Themify Builder < 7.5.8 - Open Redirect

Description The plugin does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue PoC curl -kvL https://www.example.com/wp-login.php \ -e http://arbitrary-referer \ -d "log=invalidusername=invalidpasswordlogin=1redirectfail=https://malicious-site.com...

Themify Builder < 7.5.8 - Open Redirect

Description The plugin does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue curl -kvL https://www.example.com/wp-login.php \ -e http://arbitrary-referer \ -d...

CVE-2023-46145

Improper Privilege Management vulnerability in Themify Themify Ultra allows Privilege Escalation.This issue affects Themify Ultra: from n/a through 7.3.5...

CVE-2023-46145

Improper Privilege Management vulnerability in Themify Themify Ultra allows Privilege Escalation.This issue affects Themify Ultra: from n/a through 7.3.5...

CVE-2023-46145 WordPress Themify Ultra theme <= 7.3.5 - Authenticated Privilege Escalation vulnerability

Improper Privilege Management vulnerability in Themify Themify Ultra allows Privilege Escalation.This issue affects Themify Ultra: from n/a through 7.3.5...

CVE-2023-46145 WordPress Themify Ultra theme <= 7.3.5 - Authenticated Privilege Escalation vulnerability

Improper Privilege Management vulnerability in Themify Themify Ultra allows Privilege Escalation.This issue affects Themify Ultra: from n/a through 7.3.5...

WordPress plugin Themify Ultra 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-4567

The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themifybutton shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-4567

The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themifybutton shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress plugin Themify Shortcodes 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in PHP. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability exists in the WordPress plugi...

CVE-2024-4567

CVE-2024-4567 (Themify Shortcodes) is a stored XSS in the Themify Shortcodes WordPress plugin up to version 2.0.9. The vulnerability stems from insufficient input sanitization and output escaping in the themify_button shortcode attributes, allowing an authenticated attacker with contributor-level...

CVE-2024-4567 Themify Shortcodes <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify_button Shortcode

The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themifybutton shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-4567 Themify Shortcodes <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify_button Shortcode

The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themifybutton shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Themify Shortcodes plugin <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify_button Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via themifybutton Shortcode vulnerability discovered by Francesco Carlucci in WordPress Plugin Themify Shortcodes versions = 2.0.9...

WordPress Themify Shortcodes Plugin <= 2.0.9 is vulnerable to Cross Site Scripting (XSS)

Software Themify Shortcodes Type Plugin Vulnerable versions = 2.0.9 Fixed in 2.1.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4567 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1f47e36fe951 Credits Francesco Carlucci...

CVE-2024-31366

Missing Authorization vulnerability in Themify Post Type Builder PTB.This issue affects Post Type Builder PTB: from n/a through 2.0.8...

CVE-2024-31365

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themify Post Type Builder PTB allows Reflected XSS.This issue affects Post Type Builder PTB: from n/a before 2.1.1...

CVE-2024-31366

Technical details about CVE-2024-31366 are not publicly provided in the supplied documents. Monitor for updates from vendors/researchers for affected product/Themify PTB PTB, version ranges, impact, and fixes.

CVE-2024-31365

CVE-2024-31365 is a Reflected XSS in Themify Post Type Builder (PTB). The issue affects PTB versions before 2.1.1; root cause is improper input handling during web page generation. CVSS vector indicates NETWORK access, LOW confidentiality/integrity/availability impact, UI interaction required, an...

PT-2024-24011 · Themify · Themify Post Type Builder

Name of the Vulnerable Software and Affected Versions: Themify Post Type Builder PTB versions 2.0.8 and earlier Description: The issue is related to a Missing Authorization vulnerability in Themify Post Type Builder PTB. Recommendations: For Themify Post Type Builder PTB versions 2.0.8 and earlie...