CVEs we hold for Extendthemes
Records whose assigning authority named Extendthemes as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-5427Kubio AI Page Builder <= 2.7.2 - Missing Authorization to Authenticated (Contributor+) Limited File Upload via Kubio…extendthemes Kubio AI Page Builder
CVE-2026-16779Kubio AI Page Builder <= 2.8.5 - Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template…extendthemes Kubio AI Page Builder
CVE-2026-14472Kubio AI Page Builder <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block…extendthemes Kubio AI Page Builder
CVE-2025-9560Colibri Page Builder <= 1.0.334 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_newsletter…extendthemes Colibri Page Builder
CVE-2025-8487Kubio AI Page Builder <= 2.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installationextendthemes Kubio AI Page Builder
CVE-2025-62751WordPress Vireo theme <= 1.0.24 - Broken Access Control vulnerabilityextendthemes Vireo
CVE-2025-2294Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusionextendthemes Kubio AI Page Builder
CVE-2025-11747Colibri Page Builder <= 1.0.345 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeextendthemes Colibri Page Builder
CVE-2025-11376Colibri Page Builder <= 1.0.335 - Authenticated (Contributor+) Stored Cross-Site Scriptingextendthemes Colibri Page Builder
CVE-2024-5038Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeextendthemes Colibri Page Builder
CVE-2024-5020Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via…extendthemes Colibri Page Builder; smub Envira Gallery –…
CVE-2024-4451Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_video_player…extendthemes Colibri Page Builder
CVE-2024-39661WordPress Kubio AI Page Builder plugin <= 2.2.4 - Authenticated Cross Site Scripting (XSS) vulnerabilityExtendThemes Kubio AI Page Builder
CVE-2024-37458WordPress Highlight theme <= 1.0.29 - Cross Site Request Forgery (CSRF) vulnerabilityextendthemes Highlight
CVE-2024-37431WordPress Mesmerize theme <= 1.6.120 - Cross Site Request Forgery (CSRF) vulnerabilityextendthemes Mesmerize
CVE-2024-3340Colibri Page Builder <= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via…extendthemes Colibri Page Builder
CVE-2024-3338Colibri Page Builder <= 1.0.262 - Authenticated (Author+) Stored Cross-Site Scriptingextendthemes Colibri Page Builder
CVE-2024-3337Colibri Page Builder <= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via…extendthemes Colibri Page Builder
CVE-2024-2839Colibri Page Builder <= 1.0.263 - Authenticated (Contributor+) Stored Cross-Site Scriptingextendthemes Colibri Page Builder
CVE-2024-28004WordPress Colibri Page Builder plugin <= 1.0.248 - Broken Access Control vulnerabilityExtendThemes Colibri Page Builder
CVE-2024-1870Colibri Page Builder <= 1.0.260 - Missing Authorizationextendthemes Colibri Page Builder
CVE-2024-1362Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via cp_shortcode_refreshextendthemes Colibri Page Builder
CVE-2024-1361Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via extend_builderextendthemes Colibri Page Builder
CVE-2024-1360Colibri WP <= 1.0.94 - Cross-Site Request Forgery to Limited Plugin Installationextendthemes Colibri WP
CVE-2024-13516Kubio AI Page Builder <= 2.3.5 - Reflected Cross-Site Scriptingextendthemes Kubio AI Page Builder
CVE-2023-6988Colibri Page Builder <= 1.0.239 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeextendthemes Colibri Page Builder
CVE-2023-50833WordPress Colibri Page Builder Plugin <= 1.0.239 is vulnerable to Cross Site Scripting (XSS)ExtendThemes Colibri Page Builder
CVE-2023-3204Materialis <= 1.1.24 - Missing Authorization to Limited Arbitrary Options Updateextendthemes Materialis
CVE-2023-2188Colibri Page Builder <= 1.0.227 - Authenticated (Administrator+) SQL Injection via post_idextendthemes Colibri Page Builder
CVE-2019-25142Mesmerize <= 1.6.89 & Materialis <= 1.0.172 - Authenticated Arbitrary Options Updateextendthemes Mesmerize
30 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.