Log in Start free

ExtendThemes

Products

ProductCVEsExploitedLatest
Colibri Page Builder18–Oct 16, 2026
Kubio AI Page Builder9–Nov 7, 2026
Highlight1–Jan 2, 2025
Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy1–Oct 16, 2026
Colibri WP1–Feb 23, 2024
Materialis1–Jun 20, 2024
Mesmerize1–Jan 2, 2025
Vireo1–Dec 31, 2025

Exploited and recent CVEs

  • CVE-2026-115816 Medium 6.4 Kubio AI Page Builder <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via kubio/shortcode Block via Product Review –
  • CVE-2026-109191 Medium 4.3 Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML 0.3%
  • CVE-2026-107758 High 7.2 Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments 0.4%
  • CVE-2026-100107 High 7.2 Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass) 0.3%
  • CVE-2026-14472 Medium 6.4 Kubio AI Page Builder <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content 0.4%
  • CVE-2026-16779 Medium 4.3 Kubio AI Page Builder <= 2.8.5 - Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration Reversion via kubio_restore_front_page AJAX Action 0.4%
  • CVE-2026-5427 Medium 5.3 Kubio AI Page Builder <= 2.7.2 - Missing Authorization to Authenticated (Contributor+) Limited File Upload via Kubio Block Attributes 0.5%
  • CVE-2025-62751 Medium 4.3 WordPress Vireo theme <= 1.0.24 - Broken Access Control vulnerability 0.2%
  • CVE-2025-11747 Medium 6.4 Colibri Page Builder <= 1.0.345 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.3%
  • CVE-2025-11376 Medium 6.4 Colibri Page Builder <= 1.0.335 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.2%
  • CVE-2025-9560 Medium 6.4 Colibri Page Builder <= 1.0.334 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_newsletter Shortcode 0.2%
  • CVE-2025-8487 Medium 5.4 Kubio AI Page Builder <= 2.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation 0.3%
  • CVE-2025-2294 Critical 9.8 Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion 78.4%
  • CVE-2024-13516 Medium 6.1 Kubio AI Page Builder <= 2.3.5 - Reflected Cross-Site Scripting 0.3%
  • CVE-2024-37458 Medium 4.3 WordPress Highlight theme <= 1.0.29 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
  • CVE-2024-37431 Medium 4.3 WordPress Mesmerize theme <= 1.6.120 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
  • CVE-2024-5020 Medium 6.4 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library 0.4%
  • CVE-2024-39661 Medium 6.5 WordPress Kubio AI Page Builder plugin <= 2.2.4 - Authenticated Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2023-3204 Medium 6.5 Materialis <= 1.1.24 - Missing Authorization to Limited Arbitrary Options Update 0.4%
  • CVE-2024-4451 Medium 6.4 Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_video_player Shortcode 0.3%
  • CVE-2024-5038 Medium 6.4 Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.3%
  • CVE-2024-3340 Medium 5.4 Colibri Page Builder <= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri-gallery-slideshow' Shortcode 0.4%
  • CVE-2024-3337 Medium 6.4 Colibri Page Builder <= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri_breadcrumb_element' Shortcode 0.4%
  • CVE-2024-3338 Medium 4.4 Colibri Page Builder <= 1.0.262 - Authenticated (Author+) Stored Cross-Site Scripting 0.4%
  • CVE-2024-2839 Medium 6.4 Colibri Page Builder <= 1.0.263 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
  • CVE-2024-28004 Medium 5.4 WordPress Colibri Page Builder plugin <= 1.0.248 - Broken Access Control vulnerability 0.4%
  • CVE-2024-1870 Medium 4.3 Colibri Page Builder <= 1.0.260 - Missing Authorization 0.4%
  • CVE-2024-1360 Medium 4.3 Colibri WP <= 1.0.94 - Cross-Site Request Forgery to Limited Plugin Installation 0.2%
  • CVE-2024-1362 Medium 4.3 Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via cp_shortcode_refresh 0.2%
  • CVE-2024-1361 Medium 4.3 Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via extend_builder 0.2%