WordPress Avada Theme <= 7.11.1 is vulnerable to Server Side Request Forgery (SSRF)

Software Avada Type Theme Vulnerable versions = 7.11.1 Fixed in 7.11.2 OWASP Top 10 A1: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2023-39313 Patch priority Low CVSS severity Low 7.7 Developer Claim ownership PSID 8a9512654743 Credits Rafie Muhammad Patchstack...

WordPress Avada Theme <= 7.11.1 is vulnerable to Broken Access Control

Software Avada Type Theme Vulnerable versions = 7.11.1 Fixed in 7.11.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-39922 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7f0edbc9c590 Credits Rafie Muhammad Patchstack Required...

WordPress Avada Theme <= 7.11.1 is vulnerable to Arbitrary File Upload

Software Avada Type Theme Vulnerable versions = 7.11.1 Fixed in 7.11.2 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-39307 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 332539b4f8ac Credits Rafie Muhammad Patchstack Required privilege...

VulnCheck KEV: CVE-2023-39312

Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1...

WordPress Avada Theme <= 7.11.1 is vulnerable to Arbitrary File Upload

Software Avada Type Theme Vulnerable versions = 7.11.1 Fixed in 7.11.2 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-39312 Patch priority High CVSS severity High 9.1 Developer Claim ownership PSID 1d3152e6549b Credits Rafie Muhammad Patchstack Required privilege...

CVE-2020-36711

The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the updatelayout function in versions up to, and including, 6.2.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers, and above, to inject arbitrary web...

CVE-2020-36711

The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the updatelayout function in versions up to, and including, 6.2.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers, and above, to inject arbitrary web...

Cross site scripting

The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the updatelayout function in versions up to, and including, 6.2.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers, and above, to inject arbitrary web...

CVE-2020-36711 Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting

The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the updatelayout function in versions up to, and including, 6.2.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers, and above, to inject arbitrary web...

CVE-2020-36711 Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting

The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the updatelayout function in versions up to, and including, 6.2.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers, and above, to inject arbitrary web...

CVE-2020-36711

The CVE-2020-36711 entry concerns the Avada WordPress theme up to version 6.2.3, vulnerable to Stored Cross-Site Scripting via the update_layout function due to insufficient input sanitization and output escaping. Exploitation would allow contributor-level users and higher to inject scripts that ...

WordPress theme Avada 跨站脚本漏洞

WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports personal blog sites on servers running PHP and MySQL.WordPress theme is a theme for WordPress. A cross-site scripting vulnerability exists in WordPress theme Avada version 6.2.3 and prior versions...

PT-2023-11853 · WordPress · Avada

Name of the Vulnerable Software and Affected Versions: Avada theme for WordPress versions up to and including 6.2.3 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the update layout function. This allows attackers with...

CVE-2020-36711: Improper Neutralization of Input During Web Page Generation

The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the updatelayout function in versions up to, and including, 6.2.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers, and above, to inject arbitrary web...

CVE-2022-41996

Cross-Site Request Forgery CSRF vulnerability in ThemeFusion Avada premium theme versions = 7.8.1 on WordPress leading to arbitrary plugin installation/activation...

CVE-2022-41996

Cross-Site Request Forgery CSRF vulnerability in ThemeFusion Avada premium theme versions = 7.8.1 on WordPress leading to arbitrary plugin installation/activation...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in ThemeFusion Avada premium theme versions = 7.8.1 on WordPress leading to arbitrary plugin installation/activation...

CVE-2022-41996 WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in ThemeFusion Avada premium theme versions = 7.8.1 on WordPress leading to arbitrary plugin installation/activation...

CVE-2022-41996

CVE-2022-41996 is a CSRF vulnerability in ThemeFusion Avada premium theme for WordPress, affecting versions

CVE-2022-41996 WordPress Avada premium theme <= 7.8.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in ThemeFusion Avada premium theme versions = 7.8.1 on WordPress leading to arbitrary plugin installation/activation...