CVE-2025-60101 WordPress Woostify Theme <= 2.4.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in duongancol Woostify woostify allows Stored XSS.This issue affects Woostify: from n/a through = 2.4.2...

CVE-2025-60101 WordPress Woostify Theme <= 2.4.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in duongancol Woostify woostify allows Stored XSS.This issue affects Woostify: from n/a through = 2.4.2...

CVE-2025-60101

CVE-2025-60101 (Woostify Theme) Stored XSS affects Woostify theme (versions up to and including 2.4.2). Root cause aligns with improper neutralization of input during web page generation. CVSS 3.1 base metrics provided: AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L, base score 5.9 (Medium). Connected sourc...

PT-2025-39548

Name of the Vulnerable Software and Affected Versions Woostify versions through 2.4.2 Description The software contains a flaw due to improper handling of user-supplied data when creating web pages, leading to a potential Cross-site Scripting XSS issue. This allows for the injection of malicious...

WordPress plugin Woostify 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site...

WordPress Woostify Theme <= 2.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Woostify Type Theme Vulnerable versions = 2.4.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-60101 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a0bb364dd50b Credits savphill Required privilege Shop Manager Publish...

CVE-2023-6279

The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name...

WordPress Woostify Sites Library Plugin < 1.4.8 is vulnerable to Broken Access Control

Software Woostify Sites Library Type Plugin Vulnerable versions 1.4.8 Fixed in 1.4.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-6279 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 4fb2ad00c846 Credits Krzysztof Zając CERT PL...

CVE-2023-6279

The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name...

CVE-2023-6279

The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name...

Code injection

The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name...

CVE-2023-6279 Woostify Sites Library < 1.4.8 - Subscriber+ Arbitrary Options Update to DoS

The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name...

CVE-2023-6279

CVE-2023-6279 affects Woostify Sites Library (WordPress plugin) versions before 1.4.8. The issue is broken access control in an AJAX action: authenticated users (e.g., subscribers) can update arbitrary blog options and set them to ‘activated’, which the sources describe as potentially leading to ...

CVE-2023-6279 Woostify Sites Library < 1.4.8 - Subscriber+ Arbitrary Options Update to DoS

The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name...

WordPress plugin Woostify Sites Library security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

PT-2024-14923 · WordPress · Woostify Sites Library

Name of the Vulnerable Software and Affected Versions: Woostify Sites Library WordPress plugin versions prior to 1.4.8 Description: The issue concerns a lack of authorization in an AJAX action, allowing any authenticated users to update arbitrary blog options and set them to 'activated'. This cou...

Woostify Sites Library < 1.4.8 - Subscriber+ Arbitrary Options Update to DoS

Description The plugin does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name Login as subscriber, open...

Woostify Sites Library < 1.4.8 - Subscriber+ Arbitrary Options Update to DoS

Description The plugin does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name PoC Login as subscriber, open...

WordPress Woostify Sites Library Plugin <= 1.4.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Woostify Sites Library Type Plugin Vulnerable versions = 1.4.3 Fixed in 1.4.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4828367192f4 Credits István Márto...

woostify.com Improper Access Control vulnerability OBB-2158115

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...