Xylus Themes

Records12All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high4CVSS 7.0–8.9

Exploited now

Xylus Themes records in CISA KEV

No Xylus Themes vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Wp Smart Import 5 records MEDIUM Wp Event Aggregator 3 records LOW Wp Bulk Delete 2 records LOW Import Social Events 1 record LOW Xt Event Widget For Social Events 1 record MEDIUM

Records

12 records

TI-2025-29950 CVE-2025-47453 · GHSA-qw6m-wwcp-hjpw

WordPress WP Smart Import plugin <= 1.1.3 - Local File Inclusion Vulnerability

MEDIUM 44

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Xylus Themes WP Smart Import wp-smart-import allows PHP Local File Inclusion.This issue affects WP…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00737 Published 2025-05-23 No fix listed CWE-98

TI-2020-14817 CVE-2020-24147 · GHSA-96g2-x6h6-v7h9

Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import)…

MEDIUM 42

Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01612 Published 2021-07-07 No fix listed CWE-918

TI-2025-30028 CVE-2025-47531 · GHSA-jxrv-m7f3-wm3w

WordPress XT Event Widget for Social Events plugin <= 1.1.7 - Local File Inclusion Vulnerability

MEDIUM 41

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Xylus Themes XT Event Widget for Social Events xt-facebook-events allows PHP Local File Inclusion.T…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00701 Published 2025-05-07 No fix listed CWE-98

TI-2025-18417 CVE-2025-24700 · GHSA-rx5c-wxq4-wp76

WordPress WP Event Aggregator Plugin <= 1.8.2 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator wp-event-aggregator allows Reflected XSS.This issue affects WP Event Aggregator: from…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00255 Published 2025-02-14 No fix listed CWE-79

TI-2024-31670 CVE-2024-47352 · GHSA-3j6w-wcmf-ph6c

WordPress WP Bulk Delete plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Bulk Delete wp-bulk-delete allows Stored XSS.This issue affects WP Bulk Delete: from n/a through <= 1.…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00287 Published 2024-10-06 No fix listed CWE-79

TI-2024-19947 CVE-2024-30201 · GHSA-5486-77xm-7wvf

WordPress WP Smart Import plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WordPress Importer allows Reflected XSS.This issue affects WordPress Importer: from n/a through 1.0.4.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00397 Published 2024-03-27 No fix listed CWE-79

TI-2025-30582 CVE-2025-48256 · GHSA-m3r9-g8hh-v79g

WordPress Import Social Events plugin <= 1.8.5 - Cross Site Scripting (XSS) Vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes Import Social Events import-facebook-events allows Stored XSS.This issue affects Import Social Events: fr…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00271 Published 2025-05-19 No fix listed CWE-79

TI-2024-25937 CVE-2024-38703 · GHSA-3c73-87fp-87pp

WordPress WP Event Aggregator plugin <= 1.7.9 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator allows Stored XSS.This issue affects WP Event Aggregator: from n/a through 1.7…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00269 Published 2024-07-20 No fix listed CWE-79

TI-2022-19075 CVE-2022-40209 · GHSA-p5w8-5f33-gggw

WP Smart Import plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)

LOW 28

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xylus Themes WP Smart Import plugin <= 1.0.2 on WordPress.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00433 Published 2022-12-06 No fix listed CWE-79

TI-2024-21484 CVE-2024-32597 · GHSA-v4hx-5qgp-299x

WordPress WP Smart Import plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WordPress Importer allows Stored XSS.This issue affects WordPress Importer: from n/a through 1.0.7.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00314 Published 2024-04-18 No fix listed CWE-79

TI-2025-35997 CVE-2025-58192 · GHSA-78g5-fq4q-8f3p

WordPress WP Bulk Delete Plugin <= 1.3.6 - Broken Access Control Vulnerability

LOW 24

Missing Authorization vulnerability in Xylus Themes WP Bulk Delete wp-bulk-delete allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Bulk Delete: from n/a through <= 1.3.6.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00179 Published 2025-08-27 No fix listed CWE-862

TI-2024-20743 CVE-2024-31371 · GHSA-6pwm-9g9r-9xr7

WordPress WP Event Aggregator plugin <= 1.7.6 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in Xylus Themes WP Event Aggregator.This issue affects WP Event Aggregator: from n/a through 1.7.6.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.002 Published 2024-04-12 No fix listed CWE-352

Open these records in search →

Critical	2
High	4
Medium	6
Low	0
No CVSS	0