Vulnerabilidades em themeisle

120 resultados
Análise Vexday

Com 65 CVEs catalogadas, o portfólio de plugins e temas da Themeisle apresenta taxa de exploração ativa abaixo da média geral do catálogo CISA KEV, sem nenhum registro confirmado de exploração em ambiente real. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão comum em componentes WordPress que lidam com entrada de usuário sem sanitização adequada. A CVE mais relevante no momento é CVE-2024-3105, com score EPSS de 0,0278, indicando probabilidade ainda baixa de exploração massiva a curto prazo, embora a existência de uma prova de conceito pública exija atenção redobrada por parte de equipes de segurança. As 4 CVEs surgidas nos últimos 90 dias e as 3 classificadas como críticas reforçam a necessidade de monitoramento contínuo e atualização prioritária dos produtos afetados.

CVE-2025-12045MEDIUMOrbit Fox Companion <= 3.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post TaxonomyEPSS 0.2%CVE-2026-23970HIGHWordPress Redirection for Contact Form 7 plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-66069MEDIUMWordPress PPOM for WooCommerce plugin <= 33.0.16 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2024-1162MEDIUMOrbit Fox by ThemeIsle <= 2.10.29 - Cross-Site Request ForgeryEPSS 0.2%CVE-2026-1319MEDIUMRobin Image Optimizer <= 2.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Alternative Text FieldEPSS 0.2%CVE-2026-119054MEDIUMMultiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-urlEPSS 0.2%CVE-2026-57618MEDIUMWordPress Neve PRO theme <= 3.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-31301MEDIUMWordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.0 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2026-1755MEDIUMMenu Icons by ThemeIsle <= 0.13.20 - Authenticated (Author+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-104735MEDIUMRSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title>EPSS 0.2%CVE-2025-58593MEDIUMWordPress Orbit Fox by ThemeIsle Plugin <= 3.0.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2024-52420MEDIUMWordPress Disable Admin Notices individually plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2024-37467MEDIUMWordPress Hestia theme <= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2026-97302MEDIUMWordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-61970MEDIUMWordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 5.0.4 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.2%CVE-2026-66437MEDIUMWordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.2%CVE-2026-39507HIGHWordPress Social Slider Feed plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-24573MEDIUMWordPress Visualizer plugin < 4.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-53254MEDIUMWordPress Cyrlitera plugin <= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2026-2410MEDIUMDisable Admin Notices – Hide Dashboard Notifications <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings UpdateEPSS 0.2%