---
title: "Themeisle vulnerabilities: CVEs, CISA KEV and security advisories"
url: https://radicalnotion.ai/vendor/themeisle
type: vendor
description: "Themeisle has 136 published CVEs, 0 in CISA KEV and 15 with public exploits."
updated: 2026-11-07
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# Themeisle vulnerabilities

- **Published CVEs:** 136
- **In CISA KEV:** 0
- **With a public exploit:** 15
- **With a patch:** 135
- **Average CVSS:** 6.5
- **CVEs in the last two years:** 68
- **First CVE:** 2019-09-30
- **Latest CVE:** 2026-11-07

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 10 |
| High | 32 |
| Medium | 91 |
| Low | 3 |
| Unscored | 0 |

## Most affected products

| Product | CVEs |
| --- | --- |
| [RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator](https://radicalnotion.ai/vendor/themeisle/rss-aggregator-by-feedzy-feed-to-post-autoblogging-news-and-youtube-video-feeds-aggregator) | 17 |
| [orbit fox](https://radicalnotion.ai/vendor/themeisle/orbit-fox) | 15 |
| [Orbit Fox: Duplicate Page and 4 more models](https://radicalnotion.ai/vendor/themeisle/orbit-fox-duplicate-page-menu-icons-svg-support-cookie-notice-custom-fonts-and-more) | 14 |
| [multiple\_page\_generator](https://radicalnotion.ai/vendor/themeisle/multiple-page-generator) | 11 |
| [Multiple Page Generator Plugin – MPG](https://radicalnotion.ai/vendor/themeisle/multiple-page-generator-plugin-mpg) | 11 |
| [Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE](https://radicalnotion.ai/vendor/themeisle/otter-blocks-gutenberg-blocks-page-builder-for-gutenberg-editor-and-fse) | 11 |
| [otter\_blocks](https://radicalnotion.ai/vendor/themeisle/otter-blocks) | 10 |
| [Redirection for Contact Form 7](https://radicalnotion.ai/vendor/themeisle/redirection-for-contact-form-7) | 9 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 51 |
| [CWE-862](https://radicalnotion.ai/cwe/cwe-862) | Missing Authorization | 19 |
| [CWE-352](https://radicalnotion.ai/cwe/cwe-352) | Cross-Site Request Forgery (CSRF) | 11 |
| [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 11 |
| [CWE-918](https://radicalnotion.ai/cwe/cwe-918) | Server-Side Request Forgery (SSRF) | 8 |
| [CWE-434](https://radicalnotion.ai/cwe/cwe-434) | Unrestricted Upload of File with Dangerous Type | 5 |
| [CWE-502](https://radicalnotion.ai/cwe/cwe-502) | Deserialization of Untrusted Data | 4 |
| [CWE-284](https://radicalnotion.ai/cwe/cwe-284) | Improper Access Control | 3 |

## Assigning CNAs

| CNA | CVEs |
| --- | --- |
| [Wordfence](https://radicalnotion.ai/cna/wordfence) | 79 |
| [Patchstack](https://radicalnotion.ai/cna/patchstack) | 44 |
| [WPScan](https://radicalnotion.ai/cna/wpscan) | 9 |
| [mitre](https://radicalnotion.ai/cna/mitre) | 2 |
| [VulnCheck](https://radicalnotion.ai/cna/vulncheck) | 2 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2019 | 2 |
| 2020 | 0 |
| 2021 | 2 |
| 2022 | 2 |
| 2023 | 15 |
| 2024 | 47 |
| 2025 | 27 |
| 2026 | 41 |

## Latest CVEs

| CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-121519 | Social Slider Feed \<= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' Parameter | medium | 6.4 | 0.2% | No | 2026-11-07 |
| CVE-2026-120035 | RSS Aggregator by Feedzy \<= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Title | medium | 5.4 | 0.3% | No | 2026-11-06 |
| CVE-2026-120659 | Redirection for Contact Form 7 \<= 3.2.14 - Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy via 'wpcf7-redirect' Parameter | medium | 5.3 | 0.4% | No | 2026-11-06 |
| CVE-2026-119054 | Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url | medium | 5.1 | 0.2% | No | 2026-10-29 |
| CVE-2026-110707 | RSS Aggregator by Feedzy \<= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element | medium | 4.7 | 0.3% | No | 2026-10-29 |
| CVE-2026-109207 | RSS Aggregator by Feedzy \<= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL | high | 7.2 | 0.3% | No | 2026-10-16 |
| CVE-2026-104801 | PPOM \]\[n\]\[org\]' Parameter | critical | 9.1 | 0.8% | No | 2026-10-10 |
| CVE-2026-104735 | RSS Aggregator by Feedzy | medium | 6.4 | 0.2% | No | 2026-10-10 |
| CVE-2026-97305 | WordPress AI Chatbot for WordPress – Hyve Lite plugin \<= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability | medium | 6.9 | 0.2% | No | 2026-10-05 |
| CVE-2026-102002 | Otter Blocks \<= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget | low | 3.1 | 0.3% | No | 2026-10-02 |
| CVE-2026-62073 | WordPress WP Full Stripe Free plugin \<= 8.5.6 - Broken Access Control vulnerability | high | 7.5 | 0.2% | No | 2026-10-01 |
| CVE-2026-97302 | WordPress MPG plugin \<= 4.2.3 - Sensitive Data Exposure vulnerability | medium | 5.3 | 0.2% | No | 2026-09-30 |

## Frequently asked questions

### How many CVEs does Themeisle have?

Themeisle has 136 published CVE records since 2019, including 68 in the last two years.

### How many Themeisle CVEs are in CISA KEV?

None of Themeisle's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Which Themeisle products have the most CVEs?

The Themeisle products with the most published CVEs are RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator, orbit fox, Orbit Fox: Duplicate Page and 4 more models, multiple\_page\_generator, Multiple Page Generator Plugin – MPG.

### What are the most common weakness types in Themeisle CVEs?

Themeisle's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-862 (Missing Authorization), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')).

### Are there public exploits for Themeisle vulnerabilities?

Yes — 15 of Themeisle's CVEs have a known public exploit.

### How many critical Themeisle vulnerabilities are there?

Themeisle has 10 critical and 32 high-severity CVEs.

### What is the average severity of Themeisle CVEs?

The average CVSS base score across Themeisle's scored CVEs is 6.5.

## Related vendors

- [Centreon](https://radicalnotion.ai/vendor/centreon) (137 CVEs)
- [Snipeitapp](https://radicalnotion.ai/vendor/snipeitapp) (137 CVEs)
- [Crocoblock](https://radicalnotion.ai/vendor/crocoblock) (136 CVEs)
- [Ruijie](https://radicalnotion.ai/vendor/ruijie) (136 CVEs)
- [Tanium](https://radicalnotion.ai/vendor/tanium) (136 CVEs)
- [WebKitGTK](https://radicalnotion.ai/vendor/webkitgtk) (135 CVEs)
- [Go standard library](https://radicalnotion.ai/vendor/gostandardlibrary) (135 CVEs)
- [vLLM](https://radicalnotion.ai/vendor/vllm) (135 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/themeisle). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.