Themify

16 CVEs across 30 Themify products. Browse Themify vulnerabilities, severities, and proof-of-concept exploits.

Themify products with known CVEs

ProductCVEs
Builder6
Portfolio Post5
Themify Ultra5
Ultra5
Woocommerce Product Filter5
Themify Shortcodes3
Post Type Builder (Ptb)2
Themify Edmin2
Themify Folo2
Bloggie1
Conditional Menus1
Framework1
Icons1
Photobox1
Post Type Builder Search Addon1
Product Filter1
Rezo1
Shopo1
Shortcodes1
Slide1
Store Locator1
Themify Builder1
Themify Builder1
Themify Event Post1
Themify Newsy1
Themify Popup1
Themify Portfolio Post1
Themify Shortcodes1
Themify Sidepane Wordpress Theme1
Wigi1
Themify CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-56037High8.82026-07-02Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection. This issue affects Themify Popup: from n/a through 1.4.3.
CVE-2025-31013High7.12026-06-17Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Folo allows Reflected XSS. This issue affects Th…
CVE-2025-30996Critical9.92026-01-06Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify…
CVE-2025-31048Critical9.92026-01-05Unrestricted Upload of File with Dangerous Type vulnerability in Themify Shopo allows Upload a Web Shell to a Web Server.This issue affects Shopo: from n/a thr…
CVE-2025-31047High8.82026-01-05Deserialization of Untrusted Data vulnerability in Themify Themify Edmin allows Object Injection.This issue affects Themify Edmin: from n/a through 2.0.0.
CVE-2024-13319Medium6.12025-01-22The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the UR…
CVE-2024-56216Medium6.52024-12-31Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themifyme Themify Builder themify-buil…
CVE-2024-12414Medium4.32024-12-13The Themify Store Locator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.9. This is due to missing…
CVE-2024-52423Medium6.52024-11-18Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Builder themify-builder allows Stored X…
CVE-2024-44046Medium5.92024-10-06Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify – WooCommerce Product Filter themify-wc…
CVE-2024-9385Medium6.12024-10-05The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the UR…
CVE-2024-7836Medium4.32024-08-22The Themify Builder plugin for WordPress is vulnerable to unauthorized post duplication due to missing checks on the duplicate_page_ajaxify function in all ver…
CVE-2024-43133Medium6.52024-08-12Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themify Themify Shortcodes allows Stored XSS.This…
CVE-2024-6027Critical9.82024-06-21The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to time-based SQL Injection via the ‘conditions’ parameter in all versions up to, a…
CVE-2023-46148High8.82024-06-19Missing Authorization vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.
CVE-2023-46146High8.32024-06-19Missing Authorization vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.
CVE-2024-3032Medium6.12024-06-13Themify Builder WordPress plugin before 7.5.8 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue
CVE-2023-46145High8.82024-05-17Improper Privilege Management vulnerability in Themify Themify Ultra allows Privilege Escalation.This issue affects Themify Ultra: from n/a through 7.3.5.
CVE-2024-4567Medium6.42024-05-14The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themify_button shortcode in all versions up to, and i…
CVE-2024-31366High7.12024-04-09Missing Authorization vulnerability in Themify Post Type Builder (PTB).This issue affects Post Type Builder (PTB): from n/a through 2.0.8.
CVE-2024-31365High7.12024-04-09Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Post Type Builder (PTB) allows Reflected XSS.This…
CVE-2024-2278Medium6.12024-04-01Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perfo…
CVE-2024-2263Medium4.82024-04-01Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Script…
CVE-2024-2262Medium4.72024-04-01Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filter…
CVE-2024-30440Medium5.92024-03-29Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Themify Event Post allows Stored XSS.This issue a…
CVE-2024-2732Medium5.42024-03-26The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'themify_post_slider shortcode in all versions up to…
CVE-2024-24872Medium4.32024-02-21Cross-Site Request Forgery (CSRF) vulnerability in Themify Themify Builder.This issue affects Themify Builder: from n/a through 7.0.5.
CVE-2023-51693Medium6.52024-02-01Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Icons allows Stored XSS.This issue affects Themif…
CVE-2023-46149Critical9.92023-12-20Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.
CVE-2023-46147High7.42023-12-20Deserialization of Untrusted Data vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.
CVE-2023-2654Medium6.12023-06-19The Conditional Menus WordPress plugin before 1.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Sc…
CVE-2022-32970Medium4.12023-05-10Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Themify Themify Portfolio Post plugin <= 1.2.4 versions.
CVE-2023-0362Medium5.42023-02-13Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post w…
CVE-2022-4787Medium5.42023-01-30Themify Shortcodes WordPress plugin before 2.0.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as co…
CVE-2022-4464Medium5.42023-01-16Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, wh…
CVE-2022-1532Medium6.12022-06-13Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a…
CVE-2022-1047Medium6.12022-05-09The Themify Post Type Builder Search Addon WordPress plugin before 1.4.0 does not properly escape the current page URL before reusing it in a HTML attribute, l…
CVE-2022-0200Medium5.42022-02-14Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the them…
CVE-2013-20002Critical9.82021-06-17Elemin allows remote attackers to upload and execute arbitrary PHP code via the Themify framework (before 1.2.2) wp-content/themes/elemin/themify/themify-ajax…
CVE-2021-24129Medium5.42021-03-18Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting (XSS)…