Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

WordPress security records

WordPress Vulnerability Listing

Filter Production Feed records and inspect affected software, version ranges, severity, patch information and source attribution without opening separate UUID pages.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

Clear filters

3 vulnerability records

MediumCVE-2026-1755

Menu Icons by ThemeIsle <= 0.13.20 - Authenticated (Author+) Stored Cross-Site Scripting

Menu Icons by Themeisle – Add Icons to Navigation Menus: Currently marked unpatched

Affected versions: *-0.13.20

Vulnerability type: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected software, patched versions and attribution

The Menu Icons by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_wp_attachment_image_alt’ post meta in all versions up to, and including, 0.13.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Menu Icons by Themeisle – Add Icons to Navigation Menus

Affected versions: *-0.13.20

Patched versions: 0.13.21

Researcher credit: lucsob

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
February 3, 2026
CVSS
6.4
MediumCVE-2024-4635

Menu Icons by ThemeIsle <= 0.13.13 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload

Menu Icons by Themeisle – Add Icons to Navigation Menus: Currently marked unpatched

Affected versions: *-0.13.13

Vulnerability type: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected software, patched versions and attribution

The Menu Icons by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘add_mime_type’ function in versions up to, and including, 0.13.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Menu Icons by Themeisle – Add Icons to Navigation Menus

Affected versions: *-0.13.13

Patched versions: 0.13.14

Researcher credit: wesley (wcraft)

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
May 15, 2024
CVSS
6.4
MediumCVE-2024-1047

ThemeIsle SDK <= Various Versions - Missing Authorization

PPOM – Product Addons & Custom Fields for WooCommerce: Currently marked unpatchedMPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO: Currently marked unpatchedVisualizer – Tables & Charts Manager with Built-in AI Generator: Currently marked unpatchedSuper Page Cache – Cloudflare Cache, Page Speed & Core Web Vitals: Currently marked unpatchedRevive Social – Social Media Auto Post and Scheduling Automation Plugin: Currently marked unpatchedOptimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization: Currently marked unpatchedRSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator: Currently marked unpatchedOtter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Currently marked unpatchedLightStart – Maintenance Mode, Coming Soon and Landing Page Builder: Currently marked unpatchedMenu Icons by Themeisle – Add Icons to Navigation Menus: Currently marked unpatchedStarter Sites & Templates by Neve: Currently marked unpatchedOrbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More: Currently marked unpatched

Affected versions: *-32.0.9; *-3.4.0; *-3.10.6; *-4.7.5; *-9.0.25; *-3.12.4; *-4.4.1; *-2.6.2

Vulnerability type: CWE-862 Missing Authorization

Affected software, patched versions and attribution

Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.

PPOM – Product Addons & Custom Fields for WooCommerce

Affected versions: *-32.0.9

Patched versions: 32.0.10

MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO

Affected versions: *-3.4.0

Patched versions: 3.4.1

Visualizer – Tables & Charts Manager with Built-in AI Generator

Affected versions: *-3.10.6

Patched versions: 3.10.7

Super Page Cache – Cloudflare Cache, Page Speed & Core Web Vitals

Affected versions: *-4.7.5

Patched versions: 4.7.6

Revive Social – Social Media Auto Post and Scheduling Automation Plugin

Affected versions: *-9.0.25

Patched versions: 9.0.26

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization

Affected versions: *-3.12.4

Patched versions: 3.12.5

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator

Affected versions: *-4.4.1

Patched versions: 4.4.2

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE

Affected versions: *-2.6.2

Patched versions: 2.6.3

LightStart – Maintenance Mode, Coming Soon and Landing Page Builder

Affected versions: *-2.6.9

Patched versions: 2.6.10

Menu Icons by Themeisle – Add Icons to Navigation Menus

Affected versions: *-0.13.8

Patched versions: 0.13.9

Starter Sites & Templates by Neve

Affected versions: *-1.2.6

Patched versions: 1.2.7

Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More

Affected versions: *-2.10.28

Patched versions: 2.10.29

Researcher credit: Francesco Carlucci

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
February 1, 2024
CVSS
5.3

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

Production Feed records are aggregated without claiming discovery, exploitation or infection. Applicable source notices remain attached to individual records. Read the methodology.