BdThemes
- Total products in the ecosystem
- 24
- Total vulnerabilities (90 days)
- 14
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, BdThemes recorded 14 security vulnerabilities in the last 90 days across 13 products, including 4 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Element Pack Elementor Addons had the most security vulnerabilities in the BdThemes ecosystem, with 5 vulnerabilities—approximately 35.71% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-119502WordPress Ultimate Store Kit Elementor Addons plugin <= 4.0.1 - Broken Access Control vulnerabilityCVE-2026-119501WordPress Element Pack Elementor Addons plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-111111Prime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-EscapeCVE-2026-109691WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-108478WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-119502WordPress Ultimate Store Kit Elementor Addons plugin <= 4.0.1 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes |
| Affected productUltimate Store Kit Elementor Addons |
| Published11/07/2026 |
| SeverityMedium |
CVE-2026-119501WordPress Element Pack Elementor Addons plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productElement Pack Elementor Addons | Published11/07/2026 | SeverityMedium |
|---|
CVE-2026-111111Prime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape | Exploitation statusNot exploited | FixYes | Affected productPrime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons | Published10/28/2026 | SeverityHigh |
|---|
CVE-2026-109691WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productPrime Slider – Addons For Elementor | Published10/13/2026 | SeverityMedium |
|---|
CVE-2026-108478WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productElement Pack Elementor Addons | Published10/12/2026 | SeverityMedium |
|---|
CVE-2026-105886WordPress Ultimate Post Kit plugin <= 4.5.5 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productUltimate Post Kit | Published10/08/2026 | SeverityMedium |
|---|
CVE-2026-105875WordPress Prime Slider – Addons For Elementor plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productPrime Slider – Addons For Elementor | Published10/07/2026 | SeverityMedium |
|---|
CVE-2026-105873WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productElement Pack Elementor Addons | Published10/07/2026 | SeverityMedium |
|---|
CVE-2026-105871WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productElement Pack Elementor Addons | Published10/07/2026 | SeverityMedium |
|---|
CVE-2026-93527WordPress Live Copy Paste for Elementor plugin <= 1.5.10 - SQL Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productLive Copy Paste for Elementor | Published09/23/2026 | SeverityHigh |
|---|
CVE-2026-92991Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API | Exploitation statusNot exploited | FixYes | Affected productElement Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons | Published09/18/2026 | SeverityMedium |
|---|
CVE-2026-66574WordPress Element Pack Elementor Addons plugin <= 8.8.3 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productElement Pack Elementor Addons | Published09/17/2026 | SeverityMedium |
|---|
CVE-2026-78657SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field | Exploitation statusNot exploited | FixYes | Affected productSigmaForms Pro – AI Generated Forms | Published09/02/2026 | SeverityCritical |
|---|
CVE-2026-14494Sigma Forms Pro <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field | Exploitation statusNot exploited | FixYes | Affected productSigmaForms Pro – AI Generated Forms | Published08/29/2026 | SeverityCritical |
|---|
CVE-2026-65502WordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability | Exploitation statusNot exploited | FixYes | Affected productElement Pack Elementor Addons | Published08/06/2026 | SeverityMedium |
|---|
CVE-2026-25403WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productUltimate Store Kit Elementor Addons | Published08/06/2026 | SeverityMedium |
|---|
CVE-2026-0673Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection | Exploitation statusNot exploited | FixYes | Affected productElement Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons | Published08/06/2026 | SeverityMedium |
|---|
CVE-2026-65505WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Data Exposure vulnerability | Exploitation statusNot exploited | FixYes | Affected productUltimate Store Kit Elementor Addons | Published07/23/2026 | SeverityMedium |
|---|
CVE-2026-65503WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productUltimate Store Kit Elementor Addons | Published07/23/2026 | SeverityMedium |
|---|
CVE-2026-57413WordPress Instant Image Generator plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability | Exploitation statusNot exploited | FixYes | Affected productInstant Image Generator | Published07/13/2026 | SeverityMedium |
|---|
CVE-2025-63079WordPress Live Copy Paste for Elementor plugin <= 1.5.3 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productLive Copy Paste for Elementor | Published06/26/2026 | SeverityMedium |
|---|
CVE-2026-52705WordPress SigmaForms Pro – AI Generated Forms plugin <= 1.4.5 - Arbitrary File Upload vulnerability | Exploitation statusNot exploited | FixYes | Affected productSigmaForms Pro – AI Generated Forms | Published06/17/2026 | SeverityCritical |
|---|
CVE-2026-40721WordPress Element Pack Pro plugin <= 9.0.6 - Local File Inclusion vulnerability | Exploitation statusNot exploited | FixYes | Affected productElement Pack Pro | Published06/17/2026 | SeverityHigh |
|---|
CVE-2026-40745WordPress Element Pack Elementor Addons plugin <= 8.4.2 - SQL Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productElement Pack Elementor Addons | Published04/15/2026 | SeverityHigh |
|---|
CVE-2026-4655Element Pack Addons for Elementor <= 8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG Image Widget | Exploitation statusNot exploited | FixYes | Affected productElement Pack – Widgets, Templates & Addons for Elementor | Published04/08/2026 | SeverityMedium |
|---|
CVE-2026-4341Prime Slider <= 4.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'follow_us_text' Parameter | Exploitation statusNot exploited | FixYes | Affected productPrime Slider – Addons For Elementor | Published04/08/2026 | SeverityMedium |
|---|
CVE-2026-24362WordPress Ultimate Post Kit plugin <= 4.0.21 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productUltimate Post Kit | Published03/25/2026 | SeverityMedium |
|---|
CVE-2026-1793Element Pack Addons for Elementor <= 8.3.17 - Authenticated (Contributor+) Arbitrary File Read | Exploitation statusNot exploited | FixYes | Affected productElement Pack – Widgets, Templates & Addons for Elementor | Published02/15/2026 | SeverityMedium |
|---|
CVE-2025-31413WordPress Element Pack Elementor Addons plugin <= 8.3.13 - Cross Site Request Forgery (CSRF) vulnerability | Exploitation statusNot exploited | FixYes | Affected productElement Pack Elementor Addons | Published01/22/2026 | SeverityMedium |
|---|
CVE-2026-0808Spin Wheel <= 2.1.0 - Unauthenticated Client-Side Prize Manipulation via 'prize_index' Parameter | Exploitation statusNot exploited | FixYes | Affected productSpin Wheel – Interactive spinning wheel that offers coupons | Published01/17/2026 | SeverityMedium |
|---|
CVE-2025-69336WordPress Ultimate Store Kit Elementor Addons plugin <= 2.9.4 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productUltimate Store Kit Elementor Addons | Published01/06/2026 | SeverityMedium |
|---|
CVE-2025-68500WordPress Prime Slider – Addons For Elementor plugin <= 4.0.10 - Server Side Request Forgery (SSRF) vulnerability | Exploitation statusNot exploited | FixYes | Affected productPrime Slider – Addons For Elementor | Published12/24/2025 | SeverityMedium |
|---|
CVE-2025-14277Prime Slider – Addons for Elementor <= 4.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery | Exploitation statusNot exploited | FixYes | Affected productPrime Slider – Addons For Elementor | Published12/18/2025 | SeverityMedium |
|---|
CVE-2025-13196Element Pack Addons for Elementor <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widget | Exploitation statusNot exploited | FixYes | Affected productElement Pack – Widgets, Templates & Addons for Elementor | Published11/18/2025 | SeverityMedium |
|---|
CVE-2025-12134ZoloBlocks <= 2.3.11 - Missing Authorization to Unauthenticated Popup Enable/Disable | Exploitation statusNot exploited | FixYes | Affected productZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns | Published10/24/2025 | SeverityMedium |
|---|
CVE-2025-49903WordPress ZoloBlocks plugin <= 2.3.11 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productZoloBlocks | Published10/22/2025 | SeverityMedium |
|---|
CVE-2025-11536Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery | Exploitation statusNot exploited | FixYes | Affected productElement Pack – Widgets, Templates & Addons for Elementor | Published10/20/2025 | SeverityMedium |
|---|
CVE-2025-9075ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns <= 2.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting | Exploitation statusNot exploited | FixYes | Affected productZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns | Published10/01/2025 | SeverityMedium |
|---|
CVE-2025-60161WordPress ZoloBlocks Plugin <= 2.3.11 - Server Side Request Forgery (SSRF) Vulnerability | Exploitation statusNot exploited | FixYes | Affected productZoloBlocks | Published09/26/2025 | SeverityMedium |
|---|
CVE-2025-58230WordPress ZoloBlocks plugin <= 2.3.12 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productZoloBlocks | Published09/22/2025 | SeverityMedium |
|---|
CVE-2025-58017WordPress Ultimate Store Kit Elementor Addons plugin <= 2.8.6 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productUltimate Store Kit Elementor Addons | Published09/22/2025 | SeverityMedium |
|---|
CVE-2025-53210WordPress ZoloBlocks Plugin <= 2.3.2 - Local File Inclusion Vulnerability | Exploitation statusNot exploited | FixYes | Affected productZoloBlocks | Published08/20/2025 | SeverityHigh |
|---|
CVE-2025-8100Element Pack Elementor Addons and Templates <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map Widget Marker Content | Exploitation statusNot exploited | FixYes | Affected productElement Pack – Widgets, Templates & Addons for Elementor | Published08/06/2025 | SeverityMedium |
|---|
CVE-2025-7644Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting | Exploitation statusNot exploited | FixYes | Affected productPixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery | Published07/22/2025 | SeverityMedium |
|---|
CVE-2025-5944Element Pack Addons for Elementor <= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute | Exploitation statusNot exploited | FixNo | Affected productElement Pack Elementor Addons and Templates | Published07/03/2025 | SeverityMedium |
|---|
CVE-2025-46258WordPress Element Pack Pro Plugin < 8.0.0 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productElement Pack Pro | Published06/05/2025 | SeverityMedium |
|---|
CVE-2025-46257WordPress Element Pack Pro Plugin < 8.0.0 - Cross Site Request Forgery (CSRF) vulnerability | Exploitation statusNot exploited | FixYes | Affected productElement Pack Pro | Published06/05/2025 | SeverityMedium |
|---|
CVE-2025-5292Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder <= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting | Exploitation statusNot exploited | FixYes | Affected productElement Pack – Widgets, Templates & Addons for Elementor | Published05/31/2025 | SeverityMedium |
|---|
CVE-2025-2168Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 2.4.1 - Cross-Site Request Forgery to Limited User Meta Update | Exploitation statusNot exploited | FixYes | Affected productUltimate Store Kit – Addon For WooCommerce, EDD and Elementor | Published05/01/2025 | SeverityMedium |
|---|
CVE-2025-1458Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site Scripting | Exploitation statusNot exploited | FixYes | Affected productElement Pack – Widgets, Templates & Addons for Elementor | Published04/26/2025 | SeverityMedium |
|---|
104 Results | Page 1 of 3