BdThemes vulnerabilities
We track 13 vulnerabilities in BdThemes products across 13 products. 13 are rated high or critical, and none are known to be exploited. The most recent was published on October 28, 2026.
Latest BdThemes vulnerabilities
- 7.2 High severity
Prime Slider – Hero Slider, Carousel…: Improper Neutralization of Input During Web Page Generation
The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.7.2 due to insufficient input sanitizatio
- 9.8 Critical severity
SigmaForms Pro – AI Generated Forms: Improper Limitation of a Pathname to a Restricted Directory
The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_files function in all versions up to, and including, 1.4.11. This makes it possible for unau
- 9.8 Critical severity
SigmaForms Pro – AI Generated Forms: Unrestricted Upload of File with Dangerous Type
The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to all users du
- 7.6 High severity
Element Pack Elementor Addons: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Blind SQL Injection.This issue affects Element Pack Elementor Addons: from n/a throug
- 7.5 High severity
ZoloBlocks: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in bdthemes ZoloBlocks zoloblocks allows PHP Local File Inclusion.This issue affects ZoloBlocks: from n/a through <= 2.3.2.
- 9.8 Critical severity
Ultimate Store Kit Elementor Addons: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Object Injection.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.4.0.
- 10.0 Critical severity
Instant Image Generator: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in bdthemes Instant Image Generator ai-image allows Upload a Web Shell to a Web Server.This issue affects Instant Image Generator: from n/a through <= 1.5.2.
- 9.8 Critical severity
Ultimate Store Kit – Addon For WooCommerce…: Deserialization of Untrusted Data
The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the _ultimate_store_kit_
- 9.8 Critical severity
Ultimate Store Kit – Addon For WooCommerce…: Deserialization of Untrusted Data
The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the _ultimate_store_kit_
- 8.8 High severity
Prime Slider – Addons For Elementor: Missing Authorization
Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.2.
- 8.8 High severity
Prime Slider – Addons For Elementor: Missing Authorization
Missing Authorization vulnerability in BdThemes Prime Slider – Addons For Elementor.This issue affects Prime Slider – Addons For Elementor: from n/a through 3.13.2.
- 7.5 High severity
Element Pack – Widgets, Templates & Addons for…: Exposure of Sensitive Information to an Unauthorized Actor
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.6 via the element_pack_ajax_search functi
- 8.8 High severity
Element Pack Elementor Addons: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BdThemes Element Pack Elementor Addons.This issue affects Element Pack Elementor Addons: from n/a through 5.5.3.