Imithemes vulnerabilities
We track 8 vulnerabilities in Imithemes products across 6 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on July 2, 2026.
Latest Imithemes vulnerabilities
- 7.1 High severity
NativeChurch: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes NativeChurch nativechurch allows Reflected XSS.This issue affects NativeChurch: from n/a before 4.9.5.
- 7.1 High severity
Gaea: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes Gaea gaea allows Reflected XSS.This issue affects Gaea: from n/a through < 3.8.
- 8.8 High severity
Real Spaces - WordPress Properties Directory…: Improper Privilege Management
The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'change_role_member' parameter in all versions up to, and including, 3.5. This is due to a lack of restriction in the profile update role.
- 9.8 Critical severity
Real Spaces - WordPress Properties Directory…: Improper Privilege Management
The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'imic_agent_register' function in all versions up to, and including, 3.6. This is due to a lack of restriction in the registration role. Th
- 8.8 High severity
Eventer: Missing Authorization
Missing Authorization vulnerability in imithemes Eventer eventer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eventer: from n/a through < 3.11.4.
- 9.8 Critical severity
Eventer: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in imithemes Eventer eventer allows Blind SQL Injection.This issue affects Eventer: from n/a through < 3.11.4.
- 9.8 Critical severity
IMITHEMES Listing: Unverified Password Change
The IMITHEMES Listing plugin is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3. This is due to the plugin not properly validating a verification code value prior to updating their password through the imic_res
- 7.5 High severity
Eventer - WordPress Event & Booking Manager…: Improper Neutralization of Special Elements used in an SQL Command
The Eventer plugin for WordPress is vulnerable to SQL Injection via the 'event' parameter in the 'eventer_get_attendees' function in all versions up to, and including, 3.9.8 due to insufficient escaping on the user supplied parameter and lack of sufficient pre