Lucene search

PatchstackCVELIST:CVE-2024-31386

HistoryApr 10, 2024 - 6:47 p.m.

CVE-2024-31386 Multiple WordPress themes affected by Cross-Site Request Forgery vulnerability

2024-04-1018:47:28

CWE-352

Patchstack

www.cve.org

wordpress

themes

csrf

vulnerability

hidekazu ishikawa

lightning

themeinwp

out the box

marsian

jetmonsters

macho themes

wayneconnor

modernthemesnet

tt themes

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

5 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.2%

JSON

Cross-Site Request Forgery (CSRF) vulnerability in Hidekazu Ishikawa X-T9, Hidekazu Ishikawa Lightning, themeinwp Default Mag, Out the Box Namaha, Out the Box CityLogic, Marsian i-max, Jetmonsters Emmet Lite, Macho Themes Decode, Wayneconnor Sliding Door, Out the Box Shopstar!, Modernthemesnet Gridsby, TT Themes HappenStance, Marsian i-excel, Out the Box Panoramic, Modernthemesnet Sensible WP.This issue affects X-T9: from n/a through 1.19.0; Lightning: from n/a through 15.18.0; Default Mag: from n/a through 1.3.5; Namaha: from n/a through 1.0.40; CityLogic: from n/a through 1.1.29; i-max: from n/a through 1.6.2; Emmet Lite: from n/a through 1.7.5; Decode: from n/a through 3.15.3; Sliding Door: from n/a through 3.3; Shopstar!: from n/a through 1.1.33; Gridsby: from n/a through 1.3.0; HappenStance: from n/a through 3.0.1; i-excel: from n/a through 1.7.9; Panoramic: from n/a through 1.1.56; Sensible WP: from n/a through 1.3.1.

CNA Affected

[
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "x-t9",
    "product": "X-T9",
    "vendor": "Hidekazu Ishikawa",
    "versions": [
      {
        "changes": [
          {
            "at": "1.19.1",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.19.0",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "lightning",
    "product": "Lightning",
    "vendor": "Hidekazu Ishikawa",
    "versions": [
      {
        "changes": [
          {
            "at": "15.19.0",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "15.18.0",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "default-mag",
    "product": "Default Mag",
    "vendor": "themeinwp",
    "versions": [
      {
        "changes": [
          {
            "at": "1.3.6",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.3.5",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "namaha",
    "product": "Namaha",
    "vendor": "Out the Box",
    "versions": [
      {
        "changes": [
          {
            "at": "1.0.41",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.0.40",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "citylogic",
    "product": "CityLogic",
    "vendor": "Out the Box",
    "versions": [
      {
        "changes": [
          {
            "at": "1.1.30",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.1.29",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "i-max",
    "product": "i-max",
    "vendor": "Marsian",
    "versions": [
      {
        "lessThanOrEqual": "1.6.2",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "emmet-lite",
    "product": "Emmet Lite",
    "vendor": "Jetmonsters",
    "versions": [
      {
        "changes": [
          {
            "at": "1.7.8",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.7.5",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "decode",
    "product": "Decode",
    "vendor": "Macho Themes",
    "versions": [
      {
        "lessThanOrEqual": "3.15.3",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "sliding-door",
    "product": "Sliding Door",
    "vendor": "Wayneconnor",
    "versions": [
      {
        "changes": [
          {
            "at": "3.4",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "3.3",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "shopstar",
    "product": "Shopstar!",
    "vendor": "Out the Box",
    "versions": [
      {
        "changes": [
          {
            "at": "1.1.34",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.1.33",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "gridsby",
    "product": "Gridsby",
    "vendor": "Modernthemesnet",
    "versions": [
      {
        "lessThanOrEqual": "1.3.0",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "happenstance",
    "product": "HappenStance",
    "vendor": "TT Themes",
    "versions": [
      {
        "lessThanOrEqual": "3.0.1",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "i-excel",
    "product": "i-excel",
    "vendor": "Marsian",
    "versions": [
      {
        "lessThanOrEqual": "1.7.9",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "panoramic",
    "product": "Panoramic",
    "vendor": "Out the Box",
    "versions": [
      {
        "changes": [
          {
            "at": "1.1.57",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "1.1.56",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  },
  {
    "collectionURL": "https://wordpress.org/themes/",
    "defaultStatus": "unaffected",
    "packageName": "sensible-wp",
    "product": "Sensible WP",
    "vendor": "Modernthemesnet",
    "versions": [
      {
        "lessThanOrEqual": "1.3.1",
        "status": "affected",
        "version": "n/a",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/citylogic/wordpress-citylogic-theme-1-1-29-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

patchstack.com/database/vulnerability/decode/wordpress-decode-theme-3-15-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

patchstack.com/database/vulnerability/default-mag/wordpress-default-mag-theme-1-3-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

patchstack.com/database/vulnerability/emmet-lite/wordpress-emmet-lite-theme-1-7-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

patchstack.com/database/vulnerability/gridsby/wordpress-gridsby-theme-1-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

patchstack.com/database/vulnerability/happenstance/wordpress-happenstance-theme-3-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

patchstack.com/database/vulnerability/i-excel/wordpress-i-excel-theme-1-7-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

patchstack.com/database/vulnerability/i-max/wordpress-i-max-theme-1-6-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

patchstack.com/database/vulnerability/lightning/wordpress-lightning-theme-15-18-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

patchstack.com/database/vulnerability/namaha/wordpress-namaha-theme-1-0-40-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

patchstack.com/database/vulnerability/panoramic/wordpress-panoramic-theme-1-1-56-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

patchstack.com/database/vulnerability/sensible-wp/wordpress-sensible-wp-theme-1-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

patchstack.com/database/vulnerability/shopstar/wordpress-shopstar-theme-1-1-33-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

patchstack.com/database/vulnerability/sliding-door/wordpress-sliding-door-theme-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

patchstack.com/database/vulnerability/x-t9/wordpress-x-t9-theme-1-19-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

5 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.2%

JSON

Related for CVELIST:CVE-2024-31386