MVPThemes
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| ZoxPress - The All-In-One WordPress News Theme | 2 | – | Feb 12, 2025 |
| Flex Mag - Responsive WordPress News Theme | 1 | – | Mar 7, 2025 |
| Jawn | 1 | – | Aug 24, 2026 |
| Reviewer | 1 | – | Aug 13, 2026 |
| Click Mag - Viral WordPress News Magazine/Blog Theme | 1 | – | Feb 12, 2025 |
| Zox News | 1 | – | Jan 26, 2025 |
| Zox News - Professional WordPress News & Magazine Theme | 1 | – | Feb 11, 2025 |
| The League | 1 | – | Mar 25, 2026 |
Exploited and recent CVEs
- CVE-2026-66648 WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability 0.5%
- CVE-2026-66658 WordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerability 0.4%
- CVE-2026-25454 WordPress The League theme <= 4.4.1 - Broken Access Control vulnerability 0.3%
- CVE-2024-13655 Flex Mag - Responsive WordPress News Theme <= 3.5.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Deletion 0.3%
- CVE-2024-13654 ZoxPress - The All-In-One WordPress News Theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion 0.4%
- CVE-2024-13656 Click Mag - Viral WordPress News Magazine/Blog Theme <= 3.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion 0.5%
- CVE-2024-13653 ZoxPress - The All-In-One WordPress News Theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update 0.5%
- CVE-2024-13643 Zox News <= 3.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Modification 0.6%
- CVE-2024-11936 Zox News <= 3.16.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update 0.4%