CVE-2024-4567

The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themifybutton shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-4567

The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themifybutton shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress plugin Themify Shortcodes 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in PHP. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability exists in the WordPress plugi...

CVE-2024-4567 Themify Shortcodes <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify_button Shortcode

The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themifybutton shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-4567

CVE-2024-4567 (Themify Shortcodes) is a stored XSS in the Themify Shortcodes WordPress plugin up to version 2.0.9. The vulnerability stems from insufficient input sanitization and output escaping in the themify_button shortcode attributes, allowing an authenticated attacker with contributor-level...

CVE-2024-4567 Themify Shortcodes <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify_button Shortcode

The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themifybutton shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Themify Shortcodes plugin <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify_button Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via themifybutton Shortcode vulnerability discovered by Francesco Carlucci in WordPress Plugin Themify Shortcodes versions = 2.0.9...

WordPress Themify Shortcodes Plugin <= 2.0.9 is vulnerable to Cross Site Scripting (XSS)

Software Themify Shortcodes Type Plugin Vulnerable versions = 2.0.9 Fixed in 2.1.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4567 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1f47e36fe951 Credits Francesco Carlucci...

CVE-2024-31366

Missing Authorization vulnerability in Themify Post Type Builder PTB.This issue affects Post Type Builder PTB: from n/a through 2.0.8...

CVE-2024-31365

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themify Post Type Builder PTB allows Reflected XSS.This issue affects Post Type Builder PTB: from n/a before 2.1.1...

CVE-2024-31366

Technical details about CVE-2024-31366 are not publicly provided in the supplied documents. Monitor for updates from vendors/researchers for affected product/Themify PTB PTB, version ranges, impact, and fixes.

CVE-2024-31365

CVE-2024-31365 is a Reflected XSS in Themify Post Type Builder (PTB). The issue affects PTB versions before 2.1.1; root cause is improper input handling during web page generation. CVSS vector indicates NETWORK access, LOW confidentiality/integrity/availability impact, UI interaction required, an...

PT-2024-24011 · Themify · Themify Post Type Builder

Name of the Vulnerable Software and Affected Versions: Themify Post Type Builder PTB versions 2.0.8 and earlier Description: The issue is related to a Missing Authorization vulnerability in Themify Post Type Builder PTB. Recommendations: For Themify Post Type Builder PTB versions 2.0.8 and earlie...

PT-2024-24010 · Themify · Themify Post Type Builder

Name of the Vulnerable Software and Affected Versions: Themify Post Type Builder PTB versions prior to 2.1.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacke...

Themify Event Post < 1.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting

Description The Themify Event Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-2278

Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-2263

Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-2262

Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs...

CVE-2024-2263

Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-2263 WooCommerce Product Filter < 1.4.4 - Reflected XSS

Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...