Catchthemes

9 CVEs across 26 Catchthemes products. Browse Catchthemes vulnerabilities, severities, and proof-of-concept exploits.

Catchthemes products with known CVEs

ProductCVEs
Essential Widgets2
Catch Base1
Catch Base1
Catch Breadcrumb1
Catch Dark Mode1
Catch Dark Mode1
Catch Duplicate Switcher1
Catch Gallery1
Catch Ids1
Catch Import Export1
Catch Infinite Scroll1
Catch Scroll Progress Bar1
Catch Sticky Menu1
Catch Themes Demo Import1
Catch Under Construction1
Catch Web Tools1
Create1
Darcie1
Essential Content Types1
Essential Widgets1
Full Frame1
Full Frame1
Generate Child Theme1
Header Enhancement1
Social Gallery And Widget1
To Top1
Catchthemes CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-0867Medium6.42026-02-05The Essential Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ew-author, ew-archive, ew-category, ew-page, and ew-me…
CVE-2025-67543Medium6.52025-12-09Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Catch Themes Essential Widgets essential-widgets allows S…
CVE-2025-10143High7.52025-09-17The Catch Dark Mode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0 via the 'catch_dark_mode' shortcode. T…
CVE-2025-32154High7.52025-04-04Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Catch Themes Catch Dark Mode catch-dar…
CVE-2024-44010Medium5.12024-10-06Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchthemes Full frame full-frame allows Stored XSS.This…
CVE-2024-47313Medium5.12024-10-06Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchthemes Catch Base catch-base allows Stored XSS.This…
CVE-2024-47356Medium5.12024-10-06Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchthemes Create create allows Stored XSS.This issue af…
CVE-2023-25961High7.12023-05-04Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Catch Themes Darcie theme <= 1.1.5 versions.
CVE-2021-24752Medium5.72021-10-18Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users…