Vendor

    ExtendThemes

    42 known vulnerabilities in products by ExtendThemes, 0 of them actively exploited (CISA KEV).

    Key figures

    42

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    1

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in ExtendThemes
    CriticalCVE-2025-2294

    Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion

    		9.8
    HighCVE-2019-25142

    Mesmerize <= 1.6.89 & Materialis <= 1.0.172 - Authenticated Arbitrary Options Update

    		8.8
    HighCVE-2026-107758

    Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments

    		7.2
    HighCVE-2026-100107

    ExtendThemes Kubio AI Page Builder: Cross-site Scripting

    		7.2
    HighCVE-2023-2188

    Colibri Page Builder <= 1.0.227 - Authenticated (Administrator+) SQL Injection via post_id

    		7.2
    MediumCVE-2026-14472

    ExtendThemes Kubio AI Page Builder: Cross-site Scripting

    		6.4
    MediumCVE-2026-115816

    ExtendThemes Kubio AI Page Builder: Cross-site Scripting

    		6.4
    MediumCVE-2026-5427

    ExtendThemes Kubio AI Page Builder: Missing Authorization

    		5.3
    MediumCVE-2026-109191

    Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML

    		4.3
    MediumCVE-2026-16779

    ExtendThemes Kubio AI Page Builder: Missing Authorization

    		4.3
    MediumCVE-2025-32185

    WordPress Colibri Page Builder plugin <= 1.0.329 - Cross Site Scripting (XSS) vulnerability

    also in 1 other product

    		6.5
    MediumCVE-2024-5020

    ExtendThemes Colibri Page Builder: Cross-site Scripting

    also in 12 other products

    		6.4
    MediumCVE-2022-4762

    Materialis Companion < 1.3.40 - Contributor+ Stored XSS via Shortcode

    		5.4
    MediumCVE-2025-11747

    ExtendThemes Colibri Page Builder: Cross-site Scripting

    		6.4
    MediumCVE-2024-3337

    ExtendThemes Colibri Page Builder: Cross-site Scripting

    		6.4
    MediumCVE-2022-4481

    Mesmerize Companion < 1.6.135 - Contributor+ Stored XSS

    		5.4
    MediumCVE-2025-11376

    Colibri Page Builder <= 1.0.335 - Authenticated (Contributor+) Stored Cross-Site Scripting

    		6.4
    MediumCVE-2023-3204

    Materialis <= 1.1.24 - Missing Authorization to Limited Arbitrary Options Update

    		6.5
    MediumCVE-2025-9560

    ExtendThemes Colibri Page Builder: Cross-site Scripting

    		6.4
    MediumCVE-2024-3340

    ExtendThemes Colibri Page Builder: Cross-site Scripting

    		5.4
    MediumCVE-2023-50833

    WordPress Colibri Page Builder Plugin <= 1.0.239 is vulnerable to Cross Site Scripting (XSS)

    		6.5
    MediumCVE-2023-6988

    ExtendThemes Colibri Page Builder: Cross-site Scripting

    		6.4
    MediumCVE-2024-5038

    ExtendThemes Colibri Page Builder: Cross-site Scripting

    		6.4
    MediumCVE-2024-4707

    Horearadu Materialis Companion: Cross-site Scripting

    		6.4
    MediumCVE-2025-59593

    WordPress Colibri Page Builder Plugin < 1.0.334 - Cross Site Scripting (XSS) Vulnerability

    also in 1 other product

    		5.9

    All vulnerabilities in search

    Products

    Products by ExtendThemes
    Colibri Page Builder330
    Kubio AI Page Builder90