Vulnerabilities

TI-2026-20538 CVE-2026-25422 · GHSA-849j-jr65-wp89

WordPress Popularis Extra plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) vulnerability

LOW 23

Cross-Site Request Forgery (CSRF) vulnerability in Themes4WP Popularis Extra popularis-extra allows Cross Site Request Forgery.This issue affects Popularis Extra: from n/a through <= 1.2.10.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00124 Published 2026-02-19 No fix listed CWE-352

TI-2025-19738 CVE-2025-26867 · GHSA-3hhf-g967-wcf6

WordPress Bulk theme <= 1.0.11 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in Themes4WP Bulk allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bulk: from n/a through 1.0.11.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00274 Published 2025-05-19 No fix listed CWE-862

TI-2024-25997 CVE-2024-38763 · GHSA-wqm4-fxvj-mgpg

WordPress Popularis Verse theme <= 1.1.1 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in themes4wp Popularis Verse popularis-verse allows Cross Site Request Forgery.This issue affects Popularis Verse: from n/a through <= 1.1.1.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.002 Published 2025-01-02 No fix listed CWE-352

TI-2024-10007 CVE-2024-10795 · GHSA-cwwg-j94x-j72r

Popularis Extra <= 1.2.7 - Authenticated (Contributor+) Post Disclosure

LOW 20

The Popularis Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.7 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be inc…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00327 Published 2024-11-16 No fix listed CWE-639

TI-2024-33902 CVE-2024-50470 · GHSA-f4xx-fhcp-433m

WordPress Themes4WP YouTube External Subtitles plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themes4WP Themes4WP YouTube External Subtitles themes4wp-youtube-external-subtitles allows DOM-Based XSS.This issue af…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0027 Published 2024-10-28 No fix listed CWE-79

TI-2024-08677 CVE-2024-9353 · GHSA-2v79-c5jv-4gpr

Popularis Extra <= 1.2.6 - Reflected Cross-Site Scripting

LOW 27

The Popularis Extra plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00386 Published 2024-10-04 No fix listed CWE-79