Theme security history

ColorWay Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 4 vulnerability records associated with ColorWay, published between 2016 and 2025.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

4Total records

0Critical

0High

4Medium

0Low

0Informational

1Patched records

3Currently marked unpatched

2016-07-01First disclosure

2025-09-12Latest disclosure

3 of 4CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2016	1	1 records
2022	1	1 records
2023	1	1 records
2025	1	1 records

Severity Breakdown

Severity	Records	Share
Medium	4	100%

Vulnerability-Type Breakdown

Cross-Site Scripting

2 records50%

First: 2016. Latest: 2022.

CSRF

1 record25%

First: 2023. Latest: 2023.

Information Disclosure

1 record25%

First: 2025. Latest: 2025.

Patch Status

Patched: 1
Currently marked unpatched: 3
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.4.2

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-4.2.3`	Multiple Plugins and Themes by inkthemes <= 1.1.8 - Unauthenticated Information Exposure	September 12, 2025	Not supplied	Medium
`*-4.2.3`	ColorWay <= 4.2.3 - Cross Site Request Forgery	February 8, 2023	Not supplied	Medium
`*`	Multiple Themes (Various Versions) - Reflected Cross-Site Scripting	February 14, 2022	Not supplied	Medium
`*-3.4.1`	ColorWay <= 3.4.1 - Cross-Site Scripting	July 1, 2016	3.4.2	Medium

Selected source records

Latest Records

MediumCVE-2025-59003

Multiple Plugins and Themes by inkthemes <= 1.1.8 - Unauthenticated Information Exposure

Published: September 12, 2025

Affected versions: *-1.7.1
Patched versions: Not supplied

Affected versions: *-1.3.5
Patched versions: Not supplied

Affected versions: *-1.3.2
Patched versions: Not supplied

Affected versions: *-4.2.3
Patched versions: Not supplied

Affected versions: *-1.1.8
Patched versions: Not supplied

Affected versions: *-1.2.8
Patched versions: Not supplied

Affected versions: *-1.5.0
Patched versions: Not supplied

Affected versions: *-1.1.4
Patched versions: Not supplied

Affected versions: *-1.7.2
Patched versions: Not supplied

Affected versions: *-1.0.7
Patched versions: Not supplied

Affected versions: *-1.0.6
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2023-25447

ColorWay <= 4.2.3 - Cross Site Request Forgery

Published: February 8, 2023

Affected versions: *-4.2.3
Patched versions: Not supplied

Original Wordfence record

Medium

Multiple Themes (Various Versions) - Reflected Cross-Site Scripting

Published: February 14, 2022

Affected versions: [*, 1.2.3)
Patched versions: 1.2.3

Affected versions: [*, 0.2.4)
Patched versions: 0.2.4

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 2.1.4)
Patched versions: 2.1.4

Affected versions: [*, 2.0.5)
Patched versions: 2.0.5

Affected versions: [*, 1.2.3)
Patched versions: 1.2.3

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.7.7)
Patched versions: 1.7.7

Affected versions: [*, 2.4.9)
Patched versions: 2.4.9

Affected versions: [*, 1.4.1)
Patched versions: 1.4.1

Affected versions: [*, 3.7)
Patched versions: 3.7

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.1.6)
Patched versions: 1.1.6

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 2.0.3)
Patched versions: 2.0.3

Affected versions: [*, 1.6.7)
Patched versions: 1.6.7

Affected versions: [*, 2.2.1)
Patched versions: 2.2.1

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 2.9.7)
Patched versions: 2.9.7

Affected versions: [*, 1.1)
Patched versions: 1.1

Affected versions: [*, 1.1.5)
Patched versions: 1.1.5

Affected versions: [*, 3.2.6)
Patched versions: 3.2.6

Affected versions: *-1.2.9
Patched versions: Not supplied

Affected versions: [*, 1.7.2)
Patched versions: 1.7.2

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 2.7.4)
Patched versions: 2.7.4

Affected versions: [*, 2.3.6)
Patched versions: 2.3.6

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.1.2)
Patched versions: 1.1.2

Affected versions: [*, 1.4.2)
Patched versions: 1.4.2

Affected versions: [*, 2.3.5)
Patched versions: 2.3.5

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 2.3.8)
Patched versions: 2.3.8

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.1.9)
Patched versions: 1.1.9

Affected versions: *-5.6
Patched versions: 5.7

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 0.1.4)
Patched versions: 0.1.4

Affected versions: *
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2016-10961

ColorWay <= 3.4.1 - Cross-Site Scripting

Published: July 1, 2016

Affected versions: *-3.4.1
Patched versions: 3.4.2

Original Wordfence record

Highest-Severity Records

Medium

Multiple Themes (Various Versions) - Reflected Cross-Site Scripting

Published: February 14, 2022

Affected versions: [*, 1.2.3)
Patched versions: 1.2.3

Affected versions: [*, 0.2.4)
Patched versions: 0.2.4

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 2.1.4)
Patched versions: 2.1.4

Affected versions: [*, 2.0.5)
Patched versions: 2.0.5

Affected versions: [*, 1.2.3)
Patched versions: 1.2.3

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.7.7)
Patched versions: 1.7.7

Affected versions: [*, 2.4.9)
Patched versions: 2.4.9

Affected versions: [*, 1.4.1)
Patched versions: 1.4.1

Affected versions: [*, 3.7)
Patched versions: 3.7

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.1.6)
Patched versions: 1.1.6

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 2.0.3)
Patched versions: 2.0.3

Affected versions: [*, 1.6.7)
Patched versions: 1.6.7

Affected versions: [*, 2.2.1)
Patched versions: 2.2.1

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 2.9.7)
Patched versions: 2.9.7

Affected versions: [*, 1.1)
Patched versions: 1.1

Affected versions: [*, 1.1.5)
Patched versions: 1.1.5

Affected versions: [*, 3.2.6)
Patched versions: 3.2.6

Affected versions: *-1.2.9
Patched versions: Not supplied

Affected versions: [*, 1.7.2)
Patched versions: 1.7.2

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 2.7.4)
Patched versions: 2.7.4

Affected versions: [*, 2.3.6)
Patched versions: 2.3.6

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.1.2)
Patched versions: 1.1.2

Affected versions: [*, 1.4.2)
Patched versions: 1.4.2

Affected versions: [*, 2.3.5)
Patched versions: 2.3.5

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 2.3.8)
Patched versions: 2.3.8

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.1.9)
Patched versions: 1.1.9

Affected versions: *-5.6
Patched versions: 5.7

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 0.1.4)
Patched versions: 0.1.4

Affected versions: *
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2016-10961

ColorWay <= 3.4.1 - Cross-Site Scripting

Published: July 1, 2016

Affected versions: *-3.4.1
Patched versions: 3.4.2

Original Wordfence record

MediumCVE-2025-59003

Multiple Plugins and Themes by inkthemes <= 1.1.8 - Unauthenticated Information Exposure

Published: September 12, 2025

Affected versions: *-1.7.1
Patched versions: Not supplied

Affected versions: *-1.3.5
Patched versions: Not supplied

Affected versions: *-1.3.2
Patched versions: Not supplied

Affected versions: *-4.2.3
Patched versions: Not supplied

Affected versions: *-1.1.8
Patched versions: Not supplied

Affected versions: *-1.2.8
Patched versions: Not supplied

Affected versions: *-1.5.0
Patched versions: Not supplied

Affected versions: *-1.1.4
Patched versions: Not supplied

Affected versions: *-1.7.2
Patched versions: Not supplied

Affected versions: *-1.0.7
Patched versions: Not supplied

Affected versions: *-1.0.6
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2023-25447

ColorWay <= 4.2.3 - Cross Site Request Forgery

Published: February 8, 2023

Affected versions: *-4.2.3
Patched versions: Not supplied

Original Wordfence record

Currently Marked Unpatched Records

MediumCVE-2025-59003

Multiple Plugins and Themes by inkthemes <= 1.1.8 - Unauthenticated Information Exposure

Published: September 12, 2025

Affected versions: *-1.7.1
Patched versions: Not supplied

Affected versions: *-1.3.5
Patched versions: Not supplied

Affected versions: *-1.3.2
Patched versions: Not supplied

Affected versions: *-4.2.3
Patched versions: Not supplied

Affected versions: *-1.1.8
Patched versions: Not supplied

Affected versions: *-1.2.8
Patched versions: Not supplied

Affected versions: *-1.5.0
Patched versions: Not supplied

Affected versions: *-1.1.4
Patched versions: Not supplied

Affected versions: *-1.7.2
Patched versions: Not supplied

Affected versions: *-1.0.7
Patched versions: Not supplied

Affected versions: *-1.0.6
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2023-25447

ColorWay <= 4.2.3 - Cross Site Request Forgery

Published: February 8, 2023

Affected versions: *-4.2.3
Patched versions: Not supplied

Original Wordfence record

Medium

Multiple Themes (Various Versions) - Reflected Cross-Site Scripting

Published: February 14, 2022

Affected versions: [*, 1.2.3)
Patched versions: 1.2.3

Affected versions: [*, 0.2.4)
Patched versions: 0.2.4

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 2.1.4)
Patched versions: 2.1.4

Affected versions: [*, 2.0.5)
Patched versions: 2.0.5

Affected versions: [*, 1.2.3)
Patched versions: 1.2.3

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.7.7)
Patched versions: 1.7.7

Affected versions: [*, 2.4.9)
Patched versions: 2.4.9

Affected versions: [*, 1.4.1)
Patched versions: 1.4.1

Affected versions: [*, 3.7)
Patched versions: 3.7

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.1.6)
Patched versions: 1.1.6

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 2.0.3)
Patched versions: 2.0.3

Affected versions: [*, 1.6.7)
Patched versions: 1.6.7

Affected versions: [*, 2.2.1)
Patched versions: 2.2.1

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 2.9.7)
Patched versions: 2.9.7

Affected versions: [*, 1.1)
Patched versions: 1.1

Affected versions: [*, 1.1.5)
Patched versions: 1.1.5

Affected versions: [*, 3.2.6)
Patched versions: 3.2.6

Affected versions: *-1.2.9
Patched versions: Not supplied

Affected versions: [*, 1.7.2)
Patched versions: 1.7.2

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 2.7.4)
Patched versions: 2.7.4

Affected versions: [*, 2.3.6)
Patched versions: 2.3.6

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.1.2)
Patched versions: 1.1.2

Affected versions: [*, 1.4.2)
Patched versions: 1.4.2

Affected versions: [*, 2.3.5)
Patched versions: 2.3.5

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 2.3.8)
Patched versions: 2.3.8

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 1.1.9)
Patched versions: 1.1.9

Affected versions: *-5.6
Patched versions: 5.7

Affected versions: *
Patched versions: Not supplied

Affected versions: [*, 0.1.4)
Patched versions: 0.1.4

Affected versions: *
Patched versions: Not supplied

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory