deothemes vulnerabilities

Products

• Arendelle 3
• Everse 3
• Nokke 3
• Amela 2
• Ona 2
• medikaid 1
• MedikAid | Medical Health Care RTL WordPress Theme 1
• Meridia 1
• Purosa 1
• WordPress Everse Starter Sites – Elementor Templates 1

Latest deothemes CVEs

Newest publication first

1. CVE-2026-6812 Ona <= 1.26 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'download_link' Parameter

   Published 2026-05-02

   Medium·CVSS 4.4 EPSS 0.25%

   The Ona theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.26 via the ona_activate_child_theme. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary l...

2. CVE-2026-32482 WordPress Ona theme < 1.24 - Arbitrary File Upload vulnerability

   Published 2026-03-25

   Critical·CVSS 9.9 EPSS 0.34%

   Unrestricted Upload of File with Dangerous Type vulnerability in deothemes Ona ona allows Upload a Web Shell to a Web Server.This issue affects Ona: from n/a through < 1.24.

3. CVE-2022-4974 Freemius SDK <= 2.4.2 - Missing Authorization Checks

   Published 2024-10-16

   Medium·CVSS 6.3 EPSS 0.44%

   The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in...

4. CVE-2023-2813 Multiple Themes - Reflected XSS

   Published 2023-09-04

   Medium·CVSS 6.1 EPSS 1.0%

   All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress th...

5. CVE-2023-3708 Multiple DeoThemes Themes <= (Various Versions) - Reflected Cross-Site Scripting

   Published 2023-07-18

   Medium·CVSS 6.1 EPSS 0.59%

   Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.