Log in Start free

ThemeAtelier

Products

ProductCVEsExploitedLatest
IDonatePro5–Dec 18, 2025
IDonate – Blood Donation, Request And Donor Management System4–Feb 19, 2026
ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form2–Jul 17, 2026
Domain For Sale – Sell Domains with Landing Pages, Offers & Inquiries1–Jun 6, 2025
Domain For Sale1–Sep 14, 2026
Chat Help1–Nov 21, 2025
Better Chat Support for Messenger1–Nov 21, 2025

Exploited and recent CVEs

  • CVE-2026-89023 High 8.6 ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API 0.4%
  • CVE-2026-15759 Medium 6.4 ChatHelp <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes 0.3%
  • CVE-2026-15291 High 7.5 Chat Help – Click to Chat Button & Form <= 3.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure 0.7%
  • CVE-2025-4521 High 8.8 IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_profile Function 0.3%
  • CVE-2025-60045 High 7.5 WordPress IDonatePro plugin <= 2.1.11 - Broken Access Control vulnerability 0.3%
  • CVE-2025-58938 High 7.5 WordPress IDonatePro plugin <= 2.1.9 - Broken Access Control vulnerability 0.3%
  • CVE-2025-66113 Medium 5.3 WordPress Better Chat Support for Messenger plugin <= 1.2.18 - Broken Access Control vulnerability 0.2%
  • CVE-2025-66099 Medium 5.3 WordPress Chat Help plugin <= 3.1.3 - Broken Access Control vulnerability 0.2%
  • CVE-2025-4522 Medium 6.5 IDonate 2.0.0 - 2.1.9 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion via admin_post_donor_delete Function 0.3%
  • CVE-2025-4519 High 8.8 IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_password Function 0.4%
  • CVE-2025-52752 Medium 6.5 WordPress IDonatePro plugin <= 2.1.9 - Sensitive Data Exposure vulnerability 0.3%
  • CVE-2025-30635 High 8.1 WordPress IDonatePro <= 2.1.9 - Local File Inclusion Vulnerability 0.6%
  • CVE-2025-30639 High 7.5 WordPress IDonatePro Plugin <= 2.1.9 - Broken Access Control Vulnerability 0.3%
  • CVE-2025-4523 Medium 6.5 IDonate 2.0.0 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via admin_donor_profile_view Function 0.4%
  • CVE-2025-5239 Medium 6.4 Domain For Sale <= 3.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via class_name Parameter 0.3%