Avada < 6.2.3 - Missing Permission Checks leading to Arbitrary Post Creation, Edition, Deletion and Stored XSS

Description NinTechNet disclosed multiple security vulnerabilities affecting the premium Avada WordPress theme on their blog after responsibly disclosing the security vulnerabilities to Avada. These vulnerabilities included: - Content Injection & Stored XSS - Arbitrary Post Deletion - Arbitrary...

avada theme for WordPress cross-site scripting vulnerability

avada theme for WordPress is a responsive multipurpose theme plugin for use in WordPress. A cross-site scripting vulnerability exists in avada theme for WordPress versions prior to 5.1.5. The vulnerability stems from a lack of proper validation of client-side data by the web application. An...

CVE-2017-18606

The avada theme before 5.1.5 for WordPress has stored XSS...

CVE-2017-18607

The avada theme before 5.1.5 for WordPress has CSRF...

CVE-2017-18606

The avada theme before 5.1.5 for WordPress has stored XSS...

CVE-2017-18607

The avada theme before 5.1.5 for WordPress has CSRF...

Cross site request forgery (csrf)

The avada theme before 5.1.5 for WordPress has CSRF...

Cross site scripting

The avada theme before 5.1.5 for WordPress has stored XSS...

CVE-2017-18607

The avada theme before 5.1.5 for WordPress has CSRF...

CVE-2017-18607

CVE-2017-18607 affects the Avada WordPress theme prior to 5.1.5. The NVD entry documents a CSRF vulnerability (pre-5.1.5) with CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (base 8.8) and CVSS v2: AV:N/AC:M/Au:N/C:P/I:P/A:P (base 6.8). Connected sources also reference related issues in older bui...

CVE-2017-18606

The CVE-2017-18606 entry concerns the Avada WordPress theme (before 5.1.5) with a stored XSS vulnerability. Connected sources confirm the root cause as insufficient validation of client-side data leading to cross-site scripting. Affected product: Avada theme for WordPress prior to 5.1.5. Impact: ...

CVE-2017-18606

The avada theme before 5.1.5 for WordPress has stored XSS...

PT-2019-8538

Name of the Vulnerable Software and Affected Versions Avada theme versions prior to 5.1.5 Description The issue concerns a CSRF problem. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was...

PT-2019-8537

Name of the Vulnerable Software and Affected Versions Avada theme versions prior to 5.1.5 Description The issue concerns a stored XSS in the Avada theme for WordPress. Recommendations For versions prior to 5.1.5, update to version 5.1.5 or later to resolve the issue...

CVE-2017-18606: Improper Neutralization of Input During Web Page Generation

The avada theme before 5.1.5 for WordPress has stored XSS...

CVE-2017-18607: Cross-Site Request Forgery (CSRF)

The avada theme before 5.1.5 for WordPress has CSRF...

Avada Theme <= 5.1.4 - Stored Cross-Site Scripting (XSS) & CSRF

Description The Avada WordPress theme was affected by a Stored Cross-Site Scripting XSS & CSRF security vulnerability. PoC http://cdn.wphutte.com/Avada/5.1.4/xss.html http://cdn.wphutte.com/Avada/5.1.4/csrf.html...

Avada Theme <= 5.1.4 - Stored Cross-Site Scripting (XSS) & CSRF

Description The Avada WordPress theme was affected by a Stored Cross-Site Scripting XSS & CSRF security vulnerability. http://cdn.wphutte.com/Avada/5.1.4/xss.html http://cdn.wphutte.com/Avada/5.1.4/csrf.html...

Multiple Slider Plugins for WordPress 'img' Parameter Local File Inclusion Vulnerability

A Slider plugin for WordPress hosted on the remote web server is affected by a local file inclusion vulnerability due to a failure to properly sanitize user-supplied input to the 'img' parameter of the 'imageview.class.php' script. This allows an unauthenticated, remote attacker to read arbitrary...