Extend Themes
Monthly
Unauthenticated sensitive data exposure in the SiteLeads WordPress plugin (Lead Generation Contact Widget & AI Chatbot) versions 1.2.0 and earlier allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. The vulnerability stems from improper protection of sensitive system data (CWE-497), where plugin-stored data - likely including lead contact details, API credentials, or configuration values - is accessible without authentication. No public exploit or CISA KEV listing has been identified at the time of analysis, though the CVSS score of 7.5 (High) reflects the low-effort, network-accessible nature of the attack.
Availability disruption in Kubio AI Website Builder (a WordPress page-builder plugin by Extend Themes) affects all versions before 2.9.1, exploitable by authenticated high-privilege users over a network connection. CWE-20 improper input validation allows a privileged attacker to submit malformed input to the plugin, producing a denial-of-service condition against the vulnerable system with no confidentiality or integrity impact. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects the high-privilege requirement that substantially limits the realistic attacker pool.
Cross-Site request forgery (CSRF) vulnerability in Extend Themes Skyline WP allows Cross Site Request Forgery.0.10. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting (XSS) in Extend Themes Kubio AI Page Builder through version 2.7.0 allows authenticated users to inject malicious scripts that execute in the browsers of other users viewing affected pages. An attacker with user account access can inject unescaped input during page generation, leading to session hijacking, credential theft, or malware distribution. No public exploit code has been identified at the time of analysis.
Unauthenticated sensitive data exposure in the SiteLeads WordPress plugin (Lead Generation Contact Widget & AI Chatbot) versions 1.2.0 and earlier allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. The vulnerability stems from improper protection of sensitive system data (CWE-497), where plugin-stored data - likely including lead contact details, API credentials, or configuration values - is accessible without authentication. No public exploit or CISA KEV listing has been identified at the time of analysis, though the CVSS score of 7.5 (High) reflects the low-effort, network-accessible nature of the attack.
Availability disruption in Kubio AI Website Builder (a WordPress page-builder plugin by Extend Themes) affects all versions before 2.9.1, exploitable by authenticated high-privilege users over a network connection. CWE-20 improper input validation allows a privileged attacker to submit malformed input to the plugin, producing a denial-of-service condition against the vulnerable system with no confidentiality or integrity impact. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects the high-privilege requirement that substantially limits the realistic attacker pool.
Cross-Site request forgery (CSRF) vulnerability in Extend Themes Skyline WP allows Cross Site Request Forgery.0.10. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting (XSS) in Extend Themes Kubio AI Page Builder through version 2.7.0 allows authenticated users to inject malicious scripts that execute in the browsers of other users viewing affected pages. An attacker with user account access can inject unescaped input during page generation, leading to session hijacking, credential theft, or malware distribution. No public exploit code has been identified at the time of analysis.