Thrive Apprentice premium plugin <= 2.3.9.3 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in Thrive Apprentice premium plugin versions = 2.3.9.3. Solution Update the Thrive Apprentice premium plugin to the latest available version at least 2.3.9.4...

WordPress Thrive Comments premium plugin <= 1.4.15.2 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in WordPress Thrive Comments premium plugin versions = 1.4.15.2. Solution Update the WordPress Thrive Comments premium plugin to the latest available version at least 1.4.15.3...

All Thrive Themes Legacy Themes < 2.0.0 - Unauthenticated Arbitrary File Upload and Option Deletion

Thrive “Legacy” themes register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote...

WordPress Thrive Architect premium plugin <= 2.6.7.3 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in WordPress Thrive Architect premium plugin versions = 2.6.7.3. Solution Update the WordPress Thrive Architect premium plugin to the latest available version at least 2.6.7.4...

All Thrive Themes Legacy Themes < 2.0.0 - Unauthenticated Arbitrary File Upload and Option Deletion

Thrive “Legacy” themes register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote...

WordPress Thrive Themes Builder premium plugin <= 2.2.3 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in WordPress Thrive Themes Builder premium plugin versions = 2.2.3. Solution Update the WordPress Thrive Themes Builder premium plugin to the latest available version at least 2.2.4...

WordPress Thrive Leads Version premium plugin <= 2.3.9.3 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in WordPress Thrive Leads Version premium plugin versions = 2.3.9.3. Solution Update the WordPress Thrive Leads Version premium plugin to the latest available version at least 2.3.9.4...

WordPress Thrive Ultimatum premium plugin <= 2.3.9.3 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in WordPress Thrive Ultimatum premium plugin versions = 2.3.9.3. Solution Update the WordPress Thrive Ultimatum premium plugin to the latest available version at least 2.3.9.4...

WordPress Thrive Optimize premium plugin <= 1.4.13.2 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in WordPress Thrive Optimize premium plugin versions = 1.4.13.2. Solution Update the WordPress Thrive Optimize premium plugin to the latest available version at least 1.4.13.3...

WordPress Thrive Dashboard premium plugin <= 2.3.9.2 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in WordPress Thrive Dashboard premium plugin versions = 2.3.9.2. Solution Update the WordPress Thrive Dashboard premium plugin to the latest available version at least 2.3.9.3...

VulnCheck KEV: CVE-2021-24219

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin...

All Thrive Themes and Plugins - Unauthenticated Option Update

The plugins and themes register a REST API endpoint associated with Zapier functionality. While this endpoint was intended to require an API key in order to access, it was possible to access it by supplying an empty apikey parameter in vulnerable versions if Zapier was not enabled. Attackers coul...

All Thrive Themes and Plugins - Unauthenticated Option Update

The plugins and themes register a REST API endpoint associated with Zapier functionality. While this endpoint was intended to require an API key in order to access, it was possible to access it by supplying an empty apikey parameter in vulnerable versions if Zapier was not enabled. Attackers coul...

WordPress Thrive Headline Optimizer premium plugin <= 1.3.7.2 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in WordPress Thrive Headline Optimizer premium plugin versions = 1.3.7.2. Solution Update the WordPress Thrive Headline Optimizer premium plugin to the latest available version at least 1.3.7.3...

WordPress Thrive Quiz Builder premium plugin <= 2.3.9.3 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in WordPress Thrive Quiz Builder premium plugin versions = 2.3.9.3. Solution Update the WordPress Thrive Quiz Builder premium plugin to the latest available version at least 2.3.9.4...

VulnCheck KEV: CVE-2021-24220

Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared...

Thrive Smart Home 1.1 - Authentication Bypass

Thrive Smart Home 1.1 - Authentication Bypass Exploit: Thrive Smart Home 1.1 - Authentication Bypass Date: 2019-12-30 Author: LiquidWorm Vendor: Thrive Product web page: http://www.thrivesmarthomes.com Affected version: 1.1 Tested on: Apache/2.4.41 centos OpenSSL/1.0.2k-fips Advisory ID:...

Thrive Smart Home 1.1 - Authentication Bypass

Exploit: Thrive Smart Home 1.1 - Authentication Bypass Date: 2019-12-30 Author: LiquidWorm Vendor: Thrive Product web page: http://www.thrivesmarthomes.com Affected version: 1.1 Tested on: Apache/2.4.41 centos OpenSSL/1.0.2k-fips Advisory ID: ZSL-2019-5554 Advisory URL:...

Thrive Smart Home 1.1 - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Exploit: Thrive Smart Home 1.1 - Authentication Bypass Author: LiquidWorm Vendor: Thrive Product web page: http://www.thrivesmarthomes.com Affected version: 1.1 Tested on: Apache/2.4.41 centos OpenSSL/1.0.2k-fips Advisory ID: ZSL-2019-5554...

Thrive Smart Home 1.1 Cross Site Scripting

Thrive Smart Home v1.1 Reflected Cross-Site Scripting Vendor: Thrive Product web page: http://www.thrivesmarthomes.com Affected version: 1.1 Summary: As smart home technology becomes more affordable and easy to install with services offered by Thrive Smart Homes, there are some great options...