Themify - vulnerabilities (CVEs)

40 CVEs in 28 products, 0 in the last 30 days, newest from 2026-07-02.

Products

• Builder - 6 CVEs
• Woocommerce Product Filter - 6 CVEs
• Portfolio Post - 5 CVEs
• Themify Ultra - 5 CVEs
• Ultra - 5 CVEs
• Themify Shortcodes - 3 CVEs
• Post Type Builder Ptb - 2 CVEs
• Themify Edmin - 2 CVEs
• Themify Folo - 2 CVEs
• Bloggie - 1 CVEs
• Conditional Menus - 1 CVEs
• Framework - 1 CVEs
• Icons - 1 CVEs
• Photobox - 1 CVEs
• Post Type Builder Search Addon - 1 CVEs
• Product Filter - 1 CVEs
• Rezo - 1 CVEs
• Shopo - 1 CVEs
• Shortcodes - 1 CVEs
• Slide - 1 CVEs
• Store Locator - 1 CVEs
• Themify Builder - 1 CVEs
• Themify Event Post - 1 CVEs
• Themify Newsy - 1 CVEs
• Themify Popup - 1 CVEs
• Themify Portfolio Post - 1 CVEs
• Themify Sidepane Wordpress Theme - 1 CVEs
• Wigi - 1 CVEs

Newest CVEs of Themify

• CVE-2026-56037 - CVSS 8.8 (high), 2026-07-02: Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection. This issue affects Themify Popup: from n/a through 1.4.3.
• CVE-2025-31013 - CVSS 7.1 (high), 2026-06-17: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Folo allows Reflected XSS. This issue affects…
• CVE-2025-30996 - CVSS 9.9 (critical), 2026-01-06: Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo,…
• CVE-2025-31048 - CVSS 9.9 (critical), 2026-01-05: Unrestricted Upload of File with Dangerous Type vulnerability in Themify Shopo allows Upload a Web Shell to a Web Server.This issue affects Shopo: from n/a…
• CVE-2025-31047 - CVSS 8.8 (high), 2026-01-05: Deserialization of Untrusted Data vulnerability in Themify Themify Edmin allows Object Injection.This issue affects Themify Edmin: from n/a through 2.0.0.
• CVE-2024-13319 - CVSS 6.1 (medium), 2025-01-22: The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the…
• CVE-2024-56216 - CVSS 6.5 (medium), 2024-12-31: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themifyme Themify Builder…
• CVE-2024-12414 - CVSS 4.3 (medium), 2024-12-13: The Themify Store Locator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.9. This is due to missing…
• CVE-2024-52423 - CVSS 6.5 (medium), 2024-11-18: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Builder themify-builder allows Stored…
• CVE-2024-44046 - CVSS 5.9 (medium), 2024-10-06: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify – WooCommerce Product Filter…
• CVE-2024-9385 - CVSS 6.1 (medium), 2024-10-05: The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the…
• CVE-2024-7836 - CVSS 4.3 (medium), 2024-08-22: The Themify Builder plugin for WordPress is vulnerable to unauthorized post duplication due to missing checks on the duplicate_page_ajaxify function in all…
• CVE-2024-43133 - CVSS 6.5 (medium), 2024-08-12: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themify Themify Shortcodes allows Stored XSS.This…
• CVE-2024-6027 - CVSS 9.8 (critical), 2024-06-21: The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to time-based SQL Injection via the ‘conditions’ parameter in all versions up to,…
• CVE-2023-46148 - CVSS 8.8 (high), 2024-06-19: Missing Authorization vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.
• CVE-2023-46146 - CVSS 8.8 (high), 2024-06-19: Missing Authorization vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.
• CVE-2024-3032 - CVSS 6.1 (medium), 2024-06-13: Themify Builder WordPress plugin before 7.5.8 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue
• CVE-2023-46145 - CVSS 8.8 (high), 2024-05-17: Improper Privilege Management vulnerability in Themify Themify Ultra allows Privilege Escalation.This issue affects Themify Ultra: from n/a through 7.3.5.
• CVE-2024-4567 - CVSS 6.4 (medium), 2024-05-14: The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themify_button shortcode in all versions up to, and…
• CVE-2024-31366 - CVSS 7.1 (high), 2024-04-09: Missing Authorization vulnerability in Themify Post Type Builder (PTB).This issue affects Post Type Builder (PTB): from n/a through 2.0.8.
• CVE-2024-31365 - CVSS 7.1 (high), 2024-04-09: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Post Type Builder (PTB) allows Reflected…
• CVE-2024-2278 - CVSS 6.1 (medium), 2024-04-01: Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to…
• CVE-2024-2263 - CVSS 4.8 (medium), 2024-04-01: Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site…
• CVE-2024-2262 - CVSS 4.7 (medium), 2024-04-01: Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary…
• CVE-2024-30440 - CVSS 5.9 (medium), 2024-03-29: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Themify Event Post allows Stored XSS.This issue…
• CVE-2024-2732 - CVSS 5.4 (medium), 2024-03-26: The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'themify_post_slider shortcode in all versions up…
• CVE-2024-24872 - CVSS 8.8 (high), 2024-02-21: Cross-Site Request Forgery (CSRF) vulnerability in Themify Themify Builder.This issue affects Themify Builder: from n/a through 7.0.5.
• CVE-2023-51693 - CVSS 6.5 (medium), 2024-02-01: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Icons allows Stored XSS.This issue affects…
• CVE-2023-46149 - CVSS 9.9 (critical), 2023-12-20: Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.
• CVE-2023-46147 - CVSS 8.8 (high), 2023-12-20: Deserialization of Untrusted Data vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.