Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Feedzy Rss Feeds Plugin | — | Update feedzy-rss-feeds plugin to version 4.4.2, or a newer patched version | May 15, 2025 | Feb 1, 2024 |
| Menu Icons Plugin | — | Update menu-icons plugin to version 0.13.9, or a newer patched version | May 15, 2025 | Feb 1, 2024 |
| Multiple Pages Generator By Porthas Plugin | — | Update multiple-pages-generator-by-porthas plugin to version 3.4.1, or a newer patched version | May 15, 2025 | Feb 1, 2024 |
| Optimole Wp Plugin | — | Update optimole-wp plugin to version 3.12.5, or a newer patched version | May 15, 2025 | Feb 1, 2024 |
| Otter Blocks Plugin | — | Update otter-blocks plugin to version 2.6.3, or a newer patched version | May 15, 2025 | Feb 1, 2024 |
| Templates Patterns Collection Plugin | — | Update templates-patterns-collection plugin to version 1.2.7, or a newer patched version | May 15, 2025 | Feb 1, 2024 |
| Themeisle Companion Plugin | — | Update themeisle-companion plugin to version 2.10.29, or a newer patched version | May 15, 2025 | Feb 1, 2024 |
| Tweet Old Post Plugin | — | Update tweet-old-post plugin to version 9.0.26, or a newer patched version | May 15, 2025 | Feb 1, 2024 |
| Visualizer Plugin | — | Update visualizer plugin to version 3.10.7, or a newer patched version | May 15, 2025 | Feb 1, 2024 |
| Woocommerce Product Addon Plugin | — | Update woocommerce-product-addon plugin to version 32.0.10, or a newer patched version | May 15, 2025 | Feb 1, 2024 |
| Wp Cloudflare Page Cache Plugin | — | Update wp-cloudflare-page-cache plugin to version 4.7.6, or a newer patched version | May 15, 2025 | Feb 1, 2024 |
| Wp Maintenance Mode Plugin | — | Update wp-maintenance-mode plugin to version 2.6.10, or a newer patched version | May 15, 2025 | Feb 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub