feeds Lite <= 5.1.0 - Authenticated (Subscriber+) Server-Side Request ForgeryEPSS 0.3%CVE-2026-8976MEDIUMRSS Aggregator by Feedzy <= 5.1.7 - Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-ActionsEPSS 0.3%CVE-2026-102002LOWOtter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard WidgetEPSS 0.3%CVE-2023-6798MEDIUMRSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Missing AuthorizationEPSS 0.3%CVE-2025-53209CRITICALWordPress Masteriyo LMS PRO plugin <= 2.20.0 - Privilege Escalation VulnerabilityEPSS 0.3%CVE-2025-1065MEDIUMVisualizer: Tables and Charts Manager for WordPress <= 3.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Import Data From FileEPSS 0.3%CVE-2026-11358MEDIUMOrbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' ParameterEPSS 0.3%CVE-2023-7073MEDIUMAuto Featured Image (Auto Post Thumbnail) <= 4.1.7 - Authenticated (Author+) Server-Side Request ForgeryEPSS 0.3%CVE-2022-47143MEDIUMWordPress Multiple Page Generator Plugin – MPG Plugin <= 3.3.9 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2025-11467MEDIUMRSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 5.1.1 - Unauthenticated Blind Server-Side Request ForgeryEPSS 0.3%CVE-2026-65537MEDIUMWordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-42749HIGHWordPress Disable Comments for Any Post Types (Remove comments) plugin <= 1.3.0 - Broken Authentication vulnerabilityEPSS 0.3%CVE-2026-61960HIGHWordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-97305MEDIUMWordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.2%CVE-2026-62073HIGHWordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-8689MEDIUMVisualizer: Tables and Charts Manager for WordPress <= 3.11.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Chart Creation and Modification via renderChartPages() and uploadData() FunctionsEPSS 0.2%