Known vulnerabilities in Envo Extra

Extra addon for EnvoThemes Themes

8Reported vulnerabilities

6.4Highest CVSS score

1.9.21Latest version

20,000+Active installs

What to do now

Update Envo Extra to 1.9.14 or later. 8 of these have a fixed version available. Updating resolves them.

Plugin last updated: May 27, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2024-32456	Medium 6.4	0.3%	1.8.11 and earlier	`1.8.12`	April 15, 2024
CVE-2025-66066	Medium 6.4	0.2%	1.9.11 and earlier	`1.9.12`	December 5, 2025
CVE-2024-5645	Medium 5.4	0.3%	Before 1.8.25	`1.8.25`	June 7, 2024
CVE-2024-4385	Medium 5.4	0.3%	Before 1.8.17	`1.8.17`	May 16, 2024
CVE-2026-32386	Medium 4.3	0.2%	1.9.13 and earlier	`1.9.14`	February 18, 2026
CVE-2025-47471	Medium 4.3	0.3%	1.9.9 and earlier	`1.9.10`	May 7, 2025
CVE-2024-10770	Medium 4.3	0.3%	Before 1.9.4	`1.9.4`	November 9, 2024
WF-f709fca2-b7b6-4567-8055-1156f510d1ca	Medium 4.3	—	Before 1.8.4	`1.8.4`	October 17, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.