CVE-2023-40001

Missing Authorization vulnerability in SolidWP iThemes Sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iThemes Sync: from n/a through 2.1.13...

CVE-2023-40001 WordPress iThemes Sync plugin <= 2.1.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in SolidWP iThemes Sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iThemes Sync: from n/a through 2.1.13...

CVE-2023-40001 WordPress iThemes Sync plugin <= 2.1.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in SolidWP iThemes Sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iThemes Sync: from n/a through 2.1.13...

WordPress plugin iThemes Sync 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

WordPress 6.4.3 Username Disclosure

Title: wordpress 6.4.3 - Username Disclosure Author: h4shur date:2024-02-21 Vendor Homepage: https://www.wordpress.org Software Link: https://www.wordpress.org/download Version: 6.4.3 and earlier Tested on: Windows 10 & Google Chrome Category : Web Application Bugs Description : the REST API allo...

Solid Central < 3.0.1 - Stored Cross-Site Scripting via packages

Description The plugin is vulnerable to Stored Cross-Site Scripting via via malicious package names in all versions up to and including 3.0.0 due to insufficient output escaping. This makes it possible for attackers able to compromise the packages retrieved from the iThemes API to inject arbitrar...

iThemes Sync < 2.1.14 - Cross-Site Request Forgery and Missing Authorization via 'hide_authenticate_notice'

Description The iThemes Sync plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.13. This is due to missing or incorrect nonce validation on the hideauthenticatenotice function. This makes it possible for unauthenticated attackers to hide admin...

WordPress iThemes Sync Plugin < 3.0.1 is vulnerable to Cross Site Scripting (XSS)

Software iThemes Sync Type Plugin Vulnerable versions 3.0.1 Fixed in 3.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID da91ec2d1342 Credits Robin Wood Required privilege...

WordPress iThemes Sync Plugin <= 2.1.13 is vulnerable to Broken Access Control

Software iThemes Sync Type Plugin Vulnerable versions = 2.1.13 Fixed in 2.1.14 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40001 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID dfebd44ecd2d Credits Abdi Pranata Required privileg...

CVE-2022-45825

Unauth. Reflected Cross-Site Scripting XSS vulnerability in iThemes WPComplete plugin = 2.9.2 versions...

CVE-2022-45825

Unauth. Reflected Cross-Site Scripting XSS vulnerability in iThemes WPComplete plugin = 2.9.2 versions...

CVE-2022-45825

The CVE concerns the WordPress WPComplete plugin. Affected software: iThemes WPComplete plugin versions up to 2.9.2 (WordPress ecosystem context shows up to 2.9.4 in some sources). Vulnerability type: Unauth. Reflected Cross-Site Scripting (XSS) in the plugin’s handling of input exposed to site v...

PT-2023-14771 · Ithemes · Ithemes Wpcomplete

Name of the Vulnerable Software and Affected Versions: iThemes WPComplete plugin versions = 2.9.2 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows attackers to inject malicious scripts into websites, potentially...

CVE-2022-31474

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1...

CVE-2022-31474

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1...

CVE-2022-31474

BackupBuddy WordPress plugin versions 8.5.8.0–8.7.4.1 are affected by a local file inclusion / arbitrary file read vulnerability. The root cause is a path traversal issue exposed via the download and local-destination-id parameters, enabling access to sensitive server files. Impact stated in sour...

WordPress MainWP iThemes Security Extension Plugin <= 4.1.1 is vulnerable to Broken Access Control

Software MainWP iThemes Security Extension Type Plugin Vulnerable versions = 4.1.1 Fixed in 4.1.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23643 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 4ac1fa6eea51 Credits Dave...

Hackers Exploit Zero-Day in WordPress BackupBuddy Plugin in ~5 Million Attempts

A zero-day flaw in a WordPress plugin called BackupBuddy is being actively exploited, WordPress security company Wordfence has disclosed. "This vulnerability makes it possible for unauthenticated users to download arbitrary files from the affected site which can include sensitive information," it...

WordPress BackupBuddy 8.7.4.1 Arbitrary File Read Vulnerability

WordPress BackupBuddy plugin versions 8.5.8.0 through 8.7.4.1 suffer from an arbitrary file read and download vulnerability. Description: Arbitrary File Download/Read Affected Plugin: BackupBuddy Plugin Slug: backupbuddy Plugin Developer: iThemes Affected Versions: 8.5.8.0 – 8.7.4.1 CVE ID:...

iThemes Security Free (< 7.9.1) & Pro (< 6.8.4) - Hide Backend Bypass

Both the iThemes Security free and pro versions were affected. - Patched in Version iThemes Security: 7.9.1 - Patched in Version iThemes Security Pro: 6.8.4 The bug allowed attackers to bypass the "Hide Backend" feature, that, when enabled, hides the WordPress wp-login.php and wp-admin pages...