Themes4WP vulnerabilities

Products

• Popularis Extra 3
• Bulk 1
• Popularis Verse 1
• Themes4WP YouTube External Subtitles 1
• youtube external subtitles 1

Latest Themes4WP CVEs

Newest publication first

1. CVE-2026-25422 WordPress Popularis Extra plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2026-02-19

   Medium·CVSS 5.4 EPSS 0.12%

   Cross-Site Request Forgery (CSRF) vulnerability in Themes4WP Popularis Extra popularis-extra allows Cross Site Request Forgery.This issue affects Popularis Extra: from n/a through <= 1.2.10.

2. CVE-2025-26867 WordPress Bulk theme <= 1.0.11 - Broken Access Control vulnerability

   Published 2025-05-19

   Medium·CVSS 5.3 EPSS 0.27%

   Missing Authorization vulnerability in Themes4WP Bulk allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bulk: from n/a through 1.0.11.

3. CVE-2024-38763 WordPress Popularis Verse theme <= 1.1.1 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2025-01-02

   Medium·CVSS 4.3 EPSS 0.20%

   Cross-Site Request Forgery (CSRF) vulnerability in themes4wp Popularis Verse popularis-verse allows Cross Site Request Forgery.This issue affects Popularis Verse: from n/a through <= 1.1.1.

4. CVE-2024-10795 Popularis Extra <= 1.2.7 - Authenticated (Contributor+) Post Disclosure

   Published 2024-11-16

   Medium·CVSS 4.3 EPSS 0.33%

   The Popularis Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.7 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, w...

5. CVE-2024-50470 WordPress Themes4WP YouTube External Subtitles plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

   Published 2024-10-28

   Medium·CVSS 5.4 EPSS 0.27%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themes4WP Themes4WP YouTube External Subtitles themes4wp-youtube-external-subtitles allows DOM-Based XSS.This issue affects Themes4WP YouTube External Subtitles: from n/a through...

6. CVE-2024-9353 Popularis Extra <= 1.2.6 - Reflected Cross-Site Scripting

   Published 2024-10-04

   Medium·CVSS 6.1 EPSS 0.39%

   The Popularis Extra plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.