Ex-Themes vulnerabilities

Products

• WP Timeline – Vertical and Horizontal timeline plugin 3
• wp timeline 2
• WooCommerce Food - Restaurant Menu & Food ordering 1
• WooEvents 1
• WooEvents - Calendar and Event Booking 1
• WooTour 1
• WP Food 1

Latest Ex-Themes CVEs

Newest publication first

1. CVE-2026-32440 WordPress WP Food plugin < 2.7.1 - Broken Access Control vulnerability

   Published 2026-03-13

   Medium·CVSS 5.3 EPSS 0.20%

   Missing Authorization vulnerability in Ex-Themes WP Food wp-food allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Food: from n/a through < 2.7.1.

2. CVE-2025-54722 WordPress WooTour plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability

   Published 2025-11-06

   High·CVSS 7.1 EPSS 0.24%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ex-Themes WooTour woo-tour allows Reflected XSS.This issue affects WooTour: from n/a through <= 3.6.3.

3. CVE-2025-60121 WordPress WooEvents plugin <= 4.1.7 - Broken Access Control vulnerability

   Published 2025-09-26

   Medium·CVSS 5.3 EPSS 0.27%

   Missing Authorization vulnerability in Ex-Themes WooEvents woo-events allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooEvents: from n/a through <= 4.1.7.

4. CVE-2024-13792 WooCommerce Food - Restaurant Menu & Food ordering <= 3.3.2 - Unauthenticated Arbitrary Shortcode Execution via ids

   Published 2025-02-20

   Critical·CVSS 9.8 EPSS 0.55%

   The WooCommerce Food - Restaurant Menu & Food ordering plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.2. This is due to the software allowing users to execute an action that does not properly validate a value before r...

5. CVE-2024-47322 WordPress WP Timeline plugin <= 3.6.7 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2024-10-06

   High·CVSS 7.1 EPSS 0.29%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines allows Reflected XSS.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n...

6. CVE-2024-47324 WordPress WP Timeline plugin <= 3.6.7 - Local File Inclusion vulnerability

   Published 2024-10-05

   High·CVSS 7.5 EPSS 0.51%

   Path Traversal: '.../...//' vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n/a through <= 3.6.7.

7. CVE-2024-47323 WordPress WP Timeline plugin <= 3.6.7 - Local File Inclusion vulnerability

   Published 2024-10-05

   High·CVSS 8.1 EPSS 0.61%

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n/a...

8. CVE-2024-8671 WooEvents <= 4.1.2 - Unauthenticated Arbitrary File Overwrite

   Published 2024-09-24

   Critical·CVSS 9.1 EPSS 1.0%

   The WooEvents - Calendar and Event Booking plugin for WordPress is vulnerable to arbitrary file overwrite due to insufficient file path validation in the inc/barcode.php file in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated attackers to over...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.