← back to popular plugins
wordfence / plugin · astra-sites
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg
astra-sites
total installs
1,000,000
total vulns
5
critical
0
high
1
medium
4
low
0
latest vuln
—
patched
5
unpatched
0
avg time to patch
—
vulnerabilities
(5)
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.7 - Missing Authorization
medium
✓ patched
The Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 4.7.7. This is due to a missing capability check on a function. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
✓ patched
cve id
CVE-2026-102393 ↗
cvss score
6.4
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Oct 5, 2026
The Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.7.7. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.5 - Authenticated (Contributor+) Insecure Direct Object Reference
medium
✓ patched
cve id
CVE-2026-62134 ↗
cvss score
4.3
cwe
CWE-639: Authorization Bypass Through User-Controlled Key
published
Sep 10, 2026
The Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.7.5. This is due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.
Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass
high
✓ patched
cve id
CVE-2025-13065 ↗
cvss score
8.8
cwe
CWE-434: Unrestricted Upload of File with Dangerous Type
published
Dec 5, 2025
The Starter Templates plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.4.41. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Starter Templates <= 4.4.9 - Cross-Site Request Forgery
medium
✓ patched
cve id
CVE-2025-24568 ↗
cvss score
4.3
cwe
CWE-352: Cross-Site Request Forgery (CSRF)
published
Jan 24, 2025
The Starter Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.9. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.