CVE-2026-5427 | Medium | 5.3 | 2026-04-17 | The Kubio plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 2.7.2. This is due to insufficient capability checks in t… |
CVE-2025-62751 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in extendthemes Vireo vireo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vire… |
CVE-2025-11747 | Medium | 6.4 | 2025-12-19 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the colibri_blog_posts shortcode in all versions up to, and incl… |
CVE-2025-11376 | Medium | 6.4 | 2025-12-13 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_loop' shortcode in all versions up to, and… |
CVE-2025-59593 | Medium | 5.9 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder a… |
CVE-2025-9560 | Medium | 6.4 | 2025-10-11 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_newsletter shortcode in all versions up to… |
CVE-2025-8487 | Medium | 5.4 | 2025-09-19 | The Kubio AI Page Builder plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the kubio-image-hub-insta… |
CVE-2025-32185 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder a… |
CVE-2025-2294 | Critical | 9.8 | 2025-03-28 | The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via thekubio_hybrid_theme_load… |
CVE-2024-13516 | Medium | 6.1 | 2025-01-18 | The Kubio AI Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including… |
CVE-2024-37458 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in extendthemes Highlight highlight allows Cross Site Request Forgery.This issue affects Highlight: from n/a th… |
CVE-2024-37431 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in extendthemes Mesmerize mesmerize allows Cross Site Request Forgery.This issue affects Mesmerize: from n/a th… |
CVE-2024-5020 | Medium | 6.4 | 2024-12-04 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in… |
CVE-2024-39661 | Medium | 6.5 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ExtendThemes Kubio AI Page Builder.This issue affe… |
CVE-2023-3204 | Medium | 6.5 | 2024-06-20 | The Materialis theme for WordPress is vulnerable to limited arbitrary options updates in versions up to, and including, 1.1.24. This is due to missing authoriz… |
CVE-2024-4451 | Medium | 6.4 | 2024-06-07 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_video_player shortcode in all versions up t… |
CVE-2024-5038 | Medium | 6.4 | 2024-06-06 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including… |
CVE-2024-4707 | Medium | 6.4 | 2024-06-06 | The Materialis Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's materialis_contact_form shortcode in all versions u… |
CVE-2024-34809 | Medium | 4.3 | 2024-05-17 | Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes EmpowerWP.This issue affects EmpowerWP: from n/a through 1.0.21. |
CVE-2024-3340 | Medium | 5.4 | 2024-05-02 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri-gallery-slideshow' shortcode in all versio… |
CVE-2024-3338 | Medium | 4.4 | 2024-05-02 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt data parameter in all versions up to, and including, 1… |
CVE-2024-3337 | Medium | 6.4 | 2024-05-02 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_breadcrumb_element' shortcode in all versi… |
CVE-2024-33688 | Medium | 4.3 | 2024-04-26 | Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Teluro.This issue affects Teluro: from n/a through 1.0.31. |
CVE-2024-2839 | Medium | 6.4 | 2024-04-02 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_post_title' shortcode in all versions up t… |
CVE-2024-28004 | Medium | 5.4 | 2024-03-28 | Missing Authorization vulnerability in ExtendThemes Colibri Page Builder.This issue affects Colibri Page Builder: from n/a through 1.0.248. |
CVE-2024-2904 | Medium | 4.3 | 2024-03-26 | Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Calliope.This issue affects Calliope: from n/a through 1.0.33. |
CVE-2024-1870 | Medium | 4.3 | 2024-03-09 | The Colibri Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callActivateLicenseEn… |
CVE-2024-1362 | Medium | 4.3 | 2024-02-23 | The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. This is due to missing… |
CVE-2024-1361 | Medium | 4.3 | 2024-02-23 | The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. This is due to missing… |
CVE-2024-1360 | Medium | 4.3 | 2024-02-23 | The Colibri WP theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.94. This is due to missing or incorrec… |
CVE-2023-6988 | Medium | 6.4 | 2024-01-11 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's extend_builder_render_js shortcode in all versions… |
CVE-2023-50833 | Medium | 6.5 | 2023-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExtendThemes Colibri Page Builder allows Stored XSS.This… |
CVE-2023-2188 | High | 7.2 | 2023-08-31 | The Colibri Page Builder for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 1.0.227 due to insufficient… |
CVE-2019-25142 | High | 8.8 | 2023-06-07 | The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172… |
CVE-2022-4762 | Medium | 5.4 | 2023-02-06 | The Materialis Companion WordPress plugin before 1.3.40 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-4481 | Medium | 5.4 | 2023-01-16 | The Mesmerize Companion WordPress plugin before 1.6.135 does not validate and escape some of its shortcode attributes before outputting them back in the page… |