Ex-Themes vulnerabilities
We track 6 vulnerabilities in Ex-Themes products across 5 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on November 6, 2025.
Latest Ex-Themes vulnerabilities
- 7.1 High severity
WooTour: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ex-Themes WooTour woo-tour allows Reflected XSS.This issue affects WooTour: from n/a through <= 3.6.3.
- 9.8 Critical severity
WooCommerce Food - Restaurant Menu & Food…: Improper Control of Generation of Code
The WooCommerce Food - Restaurant Menu & Food ordering plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.2. This is due to the software allowing users to execute an action that does not properly valid
- 7.1 High severity
WP Timeline – Vertical and Horizontal timeline…: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines allows Reflected XSS.This issue affects WP Timeline – Vertical and Horizontal tim
- 7.5 High severity
WP Timeline – Vertical and Horizontal timeline…: Path Traversal: '.../...//'
Path Traversal: '.../...//' vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n/a through <= 3.6.7.
- 8.1 High severity
WP Timeline – Vertical and Horizontal timeline…: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines.This issue affects WP Timeline – Vertical and Horizontal timel
- 9.1 Critical severity
WooEvents - Calendar and Event Booking: Improper Limitation of a Pathname to a Restricted Directory
The WooEvents - Calendar and Event Booking plugin for WordPress is vulnerable to arbitrary file overwrite due to insufficient file path validation in the inc/barcode.php file in all versions up to, and including, 4.1.2. This makes it possible for unauthenticat