ThemeMakers vulnerabilities
We track 6 vulnerabilities in ThemeMakers products across 4 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on March 25, 2026.
Latest ThemeMakers vulnerabilities
- 7.1 High severity
Car Dealer: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeMakers Car Dealer cardealer allows Reflected XSS.This issue affects Car Dealer: from n/a through <= 1.6.7.
- 9.8 Critical severity
ThemeMakers Visual Content Composer: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeMakers ThemeMakers Visual Content Composer tmm_content_composer allows Object Injection.This issue affects ThemeMakers Visual Content Composer: from n/a through <= 1.5.8.
- 9.8 Critical severity
Car Dealer: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeMakers Car Dealer cardealer allows Object Injection.This issue affects Car Dealer: from n/a through < 1.6.8.
- 8.8 High severity
Car Dealer Automotive WordPress Theme –…: Cross-Site Request Forgery
The Cardealer theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.4. This is due to missing nonce validation on the 'update_user_profile' function. This makes it possible for unauthenticated attackers to update
- 8.8 High severity
Car Dealer Automotive WordPress Theme –…: Missing Authorization
The Cardealer theme for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.4 due to missing capability check on the 'save_settings' function. This makes it possible for authenticated attackers, with subscriber-level access an
- 8.8 High severity
Car Dealer Automotive WordPress Theme –…: Improper Limitation of a Pathname to a Restricted Directory
The Car Dealer Automotive WordPress Theme – Responsive theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_post_photo() and add_car() functions in all versions up to, and including, 1.6.3. This ma