← back to popular plugins
wordfence / plugin · astra-sites
Starter Templates – AI-Powered Templates for Elementor & Gutenberg
astra-sites
total installs
2,000,000
total vulns
2
critical
0
high
1
medium
1
low
0
latest vuln
—
patched
2
unpatched
0
avg time to patch
—
vulnerabilities
(2)
Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass
high
✓ patched
cve id
CVE-2025-13065 ↗
cvss score
8.8
cwe
CWE-434: Unrestricted Upload of File with Dangerous Type
published
Dec 5, 2025
The Starter Templates plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.4.41. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Starter Templates <= 4.4.9 - Cross-Site Request Forgery
medium
✓ patched
cve id
CVE-2025-24568 ↗
cvss score
4.3
cwe
CWE-352: Cross-Site Request Forgery (CSRF)
published
Jan 24, 2025
The Starter Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.9. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.