CVEs we hold for Creative
Records whose assigning authority named Creative as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-9236CM Ad Changer <= 2.0.7 - Cross-Site Request Forgery to Campaign Deletion via Campaign Managementcreativemindssolutions CM Ad Changer – A simple tool to…
CVE-2026-8892CM Business Directory <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Business Address Meta…creativemindssolutions CM Business Directory – Optimise and…
CVE-2026-8365Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via…creativethemeshq Blocksy
CVE-2026-66031Ekushey Project Manager CRM 5.0 Stored XSS via Reply Ticket FieldCreativeitem Ekushey Project Manager CRM
CVE-2026-66030Ekushey Project Manager CRM 5.0 Stored XSS via Ticket Title FieldCreativeitem Ekushey Project Manager CRM
CVE-2026-66029Ekushey Project Manager CRM 5.0 Stored XSS via Client Name FieldCreativeitem Ekushey Project Manager CRM
CVE-2026-66028Ekushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client EmailCreativeitem Ekushey Project Manager CRM
CVE-2026-58480Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachmentsCreative Themes Blocksy Companion
CVE-2026-57787WordPress CWS SVGicons plugin <= 1.5.5 - SQL Injection vulnerabilityCreativeWS CWS SVGicons
CVE-2026-57630WordPress Blocksy Companion Pro plugin <= 2.1.46 - Insecure Direct Object References (IDOR) vulnerabilityCreative Themes Blocksy Companion Pro
CVE-2026-57624WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerabilityCreative Themes Blocksy Companion Pro
CVE-2026-57315WordPress Blocksy Companion Pro plugin <= 2.1.45 - Remote Code Execution (RCE) vulnerabilityCreative Themes Blocksy Companion Pro
CVE-2026-40783WordPress Blocksy Companion Pro plugin <= 2.1.37 - Remote Code Execution (RCE) vulnerabilityCreative Themes Blocksy Companion Pro
CVE-2026-4022Show Posts list <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodecreativedev4 Show Posts list – Easy designs, filters and…
CVE-2026-39677WordPress Emphires theme <= 3.9 - Local File Inclusion vulnerabilityCreatives_Planet Emphires
CVE-2026-39596WordPress Blocksy Companion Pro plugin < 2.1.29 - SQL Injection vulnerabilityCreative Themes Blocksy Companion Pro
CVE-2026-32504WordPress VintWood theme <= 1.1.8 - Local File Inclusion vulnerabilityCreativeWS VintWood
CVE-2026-32503WordPress Trendustry theme <= 1.1.4 - Local File Inclusion vulnerabilityCreativeWS Trendustry
CVE-2026-32500WordPress MetaMax theme <= 1.1.4 - Local File Inclusion vulnerabilityCreativeWS MetaMax
CVE-2026-32393WordPress Greenly Theme Addons plugin < 8.2 - Local File Inclusion vulnerabilityCreatives_Planet Greenly Theme Addons
CVE-2026-32392WordPress Greenly theme <= 8.1 - Local File Inclusion vulnerabilityCreatives_Planet Greenly
CVE-2026-26211Ekushey Project Manager CRM 5.0 Stored XSS via System Name FieldCreativeitem Ekushey Project Manager CRM
CVE-2026-2583Blocksy <= 2.1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via `blocksy_meta` Fieldscreativethemeshq Blocksy
CVE-2026-25423WordPress Real 3D FlipBook plugin <= 4.19.1 - Broken Access Control vulnerabilitycreativeinteractivemedia Real 3D FlipBook
CVE-2026-25004WordPress CM Business Directory plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerabilityCreativeMindsSolutions CM Business Directory
CVE-2026-2432CM Custom Reports <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Labelscreativemindssolutions CM Custom Reports – Flexible…
CVE-2026-2431CM Custom Reports <= 1.2.7 - Reflected Cross-Site Scripting via 'date_from' and 'date_to' Parameterscreativemindssolutions CM Custom Reports – Flexible…
CVE-2026-18488Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute…creativethemeshq Blocksy Companion
CVE-2026-16601CM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Actioncreativemindssolutions CM Map Locations – Visualize and…
CVE-2026-15158Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parametercreativethemeshq Blocksy Companion
CVE-2026-15098Real 3D Flipbook <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightboxtext' Shortcode…creativeinteractivemedia Real3D Flipbook – 3D FlipBook, PDF…
CVE-2026-12430Blocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parametercreativethemeshq Blocksy Companion
CVE-2026-1093WPFAQBlock– FAQ & Accordion Plugin For Gutenberg <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via…creativewerkdesigns WPFAQBlock– FAQ & Accordion Plugin For…
CVE-2026-0691CM E-Mail Blacklist <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'black_email' Parametercreativemindssolutions CM E-Mail Blacklist – Simple email…
CVE-2025-9565Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe…creativethemeshq Blocksy Companion
CVE-2025-68512WordPress Real 3D FlipBook plugin <= 4.11.4 - Cross Site Scripting (XSS) vulnerabilitycreativeinteractivemedia Real 3D FlipBook
CVE-2025-58995WordPress Leblix Theme <= 2.4 - Local File Inclusion VulnerabilityCreatives_Planet Leblix
CVE-2025-55713WordPress Blocksy Theme <= 2.1.6 - Cross Site Scripting (XSS) Vulnerabilitycreativethemeshq Blocksy
CVE-2025-54728WordPress CM On Demand Search And Replace Plugin <= 1.5.2 - Cross Site Request Forgery (CSRF) VulnerabilityCreativeMindsSolutions CM On Demand Search And Replace
CVE-2025-54727WordPress CM On Demand Search And Replace Plugin <= 1.5.2 - Cross Site Scripting (XSS) VulnerabilityCreativeMindsSolutions CM On Demand Search And Replace
CVE-2025-54045WordPress CM On Demand Search And Replace plugin <= 1.5.5 - Broken Access Control vulnerabilityCreativeMindsSolutions CM On Demand Search And Replace
CVE-2025-54018WordPress CM Pop-Up banners plugin <= 1.8.4 - Broken Access Control VulnerabilityCreativeMindsSolutions CM Pop-Up banners
CVE-2025-52794WordPress Creative Contact Form plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) VulnerabilityCreative-Solutions Creative Contact Form
CVE-2025-48151WordPress CM Map Locations <= 2.1.6 - Cross Site Scripting (XSS) VulnerabilityCreativeMindsSolutions CM Map Locations
CVE-2025-47465WordPress Blocksy theme <= 2.0.97 - Broken Access Control Vulnerabilitycreativethemeshq Blocksy
CVE-2025-46246WordPress CM Answers plugin <= 3.3.3 - Cross Site Request Forgery (CSRF) VulnerabilityCreativeMindsSolutions CM Answers
CVE-2025-46245WordPress CM Ad Changer plugin <= 2.0.5 - Cross Site Request Forgery (CSRF) VulnerabilityCreativeMindsSolutions CM Ad Changer
CVE-2025-3781Raisely Donation Form <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via raisely_donation_form…creativefreedomau Raisely Donation Form
CVE-2025-32210WordPress CM Registration and Invitation Codes plugin <= 2.5.6 - Broken Access Control vulnerabilityCreativeMindsSolutions CM Registration and Invitation Codes
CVE-2025-31091WordPress CM Header and Footer plugin <= 1.2.4 - Cross Site Scripting (XSS) VulnerabilityCreativeMindsSolutions CM Header and Footer
CVE-2025-30910WordPress CM Download Manager plugin <= 2.9.6 - Arbitrary File Deletion vulnerabilityCreativeMindsSolutions CM Download Manager
CVE-2025-27264WordPress Doctor Appointment Booking Plugin <= 1.0.0 - Local File Inclusion vulnerabilityCreativeitem Doctor Appointment Booking
CVE-2025-27263WordPress Doctor Appointment Booking Plugin <= 1.0.0 - SQL Injection vulnerabilityCreativeitem Doctor Appointment Booking
CVE-2025-24758WordPress CM Map Locations plugin <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerabilityCreativeMindsSolutions CM Map Locations
CVE-2025-24694WordPress CM Pop-Up Banners plugin <= 1.7.6 - Reflected Cross Site Scripting (XSS) vulnerabilityCreativeMindsSolutions CM Pop-Up banners
CVE-2025-22769WordPress Multifox theme <= 1.3.7 - Cross Site Scripting (XSS) vulnerabilityCreative Brahma Multifox
CVE-2025-22667WordPress Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets plugin <= 1.8.2 - Broken Access…Creative Werk Designs Export Order, Product, Customer &…
CVE-2025-2166CM FAQ – Simplify support with an intuitive FAQ management tool <= 1.2.5 - Reflected Cross-Site Scriptingcreativemindssolutions CM FAQ – Simplify support with an…
CVE-2025-13749Clearfy <= 2.4.0 - Cross-Site Request Forgery to Update Notification Tamperingcreativemotion Clearfy Cache – WordPress optimization…
CVE-2025-12846Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypasscreativethemeshq Blocksy Companion
CVE-2025-12475Blocksy Companion <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scriptingcreativethemeshq Blocksy Companion
CVE-2025-11167CM Registration – Tailored tool for seamless login and invitation-based registrations <= 2.5.6 - Open Redirectcreativemindssolutions CM Registration – Tailored tool for…
CVE-2025-10187GSpeech TTS – WordPress Text To Speech Plugin <= 3.17.13 - Authenticated (Admin+) SQL injectioncreative-solutions-1 GSpeech TTS – WordPress Text To Speech…
CVE-2025-10178CM Business Directory <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingcreativemindssolutions CM Business Directory – Optimise and…
CVE-2024-9849Real3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder <= 4.8 - Authenticated (Author+) Arbitrary File Uploadcreativeinteractivemedia Real 3D Flipbook – 3D FlipBook…
CVE-2024-9195WHMPress - WHMCS Client Area <= 4.3-revision-3- Authenticated (Subscriber+) Arbitrary Options Updatecreativeon WHMCS Client Area for WordPress by WHMpress
CVE-2024-9193WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Updatecreativeon WHMpress - WHMCS WordPress Integration Plugin
CVE-2024-5439Blocksy <= 2.0.50 - Authenticated (Contributor+) Stored Cross-Site Scriptingcreativethemeshq Blocksy
CVE-2024-54267WordPress CM Answers plugin <= 3.2.6 - Broken Access Control vulnerabilityCreativeMindsSolutions CM Answers
CVE-2024-51916WordPress Multifox Plus plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerabilityCreative Brahma Multifox Plus
CVE-2024-4943Blocksy <= 2.0.46 - Authenticated (Contributor+) Stored Cross-Site Scriptingcreativethemeshq Blocksy
CVE-2024-48041WordPress CM Tooltip Glossary plugin <= 4.3.9 - Stored Cross-Site Scripting vulnerabilityCreativeMindsSolutions CM Tooltip Glossary
CVE-2024-4487Blocksy Companion <= 2.0.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Uploadscreativethemeshq Blocksy Companion
CVE-2024-43260WordPress Clearfy Cache plugin <= 2.2.4 - Broken Access Control vulnerabilityCreative Motion Clearfy Cache
CVE-2024-43247WordPress WHMpress plugin <= 6.2-revision-5 - Subscriber+ Arbitrary Settings Change vulnerabilitycreativeon WHMpress
CVE-2024-43246WordPress WHMpress plugin <= 6.2-revision-5 - Reflected Cross Site Scripting (XSS) vulnerabilitycreativeon WHMpress
CVE-2024-43215WordPress Social Slider Feed plugin <= 2.2.2 - Broken Access Control vulnerabilitycreativemotion Social Slider Feed
CVE-2024-43149WordPress CM Tooltip Glossary Plugin <= 4.3.7 - Cross Site Scripting (XSS) vulnerabilityCreativeMindsSolutions CM Tooltip Glossary
CVE-2024-43122WordPress Robin image optimizer plugin <= 1.6.9 - Broken Access Control vulnerabilityCreative Motion Robin image optimizer
CVE-2024-4158Blocksy <= 2.0.42 - Authenticated (Contributor+) Stored Cross-Site Scriptingcreativethemeshq Blocksy
CVE-2024-4086CM Tooltip Glossary – Powerful Glossary Plugin <= 4.2.11 - Cross-Site Request Forgerycreativemindssolutions CM Tooltip Glossary
CVE-2024-38777WordPress Titan Anti-spam & Security plugin <= 7.3.6 - Broken Access Control vulnerabilityCreativeMotion Titan Anti-spam & Security
CVE-2024-38719WordPress Auto Featured Image plugin <= 4.1.2 - Broken Access Control vulnerabilityCreative Motion Auto Featured Image (Auto Post Thumbnail)
CVE-2024-3747Blocksy <= 2.0.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via About Me blockcreativethemeshq Blocksy
CVE-2024-37469WordPress Blocksy theme <= 1.9.5 - Cross Site Request Forgery (CSRF) vulnerabilitycreativethemeshq Blocksy
CVE-2024-37215WordPress Transition Slider – Responsive Image Slider and Gallery plugin <= 2.20.3 - Cross Site Scripting (XSS)…creativeinteractivemedia Transition Slider – Responsive…
CVE-2024-35751WordPress Woody code snippets plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerabilityCreative Motion, Will Bontrager Software, LLC Woody ad…
CVE-2024-35633WordPress Blocksy Companion plugin <= 2.0.42 - Server Side Request Forgery (SSRF) vulnerabilityCreative Themes Blocksy Companion
CVE-2024-34806WordPress Clearfy Cache plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerabilityCreative Motion Clearfy Cache
CVE-2024-34561WordPress Real3D Flipbook PDF Viewer Lite plugin <= 3.71 - Cross Site Scripting (XSS) vulnerabilityCreative interactive media 3D FlipBook, PDF Viewer, PDF…
CVE-2024-33629WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 4.0.0 - Server Side Request Forgery (SSRF) vulnerabilityCreative Motion Auto Featured Image (Auto Post Thumbnail)
CVE-2024-32961WordPress Blocksy theme <= 2.0.33 - Cross Site Scripting (XSS) vulnerabilitycreativethemeshq Blocksy
CVE-2024-32694WordPress 3D FlipBook, PDF Viewer, PDF Embedder plugin <= 3.62 - Reflected Cross Site Scripting (XSS) vulnerabilityCreative interactive media 3D FlipBook, PDF Viewer, PDF…
CVE-2024-31932WordPress Blocksy Companion plugin <= 2.0.28 - Cross Site Request Forgery (CSRF) vulnerabilityCreativeThemes Blocksy Companion
CVE-2024-31382WordPress Blocksy theme <= 2.0.22 - Cross Site Request Forgery (CSRF) vulnerabilitycreativethemeshq Blocksy
CVE-2024-30447WordPress Creative Image Slider plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerabilityCreative Image Slider – Responsive Slider Plugin
CVE-2024-24871WordPress Blocksy theme <= 2.0.19 - Cross Site Scripting (XSS) vulnerabilitycreativethemeshq Blocksy
CVE-2024-2392Blocksy Companion <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scriptingcreativethemeshq Blocksy Companion
CVE-2024-1767Blocksy <= 2.0.26 - Authenticated (Contributor+) Stored Cross-Site Scriptingcreativethemeshq Blocksy
CVE-2024-13338Webcraftic Clearfy – WordPress optimization plugin <= 2.3.1 - Cross-Site Request Forgery to Clear Cachecreativemotion Clearfy Cache – WordPress optimization…
CVE-2024-13337Webcraftic Clearfy – WordPress optimization plugin <= 2.3.2 - Cross-Site Request Forgery to Plugin Settings Update via…creativemotion Clearfy Cache – WordPress optimization…
CVE-2024-12620AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations <= 1.4.23 - Missing Authorization to…creativeinteractivemedia AnimateGL Animations for WordPress…
CVE-2024-12164WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon <= 1.6 - Missing Authorization to Authenticated…creativewerkdesigns WPSyncSheets For WPForms – Google…
CVE-2024-11420Blocksy <= 2.0.77 - Authenticated (Contributor+) Stored Cross-Site Scriptingcreativethemeshq Blocksy
CVE-2024-11202Multiple Plugins <= (Various Versions) - Reflected Cross-Site Scripting via cminds_free_guide Shortcodecreativemindssolutions CM Tooltip Glossary
CVE-2023-53876Academy LMS 6.1 Arbitrary File Upload Vulnerability via Profile SettingsCreativeitem Academy LMS
CVE-2023-37988WordPress Contact Form Generator Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)Creative Solutions Contact Form Generator
CVE-2023-3756Creativeitem Atlas Business Directory Listing search cross site scriptingCreativeitem Atlas Business Directory Listing
CVE-2023-3755Creativeitem Atlas Business Directory Listing filter_listings cross site scriptingCreativeitem Atlas Business Directory Listing
CVE-2023-3754Creativeitem Ekushey Project Manager CRM xxxxxxxx[random-msg-hash] cross site scriptingCreativeitem Ekushey Project Manager CRM
CVE-2023-35911WordPress Contact Form Generator Plugin <= 2.6.0 is vulnerable to SQL InjectionCreative form builder for WordPress
CVE-2023-31228WordPress CM On Demand Search And Replace Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)CreativeMindsSolutions CM On Demand Search And Replace
CVE-2023-30750WordPress CM Pop-Up banners Plugin <= 1.5.10 is vulnerable to SQL InjectionCreativeMindsSolutions CM Popup Plugin for WordPress
CVE-2023-28749WordPress CM On Demand Search And Replace Plugin <= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF)CreativeMindsSolutions CM On Demand Search And Replace
CVE-2023-25992WordPress CM Answers Plugin <= 3.1.9 is vulnerable to Cross Site Scripting (XSS)CreativeMindsSolutions CM Answers
CVE-2023-23898WordPress Blocksy Companion Plugin <= 1.8.67 is vulnerable to Cross Site Scripting (XSS)CreativeThemes Blocksy Companion
CVE-2023-23758Extension - creative-solutions.net - SQLi in Creative Gallery component for Joomla <= 2.2.0creative-solutions.net Creative Gallery component for Joomla
CVE-2022-4965Invitation Code Content Restriction Plugin from CreativeMinds <= 1.5.4 - Reflected Cross-Site ScriptingCreativeMinds
130 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.