Apollo13Themes vulnerabilities

Products

• Apollo13 Framework Extensions 6
• Rife Elementor Extensions & Templates 3
• Rife Extensions & Templates for Elementor 2
• Rife Free 2

Latest Apollo13Themes CVEs

Newest publication first

1. CVE-2025-13617 Apollo13 Framework Extension <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via `a13_alt_link` Parameter

   Published 2026-02-19

   Medium·CVSS 6.4 EPSS 0.35%

   The Apollo13 Framework Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘a13_alt_link’ parameter in all versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated at...

2. CVE-2024-13564 Rife Elementor Extensions & Templates <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Shortcode

   Published 2025-02-22

   Medium·CVSS 5.4 EPSS 0.30%

   The Rife Elementor Extensions & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Writing Effect Headline shortcode in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping on user supplied a...

3. CVE-2024-37491 WordPress Rife Free theme <= 2.4.18 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2025-01-02

   Medium·CVSS 4.3 EPSS 0.20%

   Cross-Site Request Forgery (CSRF) vulnerability in apollo13themes Rife Free rife-free allows Cross Site Request Forgery.This issue affects Rife Free: from n/a through <= 2.4.18.

4. CVE-2023-25959 WordPress Apollo13 Framework Extensions plugin <= 1.8.10 - Broken Access Control

   Published 2024-12-09

   Medium·CVSS 5.4 EPSS 0.59%

   Missing Authorization vulnerability in Apollo13Themes Apollo13 Framework Extensions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apollo13 Framework Extensions: from n/a through 1.8.10.

5. CVE-2023-27454 WordPress Rife Elementor Extensions & Templates plugin <= 1.1.10 - Broken Access Control vulnerability

   Published 2024-12-09

   Medium·CVSS 5.4 EPSS 0.48%

   Missing Authorization vulnerability in Apollo13Themes Rife Elementor Extensions & Templates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rife Elementor Extensions & Templates: from n/a through 1.1.10.

6. CVE-2024-37480 WordPress Apollo13 Framework Extensions plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerability

   Published 2024-07-21

   Medium·CVSS 5.4 EPSS 0.31%

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Apollo13Themes Apollo13 Framework Extensions apollo13-framework-extensions allows Stored XSS.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.3.

7. CVE-2024-5504 Rife Elementor Extensions & Templates <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Widget

   Published 2024-07-02

   Medium·CVSS 5.4 EPSS 0.35%

   The Rife Elementor Extensions & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute within the plugin's Writing Effect Headline widget in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output esc...

8. CVE-2024-35708 WordPress Rife Free theme <= 2.4.19 - Cross Site Scripting (XSS) vulnerability

   Published 2024-06-08

   Medium·CVSS 5.4 EPSS 0.26%

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in apollo13themes Rife Free allows Stored XSS.This issue affects Rife Free: from n/a through 2.4.19.

9. CVE-2024-24880 WordPress Apollo13 Framework Extensions Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS)

   Published 2024-02-08

   Medium·CVSS 5.4 EPSS 0.32%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apollo13Themes Apollo13 Framework Extensions allows Stored XSS.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.2.

10. CVE-2023-51539 WordPress Apollo13 Framework Extensions Plugin <= 1.9.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Published 2024-01-05

    High·CVSS 8.8 EPSS 0.22%

    Cross-Site Request Forgery (CSRF) vulnerability in Apollo13Themes Apollo13 Framework Extensions.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.1.

11. CVE-2023-47190 WordPress Apollo13 Framework Extensions Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS)

    Published 2023-11-08

    Medium·CVSS 5.4 EPSS 0.47%

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Apollo13Themes Apollo13 Framework Extensions plugin <= 1.9.0 versions.

12. CVE-2021-24265 Rife Elementor Extensions & Templates < 1.1.6 - Contributor+ Stored XSS

    Published 2021-05-05

    Medium·CVSS 5.4 EPSS 0.56%

    The “Rife Elementor Extensions & Templates” WordPress Plugin before 1.1.6 has a widget that is vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.