Themify Folo vulnerabilities

Latest Themify Folo CVEs

Newest publication first

1. CVE-2025-31013 WordPress Themify Folo theme <= 1.9.6 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2026-06-17

   High·CVSS 7.1 EPSS 0.15%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Folo allows Reflected XSS. This issue affects Themify Folo: from n/a through 1.9.6.

2. CVE-2025-30996 Arbitrary File Upload Vulnerability in WordPress themes by Themify

   Published 2026-01-06

   Critical·CVSS 9.9 EPSS 0.51%

   Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themify Bloggie, Themify Photobox, Themify Wigi, Themify Rezo, Themify Slide allows Upload a Web Shell to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.