CVE Tools
Track your stack

Themeisle

74 CVEs tracked since 2023. Since May 2023, none of them reached CISA KEV.

Themeisle CVEs per month

May 2023 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Themeisle CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2023-0560
2023-064 or fewer
2023-073 or fewer
2023-084 or fewer
2023-093 or fewer
2023-104 or fewer
2023-114 or fewer
2023-124 or fewer
2024-0140
2024-0270
2024-0380
2024-0490
2024-055 or fewer
2024-0650
2024-074 or fewer
2024-084 or fewer
2024-093 or fewer
2024-104 or fewer
2024-1160
2024-123 or fewer
2025-0160
2025-023 or fewer
2025-035 or fewer
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-1050
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-06100
2026-0780
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Themeisle's monthly top three, with their CVEs summed over those months.

  1. Orbit Fox115 months
  2. Orbit Fox: Duplicate Page, Menu Icons, Svg Support, Cookie Notice, Custom Fonts & More104 months
  3. Otter Blocks94 months
  4. Rss Aggregator By Feedzy – Feed To Post, Autoblogging, News & Youtube Video Feeds Aggregator84 months
  5. Otter Blocks – Gutenberg Blocks, Page Builder For Gutenberg Editor & Fse52 months
  6. Multiple Page Generator Plugin – Mpg42 months
  7. Multiple Page Generator22 months
  8. Ppom – Product Addons & Custom Fields For Woocommerce21 month
  9. Product Addons \& Fields For Woocommerce21 month
  10. Redirection For Contact Form 722 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Themeisle.

  1. CVE-2026-109207RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL7.2
  2. CVE-2026-104801PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter9.1
  3. CVE-2026-104735RSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title>6.4
  4. CVE-2026-97305WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability—
  5. CVE-2026-102002Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget3.1
  6. CVE-2026-62073WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability7.5
  7. CVE-2026-97302WordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerability5.3
  8. CVE-2026-85198MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path6.5
  9. CVE-2026-4945Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass5.3
  10. CVE-2026-61960WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability7.1
  11. CVE-2026-66437WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability4.9
  12. CVE-2026-65563WordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerability5.9
  13. CVE-2026-15653Visualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter6.4
  14. CVE-2026-65537WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability4.3
  15. CVE-2026-65526WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability8.5

The record

Peak rank
#96 in Mar 2024
Busiest month shown
Jun 2026, 10 CVEs
Months with a KEV entry
0 since May 2023
Monthly snapshots
11 since 2023
Themeisle's full record, month by month