Macho Themes

Records12All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Macho Themes records in CISA KEV

No Macho Themes vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Image Photo Gallery Final Tiles Grid 3 records LOW Newsmag 3 records CRITICAL Regina Lite 3 records CRITICAL Antreas 2 records CRITICAL Cpo Companion 2 records LOW Medzone Lite 2 records CRITICAL Naturemag Lite 2 records CRITICAL Strong Testimonials 1 record MEDIUM

Records

12 records

TI-2020-18879 CVE-2020-36708 · GHSA-48h4-c5mw-4h8j

Epsilon Framework Themes (Various Versions) - Function Injection

CRITICAL 85

The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, P…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.65342 Published 2023-06-07 No fix listed CWE-94

TI-2022-04313 CVE-2022-4717 · GHSA-fx7p-rq94-q4g9

Strong Testimonials < 3.0.3 - Contributor+ Stored XSS via Shortcode

MEDIUM 58

The Strong Testimonials WordPress plugin before 3.0.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to pe…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00649 Published 2023-02-06 Fixed in 3.0.3

TI-2020-18892 CVE-2020-36721 · GHSA-x6fw-c968-rf52

Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation

LOW 37

The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00971 Published 2023-06-07 No fix listed CWE-284

TI-2024-22386 CVE-2024-33916 · GHSA-phvc-fww6-r633

WordPress CPO Companion plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability

LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MachoThemes CPO Companion allows Stored XSS.This issue affects CPO Companion: from n/a through 1.1.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00312 Published 2024-05-03 No fix listed CWE-79

TI-2023-13033 CVE-2023-28493 · GHSA-x477-fx3j-mgrj

WordPress Newsmag Theme <= 2.4.4 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes NewsMag theme <= 2.4.4 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0037 Published 2023-05-08 No fix listed CWE-79

TI-2024-05808 CVE-2024-6261 · GHSA-69wq-fhcw-rx47

Image Photo Gallery Final Tiles Grid <= 3.6.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

LOW 28

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'FinalTilesGallery' shortcode in all versions up to, and including, 3.6.0 due to insufficient in…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00292 Published 2025-02-27 No fix listed CWE-79

TI-2023-00156 CVE-2023-0162 · GHSA-25p3-r4j6-7wqc

CPO Companion <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

LOW 26

The CPO Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its content type settings parameters in versions up to, and including, 1.0.4 due to insufficient input sanitization and o…

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00561 Published 2023-01-10 No fix listed CWE-79

TI-2020-11767 CVE-2020-14962 · GHSA-mrhx-67q5-9qc4

Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for…

LOW 26

Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title (aka imageTitle) or Caption (aka description) field o…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00892 Published 2020-06-21 No fix listed CWE-79

TI-2022-04433 CVE-2022-4837 · GHSA-37v2-887x-rc5j

CPO Companion < 1.1.0 - Contributor+ Stored XSS via Shortcode

LOW 25

The CPO Companion WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00534 Published 2023-01-30 Fixed in 1.1.0 CWE-79

TI-2022-00126 CVE-2022-0186 · GHSA-4gvq-h6xw-fx34

Image Photo Gallery Final Tiles Grid < 3.5.3 - Contributor+ Stored Cross-Site Scripting

LOW 25

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scr…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00604 Published 2022-02-21 Fixed in 3.5.3 CWE-79

TI-2023-12329 CVE-2023-27619 · GHSA-jv64-r55r-6x87

WordPress Regina Lite Theme <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)

LOW 24

Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes Regina Lite theme <= 2.0.7 versions.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00361 Published 2023-04-25 No fix listed CWE-79

TI-2024-20758 CVE-2024-31386 · GHSA-cjgc-85v4-mwgc

Multiple WordPress themes affected by Cross-Site Request Forgery vulnerability

LOW 20

Cross-Site Request Forgery (CSRF) vulnerability in Hidekazu Ishikawa X-T9, Hidekazu Ishikawa Lightning, themeinwp Default Mag, Out the Box Namaha, Out the Box CityLogic, Marsian i-max, Jetmonsters Emmet Lite, Macho Theme…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00368 Published 2024-04-10 No fix listed CWE-352

Open these records in search →