Extendthemes
Monthly
Stored cross-site scripting (XSS) in the Colibri Page Builder WordPress plugin versions up to and including 1.0.390 allows unauthenticated attackers to inject arbitrary web scripts via the comment parameter; the payload is stored and executes when any user views the injected page. The vulnerability has a CVSS v3.1 score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and no public exploit has been identified at time of analysis. While the score is elevated due to scope change and low confidentiality/integrity impact, the practical risk is notable but the raw score overstates the absolute danger; sites with comments disabled are not exposed.
Unauthenticated stored cross-site scripting (XSS) in Kubio AI Page Builder up to and including version 2.9.2 allows remote attackers to inject arbitrary web scripts via the 'comment' parameter, which execute when a victim visits an injected page. The vulnerability has a CVSS score of 7.2 and a scope change, but no public exploit code has been identified and there is no evidence of active exploitation. A vendor patch version is not confirmed, though an upstream code change exists.
Subscriber-level users on WordPress sites running Image Hub 1.2.0 and earlier can extract six third-party image-service API credentials from admin-page HTML and then use an exposed AJAX nonce to overwrite those stored credentials. The plugin emits Giphy, Openverse, Pexels, Pixabay, and Unsplash key options via wp_localize_script, and the image_hub_update_settings AJAX handler lacks a capability check, allowing the same low-privilege attacker to modify settings through update_option(). No public exploit identified at time of analysis; the assessed risk is a moderate, patch-priority information-disclosure and integrity issue rather than an emergency.
Stored cross-site scripting in the Kubio AI Page Builder plugin for WordPress (all versions up to and including 2.8.4) lets authenticated users with contributor-level access or higher embed HTML-entity-encoded script markup inside the kubio/copyright block, which the plugin subsequently decodes back into live HTML and renders to anyone who views the page. Because the payload survives both the WordPress core kses-on-save filter and the plugin's own wp_kses_post() call, the injected script executes in the browser of an admin, editor, or visitor who loads the affected content; the attacker needs no further interaction after saving the post. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) consistent with an authenticated-authoring prerequisite and cross-user impact; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Authorization bypass in Kubio AI Page Builder (WordPress plugin, all versions ≤2.8.5) enables any authenticated Contributor to overwrite front-page configuration options, rewrite primary navigation menus, replace template parts, and overwrite the plugin's global-data post. The plugin emits the AJAX nonce unconditionally into the JavaScript global window.kubioUtilsData for every user who can load the block editor - including Contributors - making the check_ajax_referer() call a non-functional authorization barrier. No public exploit identified at time of analysis, but the exploitation mechanism is fully documented in the Wordfence advisory and the vulnerable code paths are publicly visible in the WordPress plugin Trac repository.
Kubio page builder plugin for WordPress allows authenticated attackers with Contributor-level access to upload arbitrary files from external URLs by bypassing capability checks in the REST API post creation handler. The kubio_rest_pre_insert_import_assets() function automatically imports remote files referenced in block attributes without verifying the user possesses the upload_files capability, violating WordPress's normal media upload restrictions. Affected versions are up to and including 2.7.2; no public exploit code has been identified at the time of analysis.
Missing authorization in the Vireo WordPress theme (versions up to 1.0.24) enables authenticated attackers with low privileges to bypass access controls and execute high-impact operations including data exfiltration, integrity compromise, and availability disruption. The vulnerability affects a specific WordPress theme product from extendthemes with CVSS 8.8 severity. While EPSS probability is low (0.04%, 13th percentile), the low attack complexity and network attack vector warrant attention for sites using this theme. No public exploit identified at time of analysis, and not listed in CISA KEV.
Stored cross-site scripting vulnerability in the Colibri Page Builder WordPress plugin allows authenticated editors or administrators to inject malicious scripts into pages. When other users view the affected page, the script executes, potentially leading to limited data theft, defacement, or session hijacking. Exploitation requires high privileges and user interaction; no active exploitation or public exploit code is known, and EPSS predicts a very low exploitation probability (0.02%).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder allows Stored XSS.0.319. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Materialis theme for WordPress is vulnerable to limited arbitrary options updates in versions up to, and including, 1.1.24. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_video_player shortcode in all versions up to, and including, 1.0.276 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.0.276 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Materialis Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's materialis_contact_form shortcode in all versions up to, and including, 1.3.41 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes EmpowerWP.0.21. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri-gallery-slideshow' shortcode in all versions up to, and including, 1.0.272 due to. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt data parameter in all versions up to, and including, 1.0.262 due to insufficient input. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_breadcrumb_element' shortcode in all versions up to, and including, 1.0.272 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Teluro.0.31. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_post_title' shortcode in all versions up to, and including, 1.0.263 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Missing Authorization vulnerability in ExtendThemes Colibri Page Builder.0.248. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Calliope.0.33. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Colibri Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callActivateLicenseEndpoint function in all versions up to,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's extend_builder_render_js shortcode in all versions up to, and including, 1.0.239 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExtendThemes Colibri Page Builder allows Stored XSS.0.239. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Colibri Page Builder for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 1.0.227 due to insufficient escaping on the user supplied parameter. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172 (Materialis). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Stored cross-site scripting (XSS) in the Colibri Page Builder WordPress plugin versions up to and including 1.0.390 allows unauthenticated attackers to inject arbitrary web scripts via the comment parameter; the payload is stored and executes when any user views the injected page. The vulnerability has a CVSS v3.1 score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and no public exploit has been identified at time of analysis. While the score is elevated due to scope change and low confidentiality/integrity impact, the practical risk is notable but the raw score overstates the absolute danger; sites with comments disabled are not exposed.
Unauthenticated stored cross-site scripting (XSS) in Kubio AI Page Builder up to and including version 2.9.2 allows remote attackers to inject arbitrary web scripts via the 'comment' parameter, which execute when a victim visits an injected page. The vulnerability has a CVSS score of 7.2 and a scope change, but no public exploit code has been identified and there is no evidence of active exploitation. A vendor patch version is not confirmed, though an upstream code change exists.
Subscriber-level users on WordPress sites running Image Hub 1.2.0 and earlier can extract six third-party image-service API credentials from admin-page HTML and then use an exposed AJAX nonce to overwrite those stored credentials. The plugin emits Giphy, Openverse, Pexels, Pixabay, and Unsplash key options via wp_localize_script, and the image_hub_update_settings AJAX handler lacks a capability check, allowing the same low-privilege attacker to modify settings through update_option(). No public exploit identified at time of analysis; the assessed risk is a moderate, patch-priority information-disclosure and integrity issue rather than an emergency.
Stored cross-site scripting in the Kubio AI Page Builder plugin for WordPress (all versions up to and including 2.8.4) lets authenticated users with contributor-level access or higher embed HTML-entity-encoded script markup inside the kubio/copyright block, which the plugin subsequently decodes back into live HTML and renders to anyone who views the page. Because the payload survives both the WordPress core kses-on-save filter and the plugin's own wp_kses_post() call, the injected script executes in the browser of an admin, editor, or visitor who loads the affected content; the attacker needs no further interaction after saving the post. Rated CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) consistent with an authenticated-authoring prerequisite and cross-user impact; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Authorization bypass in Kubio AI Page Builder (WordPress plugin, all versions ≤2.8.5) enables any authenticated Contributor to overwrite front-page configuration options, rewrite primary navigation menus, replace template parts, and overwrite the plugin's global-data post. The plugin emits the AJAX nonce unconditionally into the JavaScript global window.kubioUtilsData for every user who can load the block editor - including Contributors - making the check_ajax_referer() call a non-functional authorization barrier. No public exploit identified at time of analysis, but the exploitation mechanism is fully documented in the Wordfence advisory and the vulnerable code paths are publicly visible in the WordPress plugin Trac repository.
Kubio page builder plugin for WordPress allows authenticated attackers with Contributor-level access to upload arbitrary files from external URLs by bypassing capability checks in the REST API post creation handler. The kubio_rest_pre_insert_import_assets() function automatically imports remote files referenced in block attributes without verifying the user possesses the upload_files capability, violating WordPress's normal media upload restrictions. Affected versions are up to and including 2.7.2; no public exploit code has been identified at the time of analysis.
Missing authorization in the Vireo WordPress theme (versions up to 1.0.24) enables authenticated attackers with low privileges to bypass access controls and execute high-impact operations including data exfiltration, integrity compromise, and availability disruption. The vulnerability affects a specific WordPress theme product from extendthemes with CVSS 8.8 severity. While EPSS probability is low (0.04%, 13th percentile), the low attack complexity and network attack vector warrant attention for sites using this theme. No public exploit identified at time of analysis, and not listed in CISA KEV.
Stored cross-site scripting vulnerability in the Colibri Page Builder WordPress plugin allows authenticated editors or administrators to inject malicious scripts into pages. When other users view the affected page, the script executes, potentially leading to limited data theft, defacement, or session hijacking. Exploitation requires high privileges and user interaction; no active exploitation or public exploit code is known, and EPSS predicts a very low exploitation probability (0.02%).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder allows Stored XSS.0.319. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Materialis theme for WordPress is vulnerable to limited arbitrary options updates in versions up to, and including, 1.1.24. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_video_player shortcode in all versions up to, and including, 1.0.276 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.0.276 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Materialis Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's materialis_contact_form shortcode in all versions up to, and including, 1.3.41 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes EmpowerWP.0.21. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri-gallery-slideshow' shortcode in all versions up to, and including, 1.0.272 due to. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt data parameter in all versions up to, and including, 1.0.262 due to insufficient input. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_breadcrumb_element' shortcode in all versions up to, and including, 1.0.272 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Teluro.0.31. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_post_title' shortcode in all versions up to, and including, 1.0.263 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Missing Authorization vulnerability in ExtendThemes Colibri Page Builder.0.248. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Calliope.0.33. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Colibri Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the callActivateLicenseEndpoint function in all versions up to,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's extend_builder_render_js shortcode in all versions up to, and including, 1.0.239 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExtendThemes Colibri Page Builder allows Stored XSS.0.239. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Colibri Page Builder for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 1.0.227 due to insufficient escaping on the user supplied parameter. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172 (Materialis). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.