MyThemeShop vulnerabilities
Published CVEs affecting MyThemeShop products: 3 record(s), with severity, exploitation and fixes.
CVE-2026-66646
Medium · 6.5
CWE-79 Aug 18, 2026
WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.
CVE-2026-9635
Medium · 6.4
CWE-79 Jul 23, 2026
WP Shortcode by MyThemeShop <= 1.4.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the [tab] shortcode in versions up to, and including, 1.4.17. This is due to insufficient input sanitization and output escaping in the mts_tabs() function, which outputs the title shortcode attribute directly into the HTML output between anchor tags without applying any escaping functions. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-24522
Medium · 4.3
CWE-862 Jan 23, 2026
WordPress WP Subscribe plugin <= 1.2.16 - Broken Access Control vulnerability
Missing Authorization vulnerability in MyThemeShop WP Subscribe wp-subscribe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Subscribe: from n/a through <= 1.2.16.