Skip to content
Sign in
5.3 Medium

CVE-2024-1047 Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of…

Description

Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.

Affected products and versions

Product Affected versions Fixed in
Orbit Fox by ThemeIsle 2.10 earliest → 2.10.28 No fix stated
Menu Icons by ThemeIsle 0.13 earliest → 0.13.8 No fix stated
Starter Sites & Templates by Neve 1.2 earliest → 1.2.6 No fix stated
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE 2.6 earliest → 2.6.2 No fix stated
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder 2.6 earliest → 2.6.9 No fix stated
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More 2.10 earliest → 2.10.28 No fix stated
Multiple Page Generator Plugin – MPG 3.4 earliest → 3.4.0 No fix stated
Visualizer: Tables and Charts Manager for WordPress 3.10 earliest → 3.10.6 No fix stated
Optimole – Optimize Images in Real Time 3.12 earliest → 3.12.4 No fix stated
Show the 4 other branches
Product Affected versions Fixed in
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator 4.4 earliest → 4.4.1 No fix stated
Super Page Cache 4.7 earliest → 4.7.5 No fix stated
Revive Social – Social Media Auto Post and Scheduling Automation Plugin 9.0 earliest → 9.0.25 No fix stated
PPOM – Product Addons & Custom Fields for WooCommerce 32.0 earliest → 32.0.9 No fix stated

Other CVEs of Orbit Fox by ThemeIsle

The 15 CVEs of Orbit Fox by ThemeIsle →
CVE-2026-65563 Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions 5.9 Medium CVE-2025-58593 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit… 6.5 Medium CVE-2025-22659 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit… 6.5 Medium CVE-2024-13183 The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_tag’… 6.4 Medium
Track this CVE