Themesgrove

11 CVEs across 6 Themesgrove products. Browse Themesgrove vulnerabilities, severities, and proof-of-concept exploits.

Themesgrove products with known CVEs

ProductCVEs
All-In-One Addons For Elementor6
Widgetkit3
Download Manager And Payment Form WordPress Plugin – Wp Smartpay1
Onepage Builder1
Onepage Builder1
Widgetkit Pro1
Themesgrove CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-46494High7.12026-01-07Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesgrove WidgetKit Pro allows Reflected XSS.This issue…
CVE-2025-2330Medium6.42025-07-02The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button+modal' widget in all…
CVE-2025-3851Medium4.32025-05-07The Download Manager and Payment Form WordPress Plugin – WP SmartPay plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 1.1.0 t…
CVE-2024-10321Medium4.32025-03-08The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5…
CVE-2024-37428Medium6.52024-07-22Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themesgrove WidgetKit allows Stored XSS.This issue…
CVE-2024-34548Medium6.52024-05-08Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesgrove WidgetKit allows Stored XSS.This issue affect…
CVE-2024-33908Medium5.32024-05-06Missing Authorization vulnerability in Themesgrove WidgetKit.This issue affects WidgetKit: from n/a through 2.5.0.
CVE-2024-2137Medium6.42024-04-12The All-in-One Addons for Elementor – WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple pricing widgets (e.g. Pricing Si…
CVE-2023-38391Medium6.72023-11-04Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themesgrove Onepage Builder allows SQL Injection.This iss…
CVE-2022-4256Medium4.82023-01-02The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users suc…
CVE-2021-24267Medium5.42021-05-05The “All-in-One Addons for Elementor – WidgetKit” WordPress Plugin before 2.3.10 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) b…