Themify vulnerabilities and threats

10 threats

Severity	CVSS	Signals	Threat	Source	Published
High	8.8	EPSS 0.5%	CVE-2026-56037Themify Popup (WordPress plugin) · Deserialization of Untrusted Data High8.8EPSS 0.5%2026-07-02CVE Database V5CVE-2026-56037 Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection. This issue affects Themify Popup: from n/a through 1.4.3. EPSS 0.5%Vulnerability CWE-502	CVE Database V5	2026-07-02
High	7.1	EPSS 0.1%	CVE-2025-31013Themify Folo (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.1%2026-06-17CVE Database V5CVE-2025-31013 CVE-2025-31013 is a high-severity reflected Cross-site Scripting (XSS) vulnerability in Themify Folo affecting versions up to and including 1.9.6. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that can execute in the context of the victim's browser. This can lead to partial confidentiality, integrity, and availability impacts. No official patch or remediation guidance is currently available from the vendor. EPSS 0.1%Vulnerability CWE-79	CVE Database V5	2026-06-17
Critical	9.9	EPSS 0.5%	CVE-2025-30996Themify Sidepane WordPress Theme · Unrestricted File Upload Critical9.9EPSS 0.5%2026-01-06CVE Database V5CVE-2025-30996 Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themify Bloggie, Themify Photobox, Themify Wigi, Themify Rezo, Themify Slide allows Upload a Web Shell to a Web Server.This issue affects Themify Sidepane WordPress Theme: from n/a through 1.9.8; Themify Newsy: from n/a through 1.9.9; Themify Folo: from n/a through 1.9.6; Themify Edmin: from n/a through 2.0.0; Bloggie: from n/a through 2.0.8; Photobox: from n/a through 2.0.1; Wigi: from n/a through 2.0.1; Rezo: from n/a through 1.9.7; Slide: from n/a through 1.7.5. EPSS 0.5%Vulnerability CWE-434	CVE Database V5	2026-01-06
Critical	9.9	EPSS 0.3%	CVE-2025-31048Shopo (WordPress plugin) · Unrestricted File Upload Critical9.9EPSS 0.3%2026-01-05CVE Database V5CVE-2025-31048 Unrestricted Upload of File with Dangerous Type vulnerability in Themify Shopo allows Upload a Web Shell to a Web Server.This issue affects Shopo: from n/a through 1.1.4. EPSS 0.3%Vulnerability Themify CWE-434	CVE Database V5	2026-01-05
High	8.8	EPSS 0.4%	CVE-2025-31047Themify Edmin (WordPress plugin) · Deserialization of Untrusted Data High8.8EPSS 0.4%2026-01-05CVE Database V5CVE-2025-31047 Deserialization of Untrusted Data vulnerability in Themify Themify Edmin allows Object Injection.This issue affects Themify Edmin: from n/a through 2.0.0. EPSS 0.4%Vulnerability CWE-502	CVE Database V5	2026-01-05
Medium	6.5	EPSS 0.3%	CVE-2024-43133Themify Shortcodes (WordPress plugin) · XSS or 'Cross-site Scripting' Medium6.5EPSS 0.3%2024-08-12CVE Database V5CVE-2024-43133 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themify Themify Shortcodes allows Stored XSS.This issue affects Themify Shortcodes: from n/a through 2.1.1. EPSS 0.3%Vulnerability CWE-79	CVE Database V5	2024-08-12
High	7.1	EPSS 0.5%	CVE-2024-31366Post Type Builder (PTB) (WordPress plugin) · Missing Authorization High7.1EPSS 0.5%2024-04-09CVE Database V5CVE-2024-31366 Missing Authorization vulnerability in Themify Post Type Builder (PTB).This issue affects Post Type Builder (PTB): from n/a through 2.0.8. EPSS 0.5%Vulnerability Themify CWE-862	CVE Database V5	2024-04-09
High	7.1	EPSS 0.4%	CVE-2024-31365Post Type Builder (PTB) (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.4%2024-04-09CVE Database V5CVE-2024-31365 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Post Type Builder (PTB) allows Reflected XSS.This issue affects Post Type Builder (PTB): from n/a before 2.1.1. EPSS 0.4%Vulnerability Themify CWE-79	CVE Database V5	2024-04-09
Medium	5.9	EPSS 0.4%	CVE-2024-30440Themify Event Post (WordPress plugin) · Cross-site Scripting Medium5.9EPSS 0.4%2024-03-29CVE Database V5CVE-2024-30440 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Themify Event Post allows Stored XSS.This issue affects Themify Event Post: from n/a through 1.2.7. EPSS 0.4%Vulnerability CWE-79	CVE Database V5	2024-03-29
Medium	4.3	EPSS 0.2%	CVE-2024-24872Themify Builder (WordPress plugin) · Cross-Site Request Forgery (CSRF) Medium4.3EPSS 0.2%2024-02-21CVE Database V5CVE-2024-24872 Cross-Site Request Forgery (CSRF) vulnerability in Themify Themify Builder.This issue affects Themify Builder: from n/a through 7.0.5. EPSS 0.2%Vulnerability CWE-352	CVE Database V5	2024-02-21

Page 1 of 1