catchthemes vulnerabilities

Products

• Essential Widgets 3
• Catch Dark Mode 2
• Catch Base 1
• Catch Breadcrumb 1
• Catch Duplicate Switcher 1
• Catch Gallery 1
• Catch IDs 1
• Catch Import Export 1
• Catch Infinite Scroll 1
• Catch Scroll Progress Bar 1
• Catch Sticky Menu 1
• Catch Themes Demo Import 1
• Catch Under Construction 1
• Catch Web Tools 1
• Create 1
• darcie 1
• Essential Content Types 1
• Full frame 1
• Generate Child Theme 1
• Header Enhancement 1
• Social Gallery and Widget 1
• To Top 1

Latest catchthemes CVEs

Newest publication first

1. CVE-2026-0867 Essential Widgets <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes

   Published 2026-02-05

   Medium·CVSS 6.4 EPSS 0.31%

   The Essential Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ew-author, ew-archive, ew-category, ew-page, and ew-menu shortcodes in all versions up to, and including, 3.0 due to insufficient input sanitization and output escaping on use...

2. CVE-2025-67543 WordPress Essential Widgets plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

   Published 2025-12-09

   Medium·CVSS 6.5 EPSS 0.21%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Catch Themes Essential Widgets essential-widgets allows Stored XSS.This issue affects Essential Widgets: from n/a through <= 2.2.2.

3. CVE-2025-10143 Catch Dark Mode <= 2.0 - Authenticated (Contributor+) Local File Inclusion

   Published 2025-09-17

   High·CVSS 7.5 EPSS 1.0%

   The Catch Dark Mode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0 via the 'catch_dark_mode' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitr...

4. CVE-2025-32154 WordPress Catch Dark Mode plugin <= 2.0.1 - Local File Inclusion vulnerability

   Published 2025-04-04

   High·CVSS 8.8 EPSS 0.99%

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Catch Themes Catch Dark Mode catch-dark-mode allows PHP Local File Inclusion.This issue affects Catch Dark Mode: from n/a through <= 2.0.1.

5. CVE-2024-44010 WordPress Full frame theme <= 2.7.2 - Cross Site Scripting (XSS) vulnerability

   Published 2024-10-06

   Medium·CVSS 5.1 EPSS 0.22%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchthemes Full frame full-frame allows Stored XSS.This issue affects Full frame: from n/a through <= 2.7.2.

6. CVE-2024-47313 WordPress Catch Base theme <= 3.4.6 - Cross Site Scripting (XSS) vulnerability

   Published 2024-10-06

   Medium·CVSS 4.8 EPSS 0.25%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchthemes Catch Base catch-base allows Stored XSS.This issue affects Catch Base: from n/a through <= 3.4.6.

7. CVE-2024-47356 WordPress Create theme <= 2.9.1 - Cross Site Scripting (XSS) vulnerability

   Published 2024-10-06

   Medium·CVSS 5.9 EPSS 0.23%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchthemes Create create allows Stored XSS.This issue affects Create: from n/a through <= 2.9.1.

8. CVE-2023-25961 WordPress Darcie Theme <= 1.1.5 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-05-04

   Medium·CVSS 6.1 EPSS 0.38%

   Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Catch Themes Darcie theme <= 1.1.5 versions.

9. CVE-2021-24752 Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting Change

   Published 2021-10-18

   Medium·CVSS 5.7 EPSS 0.42%

   Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Hea...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.