Themify

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Themify product.

RSS Feeds for Themify security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Themify products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Themify Sorted by Most Security Vulnerabilities since 2018

Themify Builder6 vulnerabilities

Themify Woocommerce Product Filter6 vulnerabilities

Themify Portfolio Post5 vulnerabilities

Themify Shortcodes5 vulnerabilities

Themify Ultra5 vulnerabilities

Themify Conditional Menus1 vulnerability

Themify Framework1 vulnerability

Themify Icons1 vulnerability

Themify Post Type Builder Search Addon1 vulnerability

Themify Product Filter1 vulnerability

Themify Shortcodes1 vulnerability

Themify Store Locator1 vulnerability

Themify Ultra1 vulnerability

By the Year

In 2026 there have been 3 vulnerabilities in Themify with an average score of 9.5 out of ten. Last year, in 2025 Themify had 4 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Themify in 2026 could surpass last years number. However, the average CVE base score of the vulnerabilities in 2026 is greater by 3.28.

Year	Vulnerabilities	Average Score
2026	3	9.53
2025	4	6.25
2024	19	6.72
2023	7	6.29
2022	3	5.87
2021	2	7.60

It may take a day or so for new Themify vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Themify Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2025-30996	Jan 06, 2026	Themify WP Themes <1.9.8: Unrestricted File Upload (Web Shell) Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themify Bloggie, Themify Photobox, Themify Wigi, Themify Rezo, Themify Slide allows Upload a Web Shell to a Web Server.This issue affects Themify Sidepane WordPress Theme: from n/a through 1.9.8; Themify Newsy: from n/a through 1.9.9; Themify Folo: from n/a through 1.9.6; Themify Edmin: from n/a through 2.0.0; Bloggie: from n/a through 2.0.8; Photobox: from n/a through 2.0.1; Wigi: from n/a through 2.0.1; Rezo: from n/a through 1.9.7; Slide: from n/a through 1.7.5.
CVE-2025-31048	Jan 05, 2026	Unrestricted Dangerous File Upload in Themify Shopo <=1.1.4 Unrestricted Upload of File with Dangerous Type vulnerability in Themify Shopo allows Upload a Web Shell to a Web Server.This issue affects Shopo: from n/a through 1.1.4.
CVE-2025-31047	Jan 05, 2026	Themify Edmin 2.0.0 - DESERIAL Untrusted Data Object Injection Deserialization of Untrusted Data vulnerability in Themify Themify Edmin allows Object Injection.This issue affects Themify Edmin: from n/a through 2.0.0.
CVE-2025-9353	Sep 24, 2025	WP XSS via Themify Builder 7.6.9 (Stored) The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 7.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 7.6.9.	Themify Builder
CVE-2025-49396	Aug 20, 2025	Missing Auth in Themify Builder <7.6.7 (IRAC) Missing Authorization vulnerability in themifyme Themify Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Themify Builder: from n/a through 7.6.7.	Themify Builder
CVE-2025-39581	Apr 16, 2025	Stored XSS in Themify Shortcodes <= 2.1.3 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Shortcodes allows Stored XSS. This issue affects Themify Shortcodes: from n/a through 2.1.3.	Themify Shortcodes
CVE-2024-13319	Jan 22, 2025	Themify Builder WP Plugin XSS Reflected v<=7.6.5 The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.6.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	Themify Builder
CVE-2024-56216	Dec 31, 2024	Themify Builder PHP Remote File Inclusion Vulnerability Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themifyme Themify Builder themify-builder allows PHP Local File Inclusion.This issue affects Themify Builder: from n/a through <= 7.6.3.	Builder
CVE-2024-12414	Dec 13, 2024	Themify Store Locator WordPress Plugin CSRF Vulnerability The Themify Store Locator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the setting_page() function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.	Store Locator
CVE-2024-52423	Nov 18, 2024	Stored XSS in Themify Builder <=7.6.3 (CVE-2024-52423) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Builder themify-builder allows Stored XSS.This issue affects Themify Builder: from n/a through <= 7.6.5.	Builder
CVE-2024-44046	Oct 06, 2024	XSS in Themify WooCommerce Product Filter <=1.5.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify WooCommerce Product Filter themify-wc-product-filter allows Stored XSS.This issue affects Themify WooCommerce Product Filter: from n/a through <= 1.5.1.	Woocommerce Product Filter
CVE-2024-9385	Oct 05, 2024	Themify Builder <7.6.2 XSS via add_query_arg in URL The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.6.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	Builder
CVE-2024-7836	Aug 22, 2024	Themify Builder 7.6.1 Auth Post Duplication via duplicate_page_ajaxify The Themify Builder plugin for WordPress is vulnerable to unauthorized post duplication due to missing checks on the duplicate_page_ajaxify function in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate and view private or draft posts created by other users that otherwise shouldn't be accessible to them.	Themify Builder Builder
CVE-2024-43133	Aug 12, 2024	Themify Shortcodes XSS in Shortcodes before 2.1.2 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themify Themify Shortcodes allows Stored XSS.This issue affects Themify Shortcodes: from n/a through 2.1.1.	Themify Shortcodes
CVE-2024-6027	Jun 21, 2024	Themify WooCommerce Product Filter v1.4.9: Timebased SQLi via conditions The Themify WooCommerce Product Filter plugin for WordPress is vulnerable to time-based SQL Injection via the conditions parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	Product Filter Woocommerce Product Filter
CVE-2023-46148	Jun 19, 2024	Missing Auth in Themify Ultra <7.3.5 Missing Authorization vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.	Ultra
CVE-2023-46146	Jun 19, 2024	Missing Auth in Themify Ultra (7.3.5) WP Theme Issue Missing Authorization vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.	Ultra
CVE-2024-3032	Jun 13, 2024	Open Redirect Vulnerability in Themify Builder WP plug < 7.5.8 Themify Builder WordPress plugin before 7.5.8 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue	Themify Builder Builder
CVE-2023-46145	May 17, 2024	WP Themify Ultra <=7.3.5 Priv Esc via Improper Priv Mgmt Improper Privilege Management vulnerability in Themify Themify Ultra allows Privilege Escalation.This issue affects Themify Ultra: from n/a through 7.3.5.	Ultra
CVE-2024-4567	May 14, 2024	Themify Shortcodes <=2.0.9 Stored XSS via themify_button The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themify_button shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Themify Shortcodes
CVE-2024-2278	Apr 01, 2024	WP Themify <1.4.4 XSS via unsanitised Filter settings Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)	Woocommerce Product Filter
CVE-2024-2263	Apr 01, 2024	Themify WP Plugin before 1.4.4 XSS via unsanitized param Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin	Woocommerce Product Filter
CVE-2024-2262	Apr 01, 2024	Themify WP Plugin <1.4.4: CSRF Allows Bulk Deletion of Filters Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs	Woocommerce Product Filter
CVE-2024-2732	Mar 26, 2024	Stored XSS in Themify Shortcodes <=2.0.8 via themify_post_slider shortcode The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'themify_post_slider shortcode in all versions up to, and including, 2.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Themify Shortcodes
CVE-2024-24872	Feb 21, 2024	CSRF in Themify Builder (v7.0.5) Vulnerable to CrossSite Request Forgery Cross-Site Request Forgery (CSRF) vulnerability in Themify Themify Builder.This issue affects Themify Builder: from n/a through 7.0.5.	Builder Themify Builder
CVE-2023-51693	Feb 01, 2024	Stored XSS in Themify Icons <=2.0.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Icons allows Stored XSS.This issue affects Themify Icons: from n/a through 2.0.1.	Icons
CVE-2023-46149	Dec 20, 2023	Unrestricted Upload of Dangerous Files in Themify Ultra <=7.3.5 Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.	Ultra
CVE-2023-46147	Dec 20, 2023	Deserialization of Untrusted Data in Themify Ultra <7.3.5 Deserialization of Untrusted Data vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.	Themify Ultra Ultra
CVE-2023-2654	Jun 19, 2023	WordPress Conditional Menus 1.2.1 Reflected XSS via unescaped attribute The Conditional Menus WordPress plugin before 1.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin	Conditional Menus
CVE-2022-32970	May 10, 2023	Stored XSS in Themify Portfolio Post <=1.2.4 Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Themify Themify Portfolio Post plugin <= 1.2.4 versions.	Portfolio Post
CVE-2023-0362	Feb 13, 2023	Stored XSS in Themify Portfolio Post before 1.2.2 Shortcode Attributes Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.	Portfolio Post
CVE-2022-4787	Jan 30, 2023	Themify Shortcodes WP Plugin XSS via Unvalidated Shortcode Attribute (2.0.8) Themify Shortcodes WordPress plugin before 2.0.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.	Shortcodes Themify Shortcodes
CVE-2022-4464	Jan 16, 2023	Stored XSS via unescaped shortcode attributes in Themify Portfolio Post <1.2.1 Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privileged users such as admin.	Portfolio Post
CVE-2022-1532	Jun 13, 2022	Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting	Woocommerce Product Filter
CVE-2022-1047	May 09, 2022	The Themify Post Type Builder Search Addon WordPress plugin before 1.4.0 does not properly escape the current page URL before reusing it in a HTML attribute The Themify Post Type Builder Search Addon WordPress plugin before 1.4.0 does not properly escape the current page URL before reusing it in a HTML attribute, leading to a reflected cross site scripting vulnerability.	Post Type Builder Search Addon
CVE-2022-0200	Feb 14, 2022	Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user) Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting	Portfolio Post
CVE-2013-20002	Jun 17, 2021	Elemin allows remote attackers to upload and execute arbitrary PHP code Elemin allows remote attackers to upload and execute arbitrary PHP code via the Themify framework (before 1.2.2) wp-content/themes/elemin/themify/themify-ajax.php file.	Framework
CVE-2021-24129	Mar 18, 2021	Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting (XSS) vulnerabilities Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting (XSS) vulnerabilities allowing low-privileged users (Contributor+) to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Panel is embedded, which could lead to privilege escalation.	Portfolio Post