Weaver Xtreme Theme Support
Weaver Xtreme Theme Support has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2024; all 3 are fixed as of September 2026. Their average CVSS score is 6.7, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2023 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (67%). Other recurring categories include Deserialization Of Untrusted Data.
Every one of the 3 issues recorded for Weaver Xtreme Theme Support has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. Weaver Xtreme Theme Support is installed on roughly 9,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2023-4971Weaver Xtreme Theme Support <= 6.3.0 - Authenticated (Administrator+) PHP Object Injection via Imported File
Read the full analysisVulnerability Records
Weaver Xtreme Theme Support
Author
wpweaver
This is the theme support for the Weaver Xtreme Theme. This plugin provides a collection of useful shortcodes and widgets designed to complement the Weaver Xtreme theme. These shortcodes have been selected and developed based on requests and feedback from thousands of users of the Weaver Xtreme and previous versions of Weaver. This plugin also provides the Legacy Weaver Xtreme Admin Dashboard interface. The Legacy Admin is an old style interface alternative to the Customizer interface. The Legacy Interface has been updated for compatibility with Weaver Xtreme Version 5, and will automatically update and convert .wxt settings files from Weaver Xtreme 4. Includes complete documentation help file. Instructions for using the shortcodes and widgets are in the help file. Shortcodes included [tab_group] – Display content in a tabbed box. – Show your YouTube videos responsively, and with the capability to use any of the YouTube custom display options. – Show your Vimeo videos responsively, and with the capability to use any of the Vimeo custom display options. [iframe] – Quick and easy display of content in an iframe. [div], [span], [html] – Add div, span, and other html to pages/posts without the need to switch to Text view. [hide/show_if] – Show or hide content depending upon options: device, page ID, user capability, logged in status. [bloginfo] – Display any information available from WordPress bloginfo function. [user_can] – Display content base on logged-in user role. [site_title] – Display Site title. [site_tagline] – Display Site tag line. Widgets Included Weaver 2 Column Text Widget – Add text into two columns in a widget Weaver Per Page Text Widget – Add a text widget on a per-page basis Weaver Login – Simplified login widget Licenses The Weaver Xtreme Theme Support plugin is licensed under the terms of the GNU GENERAL PUBLIC LICENSE, Version 2, June 1991. (GPL) The full text of the license is in the license.txt file. All images included with this plugin are either original works of the author which have been placed into the public domain, or have been derived from other public domain sources, and thus need no license. (This does not include the images provided with any of the below listed scripts and libraries. Those images are covered by their respective licenses.) This plugin also includes several scripts and libraries that are covered under the terms of their own licenses in the listed files in the plugin distribution:
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C