Themes4WP

Products

Product	CVEs	Exploited	Latest
Popularis Extra	3	–	Feb 19, 2026
Bulk	1	–	May 19, 2025
Popularis Verse	1	–	Jan 2, 2025
Themes4WP YouTube External Subtitles	1	–	Oct 28, 2024

CVE-2026-25422 Medium 5.4 WordPress Popularis Extra plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) vulnerability 0.1%
CVE-2025-26867 Medium 5.3 WordPress Bulk theme <= 1.0.11 - Broken Access Control vulnerability 0.3%
CVE-2024-38763 Medium 4.3 WordPress Popularis Verse theme <= 1.1.1 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
CVE-2024-10795 Medium 4.3 Popularis Extra <= 1.2.7 - Authenticated (Contributor+) Post Disclosure 0.3%
CVE-2024-50470 Medium 6.5 WordPress Themes4WP YouTube External Subtitles plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability 0.3%
CVE-2024-9353 Medium 6.1 Popularis Extra <= 1.2.6 - Reflected Cross-Site Scripting 0.4%