Jthemes vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Jthemes products: 13 record(s), with severity, exploitation and fixes.

xSmart 4 Genemy 3 Prestige 2 Exzo 1 Sale! Immigration law, Visa services support, Migration Agent Consulting 1 imEvent 1 Themebox - Digital Products Ecommerce 1

Exploited only (KEV) →

CVE-2025-69138 High · 8.8 CWE-266 Jun 17, 2026

WordPress Genemy theme <= 1.6.6 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Genemy <= 1.6.6 versions.

CVE-2025-69137 Medium · 6.5 CWE-862 Jun 17, 2026

WordPress Genemy theme <= 1.6.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in Genemy <= 1.6.6 versions.

CVE-2025-52747 High · 7.1 CWE-79 May 27, 2026

WordPress Themebox - Digital Products Ecommerce theme <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jthemes Themebox - Digital Products Ecommerce allows Reflected XSS. This issue affects Themebox - Digital Products Ecommerce: from n/a through 1.4.2.

CVE-2025-69393 High · 7.5 CWE-862 Feb 20, 2026

WordPress Exzo theme <= 1.2.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Jthemes Exzo exzo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Exzo: from n/a through <= 1.2.4.

CVE-2025-69330 High · 7.1 CWE-79 Feb 20, 2026

WordPress Prestige theme < 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jthemes Prestige prestige allows Reflected XSS.This issue affects Prestige: from n/a through < 1.4.1.

CVE-2025-69329 Critical · 9.8 CWE-502 Feb 20, 2026

WordPress Prestige theme < 1.4.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Jthemes Prestige prestige allows Object Injection.This issue affects Prestige: from n/a through < 1.4.1.

CVE-2025-54002 Medium · 6.5 CWE-862 Jan 22, 2026

WordPress xSmart theme <= 1.2.9.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Jthemes xSmart xsmart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects xSmart: from n/a through <= 1.2.9.4.

CVE-2025-50007 High · 8.8 CWE-266 Jan 22, 2026

WordPress xSmart theme <= 1.2.9.4 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Jthemes xSmart xsmart allows Privilege Escalation.This issue affects xSmart: from n/a through <= 1.2.9.4.

CVE-2025-50006 High · 7.1 CWE-79 Jan 22, 2026

WordPress xSmart theme <= 1.2.9.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jthemes xSmart xsmart allows Reflected XSS.This issue affects xSmart: from n/a through <= 1.2.9.4.

CVE-2025-59138 Medium · 4.9 CWE-918 Dec 31, 2025

WordPress Genemy theme <= 1.6.6 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Jthemes Genemy genemy allows Server Side Request Forgery.This issue affects Genemy: from n/a through <= 1.6.6.

CVE-2025-59134 High · 8.8 CWE-266 Dec 18, 2025

WordPress Sale! Immigration law, Visa services support, Migration Agent Consulting theme <= 1.5.8 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Jthemes Sale! Immigration law, Visa services support, Migration Agent Consulting immiex allows Privilege Escalation.This issue affects Sale! Immigration law, Visa services support, Migration Agent Consulting: from n/a through <= 1.5.8.

CVE-2025-58243 Medium · 5.3 CWE-862 Nov 6, 2025

WordPress imEvent Theme <= 3.4.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Jthemes imEvent imevent allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects imEvent: from n/a through <= 3.4.0.

CVE-2025-62936 Medium · 4.3 CWE-80 Oct 26, 2025

WordPress xSmart theme <= 1.2.9.4 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Jthemes xSmart xsmart allows Code Injection.This issue affects xSmart: from n/a through <= 1.2.9.4.