WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to PHP Object Injection

Software Themify Ultra Type Theme Vulnerable versions = 7.3.5 Fixed in 7.3.6 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2023-46147 Patch priority High CVSS severity High 7.4 Developer Claim ownership PSID ae279380be0f Credits Rafie Muhammad Patchstack Required privileg...

WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to Arbitrary File Upload

Software Themify Ultra Type Theme Vulnerable versions = 7.3.5 Fixed in 7.3.6 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-46149 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 04def42b7ff1 Credits Rafie Muhammad Patchstack Required privile...

WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to Settings Change

Software Themify Ultra Type Theme Vulnerable versions = 7.3.5 Fixed in 7.3.6 OWASP Top 10 A5: Broken Access Control Classification Settings Change CVE CVE-2023-46148 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 4e68744a5277 Credits Rafie Muhammad Patchstack Required...

WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to Privilege Escalation

Software Themify Ultra Type Theme Vulnerable versions = 7.3.5 Fixed in 7.3.6 OWASP Top 10 A2: Broken Authentication Classification Privilege Escalation CVE CVE-2023-46145 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 23dc050c5700 Credits Rafie Muhammad Patchstack...

CVE-2022-32970

Auth. editor+ Stored Cross-Site Scripting XSS vulnerability in Themify Themify Portfolio Post plugin = 1.2.4 versions...

CVE-2022-32970

Auth. editor+ Stored Cross-Site Scripting XSS vulnerability in Themify Themify Portfolio Post plugin = 1.2.4 versions...

Cross site scripting

Auth. editor+ Stored Cross-Site Scripting XSS vulnerability in Themify Themify Portfolio Post plugin = 1.2.4 versions...

CVE-2022-32970 WordPress Themify Portfolio Post Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)

Auth. editor+ Stored Cross-Site Scripting XSS vulnerability in Themify Themify Portfolio Post plugin = 1.2.4 versions...

CVE-2022-32970

CVE-2022-32970 is a stored XSS in the Themify Portfolio Post WordPress plugin (

CVE-2022-32970 WordPress Themify Portfolio Post Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)

Auth. editor+ Stored Cross-Site Scripting XSS vulnerability in Themify Themify Portfolio Post plugin = 1.2.4 versions...

WordPress plugin Themify Portfolio Post 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

CVE-2022-32970: Improper Neutralization of Input During Web Page Generation

Auth. editor+ Stored Cross-Site Scripting XSS vulnerability in Themify Themify Portfolio Post plugin = 1.2.4 versions...

PT-2023-13224

Name of the Vulnerable Software and Affected Versions: Themify Themify Portfolio Post plugin versions 1.2.4 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with editor or higher permissions. This allows for malicious scripts to b...

Themify Portfolio Post < 1.2.5 - Editor+ Stored XSS

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks...

WordPress Themify Portfolio Post Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)

Software Themify Portfolio Post Type Plugin Vulnerable versions = 1.2.4 Fixed in 1.2.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-32970 Patch priority Low CVSS severity Low 4.1 Developer Claim ownership PSID b8a82c2c105c Credits Muhammad Daffa...

Themify Portfolio Post Plugin for WordPress < 1.2.2 Stored Cross-Site Scripting

The WordPress Themify Portfolio Post Plugin installed on the remote host is affected by a stored cross-site scripting vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

CVE-2023-0362

Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0362 Themify Portfolio Post < 1.2.2 - Contributor+ Stored XSS

Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-0362

The CVE-2023-0362 entry concerns the WordPress plugin Themify Portfolio Post (before 1.2.2). The vulnerability is a Stored Cross-Site Scripting (XSS) flaw caused by not validating/escaping certain shortcode attributes before output in posts/pages, enabling users with the Contributor role and abov...

CVE-2023-0362 Themify Portfolio Post < 1.2.2 - Contributor+ Stored XSS

Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...