Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

9 records

Vendor: Ex-Themes Clear all filters
TI-2026-24968 CVE-2026-32440 · GHSA-5962-78vp-wh3j

WordPress WP Food plugin < 2.7.1 - Broken Access Control vulnerability

Priority LOW 29

Missing Authorization vulnerability in Ex-Themes WP Food wp-food allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Food: from n/a through < 2.7.1.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00187 Published 2026-03-13 No fix listed CWE-862
TI-2025-34485 CVE-2025-54722 · GHSA-qqmx-f7c6-cqmp

WordPress WooTour plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ex-Themes WooTour woo-tour allows Reflected XSS.This issue affects WooTour: from n/a through <= 3.6.3.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00235 Published 2025-11-06 No fix listed CWE-79
TI-2025-37487 CVE-2025-60121 · GHSA-9wjf-hf88-cpv7

WordPress WooEvents plugin <= 4.1.7 - Broken Access Control vulnerability

Priority LOW 30

Missing Authorization vulnerability in Ex-Themes WooEvents woo-events allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooEvents: from n/a through <= 4.1.7.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00273 Published 2025-09-26 No fix listed CWE-862
TI-2025-22310 CVE-2025-31040 · GHSA-243x-9r8g-wr3g

WordPress WP Food ordering and Restaurant Menu plugin <= 2.7 - Local File Inclusion vulnerability

Priority MEDIUM 40

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Exthemes WP Food ordering and Restaurant Menu wp-food allows PHP Local File Inclusion.This issue af…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01188 Published 2025-04-11 No fix listed CWE-98
TI-2024-31640 CVE-2024-47322 · GHSA-m9j5-2vc8-3r2c

WordPress WP Timeline plugin <= 3.6.7 - Reflected Cross Site Scripting (XSS) vulnerability

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines allows Reflected XSS.This issue affects W…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00287 Published 2024-10-06 No fix listed CWE-79
TI-2024-31642 CVE-2024-47324 · GHSA-2h27-4q3j-8qm5

WordPress WP Timeline plugin <= 3.6.7 - Local File Inclusion vulnerability

Priority LOW 35

Path Traversal: '.../...//' vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n/a through <= 3.6.…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00513 Published 2024-10-05 No fix listed CWE-35
TI-2024-31641 CVE-2024-47323 · GHSA-j77m-chgf-3hh2

WordPress WP Timeline plugin <= 3.6.7 - Local File Inclusion vulnerability

Priority LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines.This issue affects WP…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00612 Published 2024-10-05 No fix listed CWE-98
TI-2024-08044 CVE-2024-8671 · GHSA-c7r8-9m5v-mwxg

WooEvents <= 4.1.2 - Unauthenticated Arbitrary File Overwrite

Priority MEDIUM 49

The WooEvents - Calendar and Event Booking plugin for WordPress is vulnerable to arbitrary file overwrite due to insufficient file path validation in the inc/barcode.php file in all versions up to, and including, 4.1.2.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01008 Published 2024-09-24 No fix listed CWE-22