CVEs we hold for Themify

Records whose assigning authority named Themify as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-78172Themify – WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site Scriptingthemifyme Themify – WooCommerce Product Filter

CVE-2026-75027Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via…themifyme Themify Builder

CVE-2026-57369WordPress Themify Builder plugin <= 7.7.4 - Cross Site Scripting (XSS) vulnerabilitythemifyme Themify Builder

CVE-2026-56037WordPress Themify Popup plugin <= 1.4.3 - PHP Object Injection vulnerabilityThemify Popup

CVE-2026-32449WordPress Themify Event Post plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerabilitythemifyme Themify Event Post

CVE-2026-15407Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete…themifyme Themify Builder

CVE-2026-15097Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'height_slider' Slider Module…themifyme Themify Builder

CVE-2026-15096Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Fieldthemifyme Themify Builder

CVE-2026-1032Conditional Menus <= 1.2.6 - Cross-Site Request Forgery to Menu Options Updatethemifyme Conditional Menus

CVE-2025-9353Themify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingthemifyme Themify Builder

CVE-2025-67533WordPress Themify Portfolio Post plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilitythemifyme Themify Portfolio Post

CVE-2025-58787WordPress Themify Popup Plugin <= 1.4.2 - Cross Site Scripting (XSS) Vulnerabilitythemifyme Themify Popup

CVE-2025-49396WordPress Themify Builder Plugin <= 7.6.7 - Broken Access Control Vulnerabilitythemifyme Themify Builder

CVE-2025-49395WordPress Themify Icons Plugin <= 2.0.3 - Cross Site Scripting (XSS) Vulnerabilitythemifyme Themify Icons

CVE-2025-49392WordPress Themify Audio Dock Plugin <= 2.0.5 - Cross Site Scripting (XSS) Vulnerabilitythemifyme Themify Audio Dock

CVE-2025-39581WordPress Themify Shortcodes plugin <= 2.1.3 - Cross Site Scripting (XSS) Vulnerabilitythemifyme Themify Shortcodes

CVE-2025-31048WordPress Shopo <= 1.1.4 - Arbitrary File Upload VulnerabilityThemify Shopo

CVE-2025-31047WordPress Themify Edmin theme <= 2.0.0 - PHP Object Injection VulnerabilityThemify Edmin

CVE-2025-31013WordPress Themify Folo theme <= 1.9.6 - Reflected Cross Site Scripting (XSS) vulnerabilityThemify Folo

CVE-2025-30996Arbitrary File Upload Vulnerability in WordPress themes by ThemifyThemify Slide

CVE-2025-30832WordPress Themify Event Post Plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilitythemifyme Themify Event Post

CVE-2025-30831WordPress Themify Event Post Plugin <= 1.3.2 - Local File Inclusion vulnerabilitythemifyme Themify Event Post

CVE-2024-9385Themify Builder <= 7.6.2 - Reflected Cross-Site Scriptingthemifyme Themify Builder

CVE-2024-7836Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplicationthemifyme Themify Builder

CVE-2024-6027Themify - WooCommerce Product Filter <= 1.4.9 - Unauthenticated SQL Injection via conditions Parameterthemifyme Themify – WooCommerce Product Filter

CVE-2024-56239WordPress Themify Audio Dock plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerabilitythemifyme Themify Audio Dock

CVE-2024-56216WordPress Themify Builder plugin <= 7.6.3 - Local File Inclusion vulnerabilitythemifyme Themify Builder

CVE-2024-52423WordPress Themify Builder plugin <= 7.6.5 - Cross Site Scripting (XSS) vulnerabilitythemifyme Themify Builder

CVE-2024-4567Themify Shortcodes <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify_button Shortcodethemifyme Themify Shortcodes

CVE-2024-44046WordPress Themify plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilitythemifyme Themify – WooCommerce Product Filter

CVE-2024-43133WordPress Themify Shortcodes plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabilityThemify Shortcodes

CVE-2024-31366WordPress Post Type Builder (PTB) plugin <= 2.0.8 - Auth. Arbitrary Post/Page Creation vulnerabilityThemify Post Type Builder (PTB)

CVE-2024-31365WordPress Post Type Builder (PTB) plugin < 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityThemify Post Type Builder (PTB)

CVE-2024-30440WordPress Themify Event Post plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityThemify Event Post

CVE-2024-3032Themify Builder < 7.5.8 - Open RedirectUnknown Themify Builder

CVE-2024-2732Themify Shortcodes <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scriptingthemifyme Themify Shortcodes

CVE-2024-24872WordPress Themify Builder Plugin <= 7.0.5 is vulnerable to Cross Site Request Forgery (CSRF)Themify Builder

CVE-2024-2278WooCommerce Product Filter < 1.4.4 - Admin+ Stored XSSUnknown Themify

CVE-2024-2263WooCommerce Product Filter < 1.4.4 - Reflected XSSUnknown Themify

CVE-2024-2262WooCommerce Product Filter < 1.4.4 - Filter Deletion via CSRFUnknown Themify

CVE-2024-13319Themify Builder <= 7.6.5 - Reflected Cross-Site Scriptingthemifyme Themify Builder

CVE-2024-12414Themify Store Locator <= 1.1.9 - Cross-Site Request Forgerythemifyme Themify Store Locator

CVE-2023-51693WordPress Themify Icons Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS)Themify Icons

CVE-2023-46149WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to Arbitrary File UploadThemify Ultra

CVE-2023-46148WordPress Themify Ultra theme <= 7.3.5 - Authenticated Arbitrary Settings Change vulnerabilityThemify Ultra

CVE-2023-46147WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to PHP Object InjectionThemify Ultra

CVE-2023-46146WordPress Themify Ultra theme <= 7.3.5 - Multiple Broken Access Control vulnerabilityThemify Ultra

CVE-2023-46145WordPress Themify Ultra theme <= 7.3.5 - Authenticated Privilege Escalation vulnerabilityThemify Ultra

CVE-2023-0362Themify Portfolio Post < 1.2.2 - Contributor+ Stored XSSUnknown Themify Portfolio Post

CVE-2022-4787Themify Shortcodes < 2.0.8 - Contributor+ Stored XSS via ShortcodeUnknown Themify Shortcodes

CVE-2022-4464Themify Portfolio Post < 1.2.1 - Contributor+ Stored XSSUnknown Themify Portfolio Post

CVE-2022-32970WordPress Themify Portfolio Post Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)Themify Portfolio Post

CVE-2022-1532Themify - WooCommerce Product Filter < 1.3.8 - Reflected Cross-Site ScriptingUnknown Themify – WooCommerce Product Filter

CVE-2022-1047Themify - Post Type Builder Search Addon < 1.4.0 - Reflected Cross-Site ScriptingUnknown themify-ptb-search

CVE-2022-0200Themify Portfolio Post < 1.1.7 - Reflected Cross-Site ScriptingUnknown Themify Portfolio Post

CVE-2021-24129Themify Portfolio Post < 1.1.6 - Authenticated Stored Cross-Site ScriptingUnknown Themify Portfolio Post

56 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.