CVE-2024-2278 WooCommerce Product Filter < 1.4.4 - Admin+ Stored XSS

Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-2263 WooCommerce Product Filter < 1.4.4 - Reflected XSS

Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-2278

The CVE-2024-2278 entry corresponds to the Themify WordPress plugin prior to version 1.4.4. The vulnerability arises because the plugin does not sanitize and escape some Filter settings, potentially allowing high-privilege users (e.g., administrators) to perform Stored Cross-Site Scripting even w...

CVE-2024-2278 WooCommerce Product Filter < 1.4.4 - Admin+ Stored XSS

Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-2262

CVE-2024-2262 affects the Themify WordPress plugin prior to version 1.4.4, where the bulk action feature lacks CSRF protection. This enables an attacker to trigger actions that cause logged-in users to delete arbitrary filters by crafting a CSRF request, given knowledge of the related filter slug...

CVE-2024-2262 WooCommerce Product Filter < 1.4.4 - Filter Deletion via CSRF

Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs...

CVE-2024-2262 WooCommerce Product Filter < 1.4.4 - Filter Deletion via CSRF

Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs...

WordPress Themify – WooCommerce Product Filter Plugin < 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Software Themify – WooCommerce Product Filter Type Plugin Vulnerable versions 1.4.4 Fixed in 1.4.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2263 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2af17750bb44 Credits...

WordPress Themify – WooCommerce Product Filter Plugin < 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Software Themify – WooCommerce Product Filter Type Plugin Vulnerable versions 1.4.4 Fixed in 1.4.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2278 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID fbb4b3430777 Credits Erwan...

PT-2024-19563 · WordPress · Themify

Name of the Vulnerable Software and Affected Versions: Themify WordPress plugin versions prior to 1.4.4 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example in...

WordPress Themify – WooCommerce Product Filter Plugin < 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Themify – WooCommerce Product Filter Type Plugin Vulnerable versions 1.4.4 Fixed in 1.4.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-2262 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 9af412c77d7f Credits...

PT-2024-19508 · WordPress · Themify

Name of the Vulnerable Software and Affected Versions: Themify WordPress plugin versions prior to 1.4.4 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This...

WordPress plugin Themify 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-19503 · WordPress · Themify Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Themify WordPress plugin versions prior to 1.4.4 Description: The issue concerns a lack of CSRF check in the bulk action of the Themify WordPress plugin. This could allow attackers to make logged-in users delete arbitrary filters via a CSRF...

WordPress plugin Themify 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Themify 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-30440

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themify Themify Event Post allows Stored XSS.This issue affects Themify Event Post: from n/a through 1.2.7...

CVE-2024-30440 WordPress Themify Event Post plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themify Themify Event Post allows Stored XSS.This issue affects Themify Event Post: from n/a through 1.2.7...

CVE-2024-30440

CVE-2024-30440 : Stored XSS in the WordPress plugin Themify Event Post (vulnerable through 1.2.7) due to improper input neutralization during web page generation. Affected component: Themify Event Post. Root cause: Improper Neutralization of Input During Web Page Generation. Impact details are li...

CVE-2024-30440 WordPress Themify Event Post plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themify Themify Event Post allows Stored XSS.This issue affects Themify Event Post: from n/a through 1.2.7...