iThemes
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| BackupBuddy | 1 | – | Mar 13, 2023 |
| ServerBuddy by PluginBuddy.com | 1 | – | Aug 16, 2025 |
| WPComplete | 1 | – | Mar 28, 2023 |
Exploited and recent CVEs
- CVE-2025-49895 WordPress ServerBuddy by PluginBuddy.com plugin <= 1.0.5 - CSRF to PHP Object Injection vulnerability 0.2%
- CVE-2022-45825 WordPress WPComplete Plugin <= 2.9.4 is vulnerable to Cross Site Scripting (XSS) 0.5%
- CVE-2022-31474 WordPress BackupBuddy Plugin 8.5.8.0-8.7.4.1 is vulnerable to Directory Traversal 63.8%