Reported vulnerability

Multiple Themes by gavias <= Various Versions - Reflected Cross-Site Scripting

Q: How do I check which product and version this report affects?

This report covers more than one product. Choose your plugin, theme or WordPress core in the version checker, then enter its installed version. Each product has its own affected ranges and fix details in the report above.

Q: Which update should I install?

Find your exact product in the report and read its fixed versions and recommended action. Fix details for one product do not apply to every product covered by this advisory. Follow the linked source when no fixed version is specified.

Q: Does an affected version mean my website has been hacked?

An affected version means the installed release matches a vulnerability described in this report. It does not show whether anyone has exploited it on your website. The checker compares version numbers with stored reports; it does not inspect your website.

Q: Does a version outside these ranges mean my website is secure?

A version outside the reported ranges is not listed as affected by this particular issue. Other vulnerabilities, missing information or a previous compromise still need separate checks. Review other reports for your product and keep your website maintained.

Published 6 Jan 2025

Updated 6 Mar 2026

CVE-2024-43334

Compare your installed software with the affected versions below. Follow the source’s remediation guidance and test an available update after taking a backup. A database entry describes a reported issue; it does not establish whether a particular website has been compromised.

Does this affect my version?

Check your installed version against this advisory. This compares the report’s version ranges and does not scan your website.

Wordfence advisory

medium · CVSS 6.1

Multiple themes by gavias for WordPress are vulnerable to Reflected Cross-Site Scripting in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Severity vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Fioxen - Directory Listing WordPress Theme

Software: theme · fioxen
Affected versions: Start version unspecified, before 1.2.5
Fix availability: Fix available
Fixed versions: 1.2.5

Recommended action

Update to version 1.2.5, or a newer patched version

Boliin - Resort & Hotel Booking WordPress Theme

Software: theme · boliin
Affected versions: Start version unspecified, before 1.1.4
Fix availability: Fix available
Fixed versions: 1.1.4

Recommended action

Update to version 1.1.4, or a newer patched version

Paroti - Nonprofit Charity WordPress Theme

Software: theme · paroti
Affected versions: Start version unspecified, through 1.2.0
Fix availability: Fix available
Fixed versions: 1.2.1

Recommended action

Update to version 1.2.1, or a newer patched version

Lestin - Directory Listing WordPress Theme

Software: theme · lestin
Affected versions: Start version unspecified, before 1.2.0
Fix availability: Fix available
Fixed versions: 1.2.0

Recommended action

Update to version 1.2.0, or a newer patched version

Conult - Consulting Business WordPress Themes

Software: theme · conult
Affected versions: Start version unspecified, before 1.2.9
Fix availability: Fix available
Fixed versions: 1.2.9

Recommended action

Update to version 1.2.9, or a newer patched version

Constix - Construction Factory & Industrial WordPress Theme

Software: theme · constix
Affected versions: Start version unspecified, before 1.0.8
Fix availability: Fix available
Fixed versions: 1.0.8

Recommended action

Update to version 1.0.8, or a newer patched version

Sominx - Creative Business Agency WordPress Theme

Software: theme · sominx
Affected versions: Start version unspecified, through 1.2.5
Fix availability: Fix available
Fixed versions: 1.2.6

Recommended action

Update to version 1.2.6, or a newer patched version

Halpes - Nonprofit Charity Drupal 10 Theme

Software: theme · halpes
Affected versions: Start version unspecified, before 1.2.5
Fix availability: Fix available
Fixed versions: 1.2.5

Recommended action

Update to version 1.2.5, or a newer patched version

Modins - Insurance & Finance Drupal 11 Theme

Software: theme · modins
Affected versions: Start version unspecified, before 1.1.9
Fix availability: Fix available
Fixed versions: 1.1.9

Recommended action

Update to version 1.1.9, or a newer patched version

Welowe - Nonprofit Charity WordPress Theme

Software: theme · welowe
Affected versions: Start version unspecified, through 1.0.8
Fix availability: Fix available
Fixed versions: 1.0.9

Recommended action

Update to version 1.0.9, or a newer patched version

Qizon - Crowdfunding & Charity WordPress Theme

Software: theme · qizon
Affected versions: Start version unspecified, through 1.1.6
Fix availability: Fix available
Fixed versions: 1.1.7

Recommended action

Update to version 1.1.7, or a newer patched version

TheFude - Crowdfunding & Charity WordPress Theme

Software: theme · fude
Affected versions: Start version unspecified, through 1.3.7
Fix availability: Fix available
Fixed versions: 1.3.8

Recommended action

Update to version 1.3.8, or a newer patched version

Aports - Single Property WordPress Theme

Software: theme · aports
Affected versions: Start version unspecified, before 1.1.3
Fix availability: Fix available
Fixed versions: 1.1.3

Recommended action

Update to version 1.1.3, or a newer patched version

Gowilds - Travel & Tour Booking WordPress Theme

Software: theme · gowilds
Affected versions: Start version unspecified, before 1.1.9
Fix availability: Fix available
Fixed versions: 1.1.9

Recommended action

Update to version 1.1.9, or a newer patched version

Qempo - Digital Agency Services WordPress Theme

Software: theme · qempo
Affected versions: Start version unspecified, through 1.2.6
Fix availability: No fix reported
Fixed versions: No fixed version specified

Recommended action

No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.

Pisole - Digital Creative Agency WordPress Theme

Software: theme · pisole
Affected versions: Start version unspecified, before 1.1.0
Fix availability: Fix available
Fixed versions: 1.1.0

Recommended action

Update to version 1.1.0, or a newer patched version

Orgarium - Agriculture & Organic Farm WordPress Theme

Software: theme · orgarium
Affected versions: Start version unspecified, before 1.1.9
Fix availability: Fix available
Fixed versions: 1.1.9

Recommended action

Update to version 1.1.9, or a newer patched version

Tevily - Travel & Tour Booking WordPress Theme

Software: theme · tevily
Affected versions: Start version unspecified, before 1.3.0
Fix availability: Fix available
Fixed versions: 1.3.0

Recommended action

Update to version 1.3.0, or a newer patched version

Zilom - Online Education Learning WordPress Theme

Software: theme · zilom
Affected versions: Start version unspecified, before 1.4.5
Fix availability: Fix available
Fixed versions: 1.4.5

Recommended action

Update to version 1.4.5, or a newer patched version

Further references (1)

wordfence.com/threat-intel/vulnerabilities/id/7f25f001-cbb7-4d73-b37d-47bc1681c690?source=api-prod

Data sources and licences

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Read licence terms

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Read licence terms

Source: Wordfence

Need help fixing this issue?

Get help checking your site, applying an available update and resolving any problems after updating.

Get help with this issue

Questions about this vulnerability

How do I check which product and version this report affects?

This report covers more than one product. Choose your plugin, theme or WordPress core in the version checker, then enter its installed version. Each product has its own affected ranges and fix details in the report above.

Which update should I install?

Find your exact product in the report and read its fixed versions and recommended action. Fix details for one product do not apply to every product covered by this advisory. Follow the linked source when no fixed version is specified.

Does an affected version mean my website has been hacked?

An affected version means the installed release matches a vulnerability described in this report. It does not show whether anyone has exploited it on your website. The checker compares version numbers with stored reports; it does not inspect your website.

Does a version outside these ranges mean my website is secure?

A version outside the reported ranges is not listed as affected by this particular issue. Other vulnerabilities, missing information or a previous compromise still need separate checks. Review other reports for your product and keep your website maintained.

Back to vulnerability database