Themepul vulnerabilities and threats

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	4.3	EPSS 0.1%	CVE-2026-1073Purchase Button For Affiliate Link (WordPress plugin) · Cross-Site Request Forgery (CSRF) Medium4.3EPSS 0.1%2026-03-07CVE Database V5CVE-2026-1073 The Purchase Button For Affiliate Link plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing nonce validation on the settings page form handler in `inc/purchase-btn-options-page.php`. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. EPSS 0.1%Vulnerability themepul CWE-352	CVE Database V5	2026-03-07
High	7.5	EPSS 0.4%	CVE-2025-68841TopperPack (WordPress theme) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High7.5EPSS 0.4%2026-02-20CVE Database V5CVE-2025-68841 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themepul TopperPack – Complete Elementor Addons, Theme & CPT Builder topper-pack allows PHP Local File Inclusion.This issue affects TopperPack – Complete Elementor Addons, Theme & CPT Builder: from n/a through <= 1.2.1. EPSS 0.4%Vulnerability Themepul	CVE Database V5	2026-02-20

Page 1 of 1