extendthemes vulnerabilities

CVEs per yearBy the year they were published

1. 20233
2. 202415
3. 20259
4. 20266

Newest CVEs

• CVE-2026-109191

  Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML

  extendthemes · Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy

  Medium4.3
• CVE-2026-107758

  Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments

  extendthemes · Colibri Page Builder

  High7.2
• CVE-2026-100107

  Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)

  extendthemes · Kubio AI Page Builder

  High7.2
• CVE-2026-14472

  Kubio AI Page Builder <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content

  extendthemes · Kubio AI Page Builder

  Medium6.4
• CVE-2026-16779

  Kubio AI Page Builder <= 2.8.5 - Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration Reversion via kubio_restore_front_page AJAX Action

  extendthemes · Kubio AI Page Builder

  Medium4.3
• CVE-2026-5427

  Kubio AI Page Builder <= 2.7.2 - Missing Authorization to Authenticated (Contributor+) Limited File Upload via Kubio Block Attributes

  extendthemes · Kubio AI Page Builder

  Medium5.3
• CVE-2025-62751

  WordPress Vireo theme <= 1.0.24 - Broken Access Control vulnerability

  extendthemes · Vireo

  Medium4.3
• CVE-2025-11747

  Colibri Page Builder <= 1.0.345 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  extendthemes · Colibri Page Builder

  Medium6.4
• CVE-2025-11376

  Colibri Page Builder <= 1.0.335 - Authenticated (Contributor+) Stored Cross-Site Scripting

  extendthemes · Colibri Page Builder

  Medium6.4
• CVE-2025-9560

  Colibri Page Builder <= 1.0.334 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_newsletter Shortcode

  extendthemes · Colibri Page Builder

  Medium6.4