Log in Start free

EnvoThemes

Products

ProductCVEsExploitedLatest
Envo Extra7–Mar 13, 2026
Envo's Templates & Widgets for Elementor and WooCommerce4–Jul 2, 2026
Envo's Elementor Templates & Widgets for WooCommerce3–Oct 28, 2024
Envo Multipurpose1–Mar 27, 2025

Exploited and recent CVEs

  • CVE-2026-11600 Medium 4.3 Envo's Templates & Widgets for Elementor and WooCommerce <= 1.4.26 - Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting 0.4%
  • CVE-2026-32386 Medium 4.3 WordPress Envo Extra plugin <= 1.9.13 - Broken Access Control vulnerability 0.2%
  • CVE-2025-66066 Medium 6.5 WordPress Envo Extra plugin <= 1.9.11 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2025-47471 Medium 4.3 WordPress Envo Extra plugin <= 1.9.9 - Broken Access Control Vulnerability 0.3%
  • CVE-2025-22770 Medium 5.4 WordPress Envo Multipurpose theme <= 1.1.6 - Broken Access Control vulnerability 0.3%
  • CVE-2024-10770 Medium 4.3 Envo Extra <= 1.9.3 - Authenticated (Contributor+) Post Disclosure 0.3%
  • CVE-2024-50447 Medium 6.5 WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <= 1.4.19 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2024-43292 Medium 5.9 WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <= 1.4.16 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2024-5645 Medium 6.4 Envo Extra <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget 0.3%
  • CVE-2024-4385 Medium 6.4 Envo Extra <= 1.8.16 - Authenticated (Contributor+) Cross-Site Scripting 0.3%
  • CVE-2024-35167 Medium 6.5 WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <=1.4.8 - Cross Site Scripting (XSS) vulnerability 0.4%
  • CVE-2024-32456 Medium 6.5 WordPress Envo Extra plugin <= 1.8.11 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2024-0767 Medium 4.3 Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Cross-Site Request Forgery via ajax_plugin_activation 0.3%
  • CVE-2024-0766 Medium 4.3 Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Missing Authorization via templates_ajax_request 0.5%
  • CVE-2024-0768 Medium 4.3 Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Cross-Site Request Forgery via ajax_theme_activation 0.3%