Themepul vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Themepul products: 2 record(s), with severity, exploitation and fixes.

TopperPack – Complete Elementor Addons, Theme & CPT Builder 1 Purchase Button For Affiliate Link 1

Exploited only (KEV) →

CVE-2026-1073 Medium · 4.3 CWE-352 Mar 7, 2026

Purchase Button For Affiliate Link <= 1.0.2 - Cross-Site Request Forgery to Settings Update

The Purchase Button For Affiliate Link plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing nonce validation on the settings page form handler in `inc/purchase-btn-options-page.php`. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVE-2025-68841 High · 7.5 CWE-98 Feb 20, 2026

WordPress TopperPack – Complete Elementor Addons, theme & CPT Builder plugin <= 1.2.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themepul TopperPack – Complete Elementor Addons, Theme & CPT Builder topper-pack allows PHP Local File Inclusion.This issue affects TopperPack – Complete Elementor Addons, Theme & CPT Builder: from n/a through <= 1.2.1.