Catch Themes Demo Import Security Vulnerabilities and Issues — Catch Themes Demo Import CVE List

CatchpluginsCatch Themes Demo Import

3 matches found

CVE•added 2021/10/21 7:38 p.m.•100 views

CVE-2021-39352

CVE-2021-39352 affects the WordPress plugin Catch Themes Demo Import, vulnerable in versions up to 1.7 (pre-1.8). The root cause is insufficient file-type validation in ~/inc/CatchThemesDemoImport.php, enabling an authenticated administrator to upload arbitrary files that can be used for remote c...

7.2CVSS7.4AI score0.75591EPSS

Web

CVE•added 2022/03/07 8:16 a.m.•92 views

CVE-2022-0440

Affected software. Catch Themes Demo Import WordPress plugin (versions before 2.1.1). Root cause. The plugin does not validate one of the files to be imported, enabling an elevated-privilege admin to upload an arbitrary PHP file. Impact. Remote Code Execution (RCE) potentially even on hardened Wo...

7.2CVSS7.2AI score0.00875EPSS

Web

CVE•added 2021/10/18 1:46 p.m.•64 views

CVE-2021-24752

CVE-2021-24752 affects multiple CatchThemes plugins that fail capability and CSRF checks in the ctp_switch AJAX action. This allows any authenticated user (e.g., Subscriber) to alter plugin settings for: Essential Widgets (≤1.9), To Top (≤2.3), Header Enhancement (≤1.5), Generate Child Theme (≤1....

5.7CVSS5.3AI score0.00172EPSS

Web