Rextheme
12 CVEs across 10 Rextheme products. Browse Rextheme vulnerabilities, severities, and proof-of-concept exploits.
Rextheme products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-59553 | High | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions. |
CVE-2026-15306 | Medium | 6.1 | 2026-07-16 | The Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search… |
CVE-2026-57417 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme Cart Lift cart-lift allows Stored XSS.This issue… |
CVE-2025-62885 | Medium | 6.5 | 2025-10-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme WP VR wpvr allows DOM-Based XSS.This issue affec… |
CVE-2025-12005 | Medium | 4.3 | 2025-10-25 | The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to unauthorized access of data in all versions up to, a… |
CVE-2025-6350 | Medium | 6.4 | 2025-06-28 | The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hotspot-hover’… |
CVE-2025-47452 | Critical | 9.9 | 2025-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in RexTheme WP VR wpvr allows Upload a Web Shell to a Web Server.This issue affects WP VR: from n… |
CVE-2025-24730 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme WP VR wpvr allows DOM-Based XSS.This issue affec… |
CVE-2023-34376 | Medium | 5.4 | 2024-12-13 | Missing Authorization vulnerability in Rextheme Change WooCommerce Add To Cart Button Text allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2024-49680 | Medium | 4.3 | 2024-11-19 | Missing Authorization vulnerability in RexTheme WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: fr… |
CVE-2024-49293 | Medium | 4.3 | 2024-10-21 | Missing Authorization vulnerability in RexTheme WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: fr… |
CVE-2023-52144 | Medium | 5.5 | 2024-04-15 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RexTheme Product Feed Manager.This issue affects Product Feed M… |
CVE-2023-6529 | Medium | 6.1 | 2024-01-08 | The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users to downgrade the pl… |
CVE-2023-40663 | High | 7.1 | 2023-09-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rextheme WP VR plugin <= 8.3.4 versions. |
CVE-2022-47449 | High | 7.1 | 2023-05-04 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RexTheme Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD plugin <= 3.1.5 versions. |
CVE-2023-1414 | Medium | 4.3 | 2023-04-24 | The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated us… |
CVE-2023-1413 | Medium | 6.1 | 2023-04-17 | The WP VR WordPress plugin before 8.2.9 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site… |
CVE-2023-25708 | Medium | 4.3 | 2023-03-15 | Cross-Site Request Forgery (CSRF) vulnerability in Rextheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin <= 8.2.7 versions. |
CVE-2023-0174 | Medium | 5.4 | 2023-02-06 | The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shor… |