imithemes vulnerabilities

Products

• Eventer 10
• Eventer - WordPress Event & Booking Manager Plugin 6
• NativeChurch 2
• Real Spaces - WordPress Properties Directory Theme 2
• Gaea 1
• IMITHEMES Listing 1

Latest imithemes CVEs

Newest publication first

1. CVE-2014-125133 NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php

   Published 2026-10-20

   High·CVSS 8.7 EPSS 1.1%

   NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file param...

2. CVE-2026-27408 WordPress NativeChurch theme < 4.9.5 - Cross Site Scripting (XSS) vulnerability

   Published 2026-07-02

   High·CVSS 7.1 EPSS 0.25%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes NativeChurch nativechurch allows Reflected XSS.This issue affects NativeChurch: from n/a before 4.9.5.

3. CVE-2026-32518 WordPress Gaea theme < 3.8 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2026-03-25

   High·CVSS 7.1 EPSS 0.19%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes Gaea gaea allows Reflected XSS.This issue affects Gaea: from n/a through < 3.8.

4. CVE-2025-6758 Real Spaces - WordPress Properties Directory Theme <= 3.6 - Unauthenticated Privilege Escalation to Administrator via 'imic_agent_register'

   Published 2025-08-19

   Critical·CVSS 9.8 EPSS 0.40%

   The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'imic_agent_register' function in all versions up to, and including, 3.6. This is due to a lack of restriction in the registration role. This makes it possible...

5. CVE-2025-8218 Real Spaces - WordPress Properties Directory Theme <= 3.5 - Authenticated (Subscriber+) Privilege Escalation to Administrator via 'change_role_member'

   Published 2025-08-19

   High·CVSS 8.8 EPSS 0.35%

   The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'change_role_member' parameter in all versions up to, and including, 3.5. This is due to a lack of restriction in the profile update role. This makes it possib...

6. CVE-2025-39483 WordPress Eventer plugin < 3.9.9.1 - Content Injection vulnerability

   Published 2025-08-14

   Medium·CVSS 6.5 EPSS 0.29%

   Improper Control of Generation of Code ('Code Injection') vulnerability in imithemes Eventer eventer allows Code Injection.This issue affects Eventer: from n/a through < 3.9.9.1.

7. CVE-2025-39481 WordPress Eventer plugin < 3.11.4 - SQL Injection vulnerability

   Published 2025-05-16

   Critical·CVSS 9.8 EPSS 0.55%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in imithemes Eventer eventer allows Blind SQL Injection.This issue affects Eventer: from n/a through < 3.11.4.

8. CVE-2025-39482 WordPress Eventer plugin < 3.11.4 - Broken Access Control vulnerability

   Published 2025-05-16

   High·CVSS 8.8 EPSS 0.52%

   Missing Authorization vulnerability in imithemes Eventer eventer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eventer: from n/a through < 3.11.4.

9. CVE-2025-2253 IMITHEMES Listing <= 3.3 - Unauthenticated Privilege Escalation via Unverified Password Reset

   Published 2025-05-09

   Critical·CVSS 9.8 EPSS 0.85%

   The IMITHEMES Listing plugin is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3. This is due to the plugin not properly validating a verification code value prior to updating their password through the imic_reset_password_init() f...

10. CVE-2025-0959 Eventer - WordPress Event & Booking Manager Plugin <= 3.9.9.2 - Authenticated (Subscriber+) SQL Injection via reg_id

    Published 2025-03-07

    Medium·CVSS 6.5 EPSS 0.44%

    The Eventer - WordPress Event & Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via the reg_id parameter in all versions up to, and including, 3.9.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

11. CVE-2025-22635 WordPress Eventer - WordPress Event & Booking Manager Plugin plugin < 3.9.9 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 2025-02-23

    Medium·CVSS 6.1 EPSS 0.23%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes Eventer eventer allows Reflected XSS.This issue affects Eventer: from n/a through < 3.9.9.

12. CVE-2024-11134 Eventer <= 3.9.9 - Missing Authorization to Authenticated (Subscriber+) Bookings Export

    Published 2025-02-03

    Medium·CVSS 6.5 EPSS 0.32%

    The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'eventer_export_bookings_csv' function in all versions up to, and including, 3.9.9. This makes it possible for authenticated attackers with subscriber-level perm...

13. CVE-2024-11132 Eventer <= 3.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    Published 2025-02-03

    Medium·CVSS 5.4 EPSS 0.26%

    The Eventer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.9.9.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with c...

14. CVE-2024-11133 Eventer <= 3.9.9.5 - Missing Authorization to Unauthenticated Event Ticket Download

    Published 2025-02-03

    Medium·CVSS 5.3 EPSS 0.35%

    The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_pdf_download_request' function in all versions up to, and including, 3.9.9.5. This makes it possible for unauthenticated attackers to download event tick...

15. CVE-2024-11135 Eventer <= 3.9.8 - Unauthenticated SQL Injection via eventer_get_attendees

    Published 2025-01-28

    High·CVSS 7.5 EPSS 0.47%

    The Eventer plugin for WordPress is vulnerable to SQL Injection via the 'event' parameter in the 'eventer_get_attendees' function in all versions up to, and including, 3.9.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exis...

16. CVE-2024-10799 Eventer <= 3.9.7 - Authenticated (Subscriber+) Arbitrary File Read

    Published 2025-01-17

    Medium·CVSS 6.5 EPSS 0.75%

    The Eventer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.9.7 via the eventer_woo_download_tickets() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.