WordPress plugin
BoomBox Theme Extensions security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 2 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High2
- Medium0
- Low0
All BoomBox Theme Extensions vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.8 | Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_password ≤1.8.0Update to 1.8.1 | CVE-2024-12295 | |
| High8.8 | Authenticated (Contributor+) Local File Inclusion via Shortcode ≤1.8.0Update to 1.8.1 | CVE-2024-12859 |
- High8.8Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_password
≤1.8.0Update to 1.8.1
- High8.8Authenticated (Contributor+) Local File Inclusion via Shortcode
≤1.8.0Update to 1.8.1
BoomBox Theme Extensions: common questions
Does BoomBox Theme Extensions have known vulnerabilities?
Yes. VulnCrest Radar lists 2 known vulnerabilities in BoomBox Theme Extensions: 2 high. None are known to affect version null.
How do I check which version of BoomBox Theme Extensions I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent BoomBox Theme Extensions vulnerability?
CVE-2024-12295, published Mar 18, 2025: BoomBox Theme Extensions <= 1.8.0 - Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_password. Severity: High (CVSS 8.8).
Is any BoomBox Theme Extensions vulnerability listed in CISA KEV?
No. None of the known BoomBox Theme Extensions vulnerabilities is currently listed in the CISA KEV catalog.