IS-theme-companion
IS-theme-companion has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for IS-theme-companion has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by domiee13. IS-theme-companion is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2025-53277IS-theme-companion <= 1.57 - Cross-Site Request Forgery
Read the full analysisVulnerability Records

IS-theme-companion
Author
Infigo Software
IS-theme-companion , Enhances themes with extra functionality for Infigo Software Themes. The IS-theme-companion plugin features include: Beautiful ready-made homepage Sections Drag and drop page customization Predefined content sections Live content editing And many other features Enigma & Enigma Parallax WordPress Theme content recovery tool added. Watch this video of how the content recovery tool works: License IS-theme-companion WordPress plugin, Copyright (C) 2022 vibhorp IS-theme-companion WordPress plugin is licensed under the GPL3 (https://www.gnu.org/licenses/gpl-3.0.en.html). Unless otherwise specified, all the theme files and scripts are licensed under GNU General Public License. The exceptions to this license are as follows: 1) Bootstrap v3.3.7 (http://getbootstrap.com) * Copyright 2011-2016 Twitter, Inc. * Licensed under the MIT license 2) Font Awesome Icon Picker * https://farbelous.github.io/fontawesome-iconpicker/ * @author Javi Aguilar, itsjavi.com * @license MIT License 3) one-line-text-editor JS * Text Editor JS * Copyright 2016-2018 * Licensed under the MIT license * Deveolped By CP at vibhorp 4) dynamic_fields JS * Customizer Range Value JS * Copyright 2016-2018 * Licensed under the MIT license * Developed By CP at vibhorp 5) customizer-range-value-control JS * Customizer Range Value JS * Copyright 2016-2018 * Licensed under the MIT license * Developed By CP at vibhorp
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C