envato vulnerabilities

Products

• Template Kit – Import 3
• Envato Elements 2
• complete gallery manager plugin 1
• Envato Elements – Photos & Elementor Templates 1
• Template Kit – Export 1

Latest envato CVEs

Newest publication first

1. CVE-2026-96824 WordPress Template Kit – Import plugin <= 1.0.16 - Arbitrary File Deletion vulnerability

   Published 2026-09-30

   Medium·CVSS 6.8 EPSS 0.38%

   Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.

2. CVE-2024-56275 WordPress Envato Elements plugin <= 2.0.14 - Server Side Request Forgery (SSRF) vulnerability

   Published 2025-01-07

   Medium·CVSS 4.1 EPSS 0.40%

   Server-Side Request Forgery (SSRF) vulnerability in Envato Envato Elements allows Server Side Request Forgery.This issue affects Envato Elements: from n/a through 2.0.14.

3. CVE-2024-37550 WordPress Template Kit – Export plugin <= 1.0.22 - Cross Site Scripting (XSS) vulnerability

   Published 2024-07-21

   Medium·CVSS 4.8 EPSS 0.28%

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Envato Template Kit – Export allows Stored XSS.This issue affects Template Kit – Export: from n/a through 1.0.22.

4. CVE-2024-2334 Template Kit – Import <= 1.0.14 - Authenticated(Author+) Stored Cross-Site Scripting via template upload

   Published 2024-04-09

   Medium·CVSS 6.4 EPSS 0.45%

   The Template Kit – Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the template upload functionality in all versions up to, and including, 1.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated atta...

5. CVE-2021-4330 Envato Elements <= 2.0.10 & Template Kit <= 1.0.13 - Authenticated (Contributor+) Arbitrary File Upload

   Published 2023-03-07

   High·CVSS 8.8 EPSS 1.5%

   The Envato Elements & Download and Template Kit – Import plugins for WordPress are vulnerable to arbitrary file uploads due to insufficient validation of file type upon extracting uploaded Zip files in the installFreeTemplateKit and uploadTemplateKitZipFile functions. This makes...

6. CVE-2013-5962 Complete Gallery Manager <= 3.3.3 - Arbitrary File Upload

   Published 2013-09-30

   Medium·CVSS 5.1 EPSS 14.8% Public exploit

   Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.