ThemeIsle vulnerabilities
We track 35 vulnerabilities in ThemeIsle products across 22 products. 35 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest ThemeIsle vulnerabilities
- 7.1 High severity
Woody ad snippets: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Woody ad snippets insert-php allows Reflected XSS.This issue affects Woody ad snippets: from n/a through 2.7.10.
- 7.2 High severity
RSS Aggregator by Feedzy – Feed to Post…: Improper Neutralization of Input During Web Page Generation
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insuf
- 9.1 Critical severity
PPOM – Product Addons & Custom Fields for…: Improper Limitation of a Pathname to a Restricted Directory
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible f
- 8.5 High severity
Visualizer: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1.
- 7.5 High severity
Visualizer – Tables & Charts Manager with…: Missing Authorization
The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an
- 9.8 Critical severity
Woody Code Snippets: Improper Control of Generation of Code
WordPress Insert PHP plugin versions before 2.5.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests
- 9.8 Critical severity
Masteriyo LMS PRO: Incorrect Privilege Assignment
Incorrect Privilege Assignment vulnerability in Themeisle Masteriyo LMS PRO allows Privilege Escalation. This issue affects Masteriyo LMS PRO: from n/a through 2.20.0.
- 7.1 High severity
Disable Comments for Any Post Types (Remove…: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeisle Disable Comments for Any Post Types (Remove comments) comments-plus allows Password Recovery Exploitation.This issue affects Disable Comments for Any Post Types (Remove comment
- 7.5 High severity
Otter Blocks – Gutenberg Blocks, Page Builder…: Improper Authorization
The Otter Blocks plugin for WordPress is vulnerable to Purchase Verification Bypass in all versions up to, and including, 3.1.4. This is due to the 'get_customer_data' method relying on an unsigned 'o_stripe_data' cookie to determine Stripe product ownership f
- 9.9 Critical severity
Woody ad snippets: Improper Control of Generation of Code
Improper Control of Generation of Code ('Code Injection') vulnerability in Themeisle Woody ad snippets insert-php allows Code Injection.This issue affects Woody ad snippets: from n/a through <= 2.7.1.
- 8.1 High severity
Redirection for Contact Form 7: Unrestricted Upload of File with Dangerous Type
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_file_to_upload' function in all versions up to, and including, 3.2.7. This makes it possible for unauthenticated at
- 7.5 High severity
Stripe Payment Forms by WP Full Pay – Accept…: Improper Neutralization of Special Elements used in an SQL Command
The Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions plugin for WordPress is vulnerable to SQL Injection via the 'wpfs-form-name' parameter in all versions up to, and including, 8.3.1 due to insufficient escaping on
- 7.5 High severity
PPOM – Product Addons & Custom Fields for…: Improper Neutralization of Special Elements used in an SQL Command
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the PPOM_Meta::get_fields_by_id() function in all versions up to, and including, 33.0.15 due to insufficient escaping on the user supplied paramet
- 9.8 Critical severity
PPOM – Product Addons & Custom Fields for…: Unrestricted Upload of File with Dangerous Type
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image cropper functionality in all versions up to, and including, 33.0.15. This makes it possible
- 7.6 High severity
WP Full Stripe Free: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle WP Full Stripe Free wp-full-stripe-free allows SQL Injection.This issue affects WP Full Stripe Free: from n/a through <= 8.2.5.
- 7.5 High severity
Otter - Gutenberg Block: Insertion of Sensitive Information Into Sent Data
Insertion of Sensitive Information Into Sent Data vulnerability in Themeisle Otter - Gutenberg Block otter-blocks allows Retrieve Embedded Sensitive Data.This issue affects Otter - Gutenberg Block: from n/a through <= 3.1.0.
- 7.5 High severity
Redirection for Contact Form 7: Deserialization of Untrusted Data
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the delete_associated_files function. This makes it possible for unauthenticated
- 8.8 High severity
Redirection for Contact Form 7: Deserialization of Untrusted Data
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the get_lead_fields function. This makes it possible for unauthenticated attacke
- 8.8 High severity
Redirection for Contact Form 7: Improper Limitation of a Pathname to a Restricted Directory
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_associated_files function in all versions up to, and including, 3.2.4. This makes it possible for unauthenti
- 8.1 High severity
Multiple Page Generator Plugin – MPG: Server-Side Request Forgery
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.5 via the 'mpg_download_file_by_link' function. This makes it possible for authenticated attackers, with editor
- 7.5 High severity
Redirection for Contact Form 7: Missing Authorization
Missing Authorization vulnerability in Themeisle Redirection for Contact Form 7 wpcf7-redirect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Redirection for Contact Form 7: from n/a through <= 2.9.2.
- 7.5 High severity
Otter Blocks – Gutenberg Blocks, Page Builder…: Improper Limitation of a Pathname to a Restricted Directory
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.0.6 via the get_image function. This makes it possible for unauthenticated attackers to vi
- 8.8 High severity
MPG: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle MPG multiple-pages-generator-by-porthas allows SQL Injection.This issue affects MPG: from n/a through <= 3.4.7.
- 9.9 Critical severity
Woody Code Snippets – Insert PHP, CSS, JS, and…: Improper Control of Generation of Code
The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insert_php' shortcode. This is due to the plugin not restricting the usage of the
- 8.8 High severity
Visualizer: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer.This issue affects Visualizer: from n/a through 3.11.1.
- 8.8 High severity
Visualizer: Tables and Charts Manager for…: Missing Authorization
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on the getQueryData() function in all versions up to, and including, 3.10.15. This m
- 9.8 Critical severity
PPOM – Product Addons & Custom Fields for…: Unrestricted Upload of File with Dangerous Type
The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppom_upload_file function in all versions up to, and including, 32.0.18. This makes it possible for unauthentica
- 8.8 High severity
Multiple Page Generator Plugin – MPG: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Multiple Page Generator Plugin – MPG.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.0.
- 7.2 High severity
Multiple Page Generator Plugin – MPG: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in Themeisle Multiple Page Generator Plugin – MPG allows Upload a Web Shell to a Web Server.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.0.
- 8.8 High severity
Multiple Page Generator Plugin – MPG: Missing Authorization
Missing Authorization vulnerability in Themeisle Multiple Page Generator Plugin – MPG.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.0.
- 8.8 High severity
RSS Aggregator by Feedzy – Feed to Post…: Improper Neutralization of Special Elements used in an SQL Command
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to SQL Injection via the ‘search_key’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the
- 7.5 High severity
Cloud Templates & Patterns collection: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeIsle Cloud Templates & Patterns collection.This issue affects Cloud Templates & Patterns collection: from n/a through 1.2.2.
- 9.8 Critical severity
Multiple Page Generator Plugin – MPG: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Multiple Page Generator Plugin – MPG multiple-pages-generator-by-porthas allows SQL Injection.This issue affects Multiple Page Generator Plugin – MP
- 7.2 High severity
Multiple Page Generator Plugin – MPG: Improper Neutralization of Special Elements used in an SQL Command
The Multiple Page Generator Plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparat
- 8.8 High severity
Visualizer: Tables and Charts Manager for…: Deserialization of Untrusted Data
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 'remote_data' parameter in versions up to, and including 3.7.9. This makes it possible for authenticated attackers with con