Iimithemes

Products

Exploited and recent CVEs

• CVE-2026-27408 High 7.1 WordPress NativeChurch theme < 4.9.5 - Cross Site Scripting (XSS) vulnerability 0.3%
• CVE-2026-32518 High 7.1 WordPress Gaea theme < 3.8 - Reflected Cross Site Scripting (XSS) vulnerability 0.2%
• CVE-2025-6758 Critical 9.8 Real Spaces - WordPress Properties Directory Theme <= 3.6 - Unauthenticated Privilege Escalation to Administrator via 'imic_agent_register' 0.4%
• CVE-2025-8218 High 8.8 Real Spaces - WordPress Properties Directory Theme <= 3.5 - Authenticated (Subscriber+) Privilege Escalation to Administrator via 'change_role_member' 0.3%
• CVE-2025-39483 Medium 6.5 WordPress Eventer plugin < 3.9.9.1 - Content Injection vulnerability 0.3%
• CVE-2025-39481 Critical 9.3 WordPress Eventer plugin < 3.11.4 - SQL Injection vulnerability 0.5%
• CVE-2025-39482 Medium 4.3 WordPress Eventer plugin < 3.11.4 - Broken Access Control vulnerability 0.5%
• CVE-2025-2253 Critical 9.8 IMITHEMES Listing <= 3.3 - Unauthenticated Privilege Escalation via Unverified Password Reset 0.8%
• CVE-2025-0959 High 8.8 Eventer - WordPress Event & Booking Manager Plugin <= 3.9.9.2 - Authenticated (Subscriber+) SQL Injection via reg_id 0.4%
• CVE-2025-22635 High 7.1 WordPress Eventer - WordPress Event & Booking Manager Plugin plugin < 3.9.9 - Reflected Cross Site Scripting (XSS) vulnerability 0.2%
• CVE-2024-11134 Medium 4.3 Eventer <= 3.9.9 - Missing Authorization to Authenticated (Subscriber+) Bookings Export 0.3%
• CVE-2024-11132 Medium 6.4 Eventer <= 3.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.3%
• CVE-2024-11133 Medium 5.3 Eventer <= 3.9.9.5 - Missing Authorization to Unauthenticated Event Ticket Download 0.3%
• CVE-2024-11135 High 7.5 Eventer <= 3.9.8 - Unauthenticated SQL Injection via eventer_get_attendees 0.5%
• CVE-2024-10799 Medium 6.5 Eventer <= 3.9.7 - Authenticated (Subscriber+) Arbitrary File Read 0.8%