Exposição de Bold Themes
WordPress themes78
score de exposição
3.519
sites usam
0
em exploração
11
críticos
Análise Vexday
Com 53 CVEs catalogadas, os produtos da Bold Themes acumulam um histórico relevante de vulnerabilidades, sendo 11 delas classificadas como críticas — volume que merece atenção em ambientes de produção. A taxa de exploração ativa está abaixo da média geral do catálogo CISA KEV, sem registros confirmados de exploração em larga escala no momento. No entanto, o CVE mais perigoso identificado, CVE-2021-24321, apresenta um score EPSS de aproximadamente 0,67, indicando probabilidade relativamente elevada de exploração real, o que justifica priorização no processo de remediação. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão que sugere controles insuficientes de sanitização de entrada e saída nos temas analisados.
CVEs
53 resultadosCVE-2024-1157MEDIUMBold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URLEPSS 0.4%CVE-2024-53801MEDIUMWordPress Bold Page Builder plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-1159MEDIUMBold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Raw ContentEPSS 0.4%CVE-2024-1160MEDIUMBold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon LinkEPSS 0.4%CVE-2025-67997CRITICALWordPress Travelicious theme < 1.6.7 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2025-67996CRITICALWordPress Nestin theme < 1.2.6 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2025-68541CRITICALWordPress Ippsum theme <= 1.2.0 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2025-52724CRITICALWordPress Amwerk theme <= 1.2.0 - PHP Object Injection VulnerabilityEPSS 0.4%CVE-2025-5286MEDIUMBold Builder <= 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings ParameterEPSS 0.3%CVE-2025-64233CRITICALWordPress Codiqa theme < 1.2.8 - PHP Object Injection vulnerabilityEPSS 0.3%CVE-2024-47298MEDIUMWordPress Bold Page Builder plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-30442MEDIUMWordPress Bold Page Builder plugin <= 4.8.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-45110MEDIUMWordPress Bold Timeline Lite plugin <= 1.1.9 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-27369HIGHWordPress Celeste theme <= 1.3.6 - PHP Object Injection vulnerabilityEPSS 0.3%CVE-2024-5647MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript LibraryEPSS 0.3%CVE-2025-47525MEDIUMWordPress Bold Page Builder plugin <= 5.3.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-47391MEDIUMWordPress Bold Page Builder plugin < 5.1.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-52417HIGHWordPress ReConstruction theme <= 1.4.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-14032MEDIUMBold Timeline Lite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Parameter in 'bold_timeline_group' ShortcodeEPSS 0.3%CVE-2025-47488MEDIUMWordPress Bold Page Builder plugin <= 5.3.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%