TI-2024-00968 Aliases CVE-2024-1047 GHSA-f527-jggh-c37w

ThemeIsle SDK <= Various Versions - Missing Authorization

LOW 31CWE-862Published 2024-02-02 · Updated 2026-04-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00555 46th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
themeisle	Menu Icons by ThemeIsle	up to 0.13.8	—	No fix listed	CNA
themeisle	Starter Sites & Templates by Neve	up to 1.2.6	—	No fix listed	CNA
themeisle	Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE	up to 2.6.2	—	No fix listed	CNA
themeisle	LightStart – Maintenance Mode, Coming Soon and Landing Page Builder	up to 2.6.9	—	No fix listed	CNA
themeisle	Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More	up to 2.10.28	—	No fix listed	CNA
themeisle	Multiple Page Generator Plugin – MPG	up to 3.4.0	—	No fix listed	CNA
themeisle	Visualizer: Tables and Charts Manager for WordPress	up to 3.10.6	—	No fix listed	CNA
optimole	Optimole – Optimize Images in Real Time	up to 3.12.4	—	No fix listed	CNA
themeisle	RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator	up to 4.4.1	—	No fix listed	CNA
optimole	Super Page Cache	up to 4.7.5	—	No fix listed	CNA
rsocial	Revive Social – Social Media Auto Post and Scheduling Automation Plugin	up to 9.0.25	—	No fix listed	CNA
themeisle	PPOM – Product Addons & Custom Fields for WooCommerce	up to 32.0.9	—	No fix listed	CNA

Menu Icons by ThemeIsle Vendorthemeisle Affected up to 0.13.8 Fixed in — No fix listed CNA
Starter Sites & Templates by Neve Vendorthemeisle Affected up to 1.2.6 Fixed in — No fix listed CNA
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Vendorthemeisle Affected up to 2.6.2 Fixed in — No fix listed CNA
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder Vendorthemeisle Affected up to 2.6.9 Fixed in — No fix listed CNA
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More Vendorthemeisle Affected up to 2.10.28 Fixed in — No fix listed CNA
Multiple Page Generator Plugin – MPG Vendorthemeisle Affected up to 3.4.0 Fixed in — No fix listed CNA
Visualizer: Tables and Charts Manager for WordPress Vendorthemeisle Affected up to 3.10.6 Fixed in — No fix listed CNA
Optimole – Optimize Images in Real Time Vendoroptimole Affected up to 3.12.4 Fixed in — No fix listed CNA
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Vendorthemeisle Affected up to 4.4.1 Fixed in — No fix listed CNA
Super Page Cache Vendoroptimole Affected up to 4.7.5 Fixed in — No fix listed CNA
Revive Social – Social Media Auto Post and Scheduling Automation Plugin Vendorrsocial Affected up to 9.0.25 Fixed in — No fix listed CNA
PPOM – Product Addons & Custom Fields for WooCommerce Vendorthemeisle Affected up to 32.0.9 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:themeisle:orbit_fox::::::wordpress::*	up to 2.10.28	Vulnerable	themeisle

cpe:2.3:a:themeisle:orbit_fox:*:*:*:*:*:wordpress:*:* Versions up to 2.10.28 Vulnerable ·themeisle

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-1047
2026-10-03 Alias added: GHSA-f527-jggh-c37w

References

Patch 2

Advisory 1

https://www.wordfence.com/threat-intel/vulnerabilities/id/6147582f-578a-47ad-b16c-65c37896783d?source=cve

Other 1

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040302%40templates-patterns-collection&new=3040302%40templates-patterns-collection&sfp_email=&sfph_mail=

TI-2021-06450 Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege Escalation CVSS 3.1MEDIUM 6.5
TI-2025-16542 WordPress Orbit Fox by ThemeIsle plugin <= 2.10.44 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
TI-2024-12229 Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter CVSS 3.1MEDIUM 6.4
TI-2024-02310 Cross-site scripting in themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Support… CVSS 3.1MEDIUM 6.4
TI-2024-01976 Cross-site scripting in themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Support… CVSS 3.1MEDIUM 6.4
TI-2024-01400 Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 3.1MEDIUM 6.4

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences