Machothemes

11 CVEs across 12 Machothemes products. Browse Machothemes vulnerabilities, severities, and proof-of-concept exploits.

Machothemes products with known CVEs

ProductCVEs
Image Photo Gallery Final Tiles Grid3
Newsmag3
Regina Lite3
Antreas2
Cpo Companion2
Medzone Lite2
Naturemag Lite2
Cpo Companion1
Medzone Lite1
Naturemag Lite1
Regina Lite1
Strong Testimonials1
Machothemes CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2024-6261Medium6.42025-02-27The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'FinalTilesGallery' shortcode in al…
CVE-2024-33916Medium6.52024-05-03Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MachoThemes CPO Companion allows Stored XSS.This issue af…
CVE-2020-36721Medium6.52023-06-07The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the…
CVE-2020-36708Critical9.82023-06-07The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0…
CVE-2023-28493Medium6.52023-05-08Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes NewsMag theme <= 2.4.4 versions.
CVE-2023-27619Medium5.42023-04-25Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes Regina Lite theme <= 2.0.7 versions.
CVE-2022-4717Medium5.42023-02-06The Strong Testimonials WordPress plugin before 3.0.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, wh…
CVE-2022-4837Medium5.42023-01-30The CPO Companion WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which co…
CVE-2023-0162Medium5.52023-01-10The CPO Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its content type settings parameters in versions up to, and…
CVE-2022-0186Medium5.42022-02-21The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing user…
CVE-2020-14962Medium5.42020-06-22Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via th…