Themesgrove
6 CVEs across 6 Themesgrove products. Browse Themesgrove vulnerabilities, severities, and proof-of-concept exploits.
Themesgrove products with known CVEs
Themesgrove CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2025-46494 | High | 7.1 | 2026-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesgrove WidgetKit Pro allows Reflected XSS.This issue… |
CVE-2025-2330 | Medium | 6.4 | 2025-07-02 | The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button+modal' widget in all… |
CVE-2025-3851 | Medium | 4.3 | 2025-05-07 | The Download Manager and Payment Form WordPress Plugin – WP SmartPay plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 1.1.0 t… |
CVE-2024-10321 | Medium | 4.3 | 2025-03-08 | The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5… |
CVE-2024-37428 | Medium | 6.5 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themesgrove WidgetKit allows Stored XSS.This issue… |
CVE-2024-34548 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesgrove WidgetKit allows Stored XSS.This issue affect… |
CVE-2024-33908 | Medium | 5.3 | 2024-05-06 | Missing Authorization vulnerability in Themesgrove WidgetKit.This issue affects WidgetKit: from n/a through 2.5.0. |
CVE-2024-2137 | Medium | 6.4 | 2024-04-12 | The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple pricing widgets (e.g. Pricing Si… |
CVE-2023-38391 | Medium | 6.7 | 2023-11-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themesgrove Onepage Builder allows SQL Injection.This iss… |
CVE-2022-4256 | Medium | 4.8 | 2023-01-02 | The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users suc… |
CVE-2021-24267 | Medium | 5.4 | 2021-05-05 | The “All-in-One Addons for Elementor – WidgetKit” WordPress Plugin before 2.3.10 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) b… |