CVE-2021-24219: The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

medium Affects focusblog (WordPress plugin), ignition (WordPress plugin), luxe (WordPress plugin), minus (WordPress plugin), performag (WordPress plugin), pressive (WordPress plugin) and 14 more. Feed 2026.10.29.4, updated 2026-10-29; published 2021-04-12; advisory modified 2026-06-17.

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

Package: focusblog (WordPress plugin) WordPress
Affected versions: <2.0.0
Fixed in: 2.0.0
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (81.3th percentile)
Published: 2021-04-12
Source: nvd

References

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

Package: ignition (WordPress plugin) WordPress
Affected versions: <2.0.0
Fixed in: 2.0.0
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (81.3th percentile)
Published: 2021-04-12
Source: nvd

References

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

Package: luxe (WordPress plugin) WordPress
Affected versions: <2.0.0
Fixed in: 2.0.0
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (81.3th percentile)
Published: 2021-04-12
Source: nvd

References

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

Package: minus (WordPress plugin) WordPress
Affected versions: <2.0.0
Fixed in: 2.0.0
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (81.3th percentile)
Published: 2021-04-12
Source: nvd

References

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

Package: performag (WordPress plugin) WordPress
Affected versions: <2.0.0
Fixed in: 2.0.0
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (81.3th percentile)
Published: 2021-04-12
Source: nvd

References

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

Package: pressive (WordPress plugin) WordPress
Affected versions: <2.0.0
Fixed in: 2.0.0
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (81.3th percentile)
Published: 2021-04-12
Source: nvd

References

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

Package: rise (WordPress plugin) WordPress
Affected versions: <2.0.0
Fixed in: 2.0.0
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (81.3th percentile)
Published: 2021-04-12
Source: nvd

References

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

Package: squared (WordPress plugin) WordPress
Affected versions: <2.0.0
Fixed in: 2.0.0
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (81.3th percentile)
Published: 2021-04-12
Source: nvd

References

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

Package: storied (WordPress plugin) WordPress
Affected versions: <2.0.0
Fixed in: 2.0.0
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (81.3th percentile)
Published: 2021-04-12
Source: nvd

References

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

Package: thrive-apprentice (WordPress plugin) WordPress
Affected versions: <2.3.9.4
Fixed in: 2.3.9.4
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (81.3th percentile)
Published: 2021-04-12
Source: nvd

References

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

Package: thrive-clever-widgets (WordPress plugin) WordPress
Affected versions: <1.57.1
Fixed in: 1.57.1
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (81.3th percentile)
Published: 2021-04-12
Source: nvd

References

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

Package: thrive-comments (WordPress plugin) WordPress
Affected versions: <1.4.15.3
Fixed in: 1.4.15.3
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (81.3th percentile)
Published: 2021-04-12
Source: nvd

References

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

Package: thrive-dashboard (WordPress plugin) WordPress
Affected versions: <2.3.9.3
Fixed in: 2.3.9.3
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (81.3th percentile)
Published: 2021-04-12
Source: nvd

References

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

Package: thrive-headline-optimizer (WordPress plugin) WordPress
Affected versions: <1.3.7.3
Fixed in: 1.3.7.3
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (81.3th percentile)
Published: 2021-04-12
Source: nvd

References

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

Package: thrive-optimize (WordPress plugin) WordPress
Affected versions: <1.4.13.3
Fixed in: 1.4.13.3
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (81.3th percentile)
Published: 2021-04-12
Source: nvd

References

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

Package: thrive-ovation (WordPress plugin) WordPress
Affected versions: <2.4.5
Fixed in: 2.4.5
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (81.3th percentile)
Published: 2021-04-12
Source: nvd

References

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

Package: thrive-quiz-builder (WordPress plugin) WordPress
Affected versions: <2.3.9.4
Fixed in: 2.3.9.4
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (81.3th percentile)
Published: 2021-04-12
Source: nvd

References

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

Package: thrive-themes-builder (WordPress plugin) WordPress
Affected versions: <2.2.4
Fixed in: 2.2.4
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (81.3th percentile)
Published: 2021-04-12
Source: nvd

References

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

Package: thrive-visual-editor (WordPress plugin) WordPress
Affected versions: <2.6.7.4
Fixed in: 2.6.7.4
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (81.3th percentile)
Published: 2021-04-12
Source: nvd

References

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before

Package: voice (WordPress plugin) WordPress
Affected versions: <2.0.0
Fixed in: 2.0.0
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 2% (81.3th percentile)
Published: 2021-04-12
Source: nvd

References

CWE-284 CWE-306

NVD record focusblog (WordPress plugin) advisories ignition (WordPress plugin) advisories luxe (WordPress plugin) advisories minus (WordPress plugin) advisories performag (WordPress plugin) advisories pressive (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2021-24220 critical Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes same package: ignition (WordPress plugin)
CVE-2015-1376 medium pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate same weakness: CWE-284
CVE-2021-24146 high Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions same weakness: CWE-284
CVE-2021-4119 medium BookStack is vulnerable to Improper Access Control. same weakness: CWE-284
CVE-2010-3714 high TYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanism same weakness: CWE-284
CVE-2015-3302 high The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) same weakness: CWE-284