Log in Start free

ThemeIsle

Products

ProductCVEsExploitedLatest
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator16–Oct 29, 2026
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More14–Jun 18, 2026
Multiple Page Generator Plugin – MPG11–Jan 26, 2025
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE11–Oct 2, 2026
Visualizer: Tables and Charts Manager for WordPress8–May 28, 2026
Redirection for Contact Form 77–Jun 15, 2026
PPOM – Product Addons & Custom Fields for WooCommerce5–Oct 10, 2026
WP Full Stripe Free4–Oct 1, 2026
PPOM for WooCommerce4–Jun 25, 2026
Visualizer4–Jul 23, 2026
Orbit Fox by ThemeIsle3–Jul 27, 2026
Auto Featured Image (Auto Post Thumbnail)3–Jul 13, 2026
Menu Icons by ThemeIsle3–Feb 3, 2026
MPG2–Sep 30, 2026
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions2–Jun 27, 2026
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder2–Feb 2, 2024
Visualizer – Tables & Charts Manager with Built-in AI Generator2–Jul 24, 2026
Otter - Gutenberg Block2–Aug 20, 2025
AI Chatbot for WordPress – Hyve Lite2–Oct 5, 2026
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts2–Jun 15, 2024
Hestia2–Jul 16, 2025
Disable Admin Notices individually1–Nov 19, 2024
Robin Image Optimizer – Unlimited Image Optimization & WebP Converter1–Feb 5, 2026
Disable Admin Notices – Hide Dashboard Notifications1–Feb 25, 2026
Social Slider Feed1–Jun 15, 2026
Social Slider Feed – Social Media Feed & Gallery Widgets1–Nov 7, 2026
Starter Sites & Templates by Neve1–Feb 2, 2024
Cyrlitera1–Jun 27, 2025
Cyr to Lat reloaded – transliteration of links and file names1–Jul 23, 2026
Woody ad snippets1–Mar 25, 2026
Cloud Templates & Patterns collection1–Nov 23, 2023
Masteriyo LMS PRO1–Jun 2, 2026
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO1–Sep 12, 2026
Multiple Pages Generator by Themeisle1–Oct 29, 2026
Neve PRO1–Jun 26, 2026
Google Maps Plugin by Intergeo1–Sep 12, 2023
Otter Blocks PRO1–Jun 8, 2024
Feedzy1–Jul 27, 2026
Disable Comments for Any Post Types (Remove comments)1–May 27, 2026

Exploited and recent CVEs

  • CVE-2026-121519 Medium 6.4 Social Slider Feed <= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' Parameter –
  • CVE-2026-119054 Medium 5.4 Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url 0.2%
  • CVE-2026-110707 Medium 4.7 RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element 0.3%
  • CVE-2026-109207 High 7.2 RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL 0.3%
  • CVE-2026-104801 Critical 9.1 PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter 0.8%
  • CVE-2026-104735 Medium 6.4 RSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title> 0.2%
  • CVE-2026-97305 Medium 6.9 WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability 0.2%
  • CVE-2026-102002 Low 3.1 Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget 0.3%
  • CVE-2026-62073 High 7.5 WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability 0.2%
  • CVE-2026-97302 Medium 5.3 WordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerability 0.2%
  • CVE-2026-85198 Medium 6.5 MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path 0.5%
  • CVE-2026-4945 Medium 5.3 Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass 0.4%
  • CVE-2026-61960 High 7.1 WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-66437 Medium 4.9 WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability 0.2%
  • CVE-2026-65563 Medium 5.9 WordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-15653 Medium 6.4 Visualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter 0.3%
  • CVE-2026-65537 Medium 4.3 WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability 0.3%
  • CVE-2026-65526 High 8.5 WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability 0.4%
  • CVE-2026-61970 Medium 4.9 WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 5.0.4 - Server Side Request Forgery (SSRF) vulnerability 0.2%
  • CVE-2026-13252 Medium 6.4 RSS Aggregator by Feedzy <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aspectRatio' Attribute 0.3%
  • CVE-2026-13468 High 7.5 Visualizer <= 4.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint 0.6%
  • CVE-2026-12432 Medium 5.3 Stripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter 0.6%
  • CVE-2026-57618 Medium 6.5 WordPress Neve PRO theme <= 3.1.2 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-56050 Medium 6.5 WordPress PPOM for WooCommerce plugin <= 33.0.18 - Broken Access Control vulnerability 0.3%
  • CVE-2026-11358 Medium 4.4 Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter 0.3%
  • CVE-2026-42378 Medium 6.5 WordPress WP Full Stripe Free plugin <= 8.4.1 - Broken Authentication vulnerability 0.4%
  • CVE-2026-39507 High 7.1 WordPress Social Slider Feed plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-23970 High 7.1 WordPress Redirection for Contact Form 7 plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-8976 Medium 4.3 RSS Aggregator by Feedzy <= 5.1.7 - Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions 0.3%
  • CVE-2025-53209 Critical 9.8 WordPress Masteriyo LMS PRO plugin <= 2.20.0 - Privilege Escalation Vulnerability 0.3%