CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-1047 – Themify - Post Type Builder Search Addon < 1.4.0 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-1047
The Themify Post Type Builder Search Addon WordPress plugin before 1.4.0 does not properly escape the current page URL before reusing it in a HTML attribute, leading to a reflected cross site scripting vulnerability. El plugin Themify Post Type Builder Search Addon de WordPress versiones anteriores a 1.4.0, no escapa correctamente la URL de la página actual antes de reusarla en un atributo HTML, conllevando a una vulnerabilidad de tipo cross site scripting reflejado • https://wpscan.com/vulnerability/078bd5f6-64f7-4665-825b-9fd0c2b7b91b • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-0200 – Themify Portfolio Post < 1.1.7 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2022-0200
Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting El plugin Themify Portfolio Post de WordPress versiones anteriores a 1.1.7 no sanea ni escapa del parámetro num_of_pages antes de devolverlo a la respuesta de la acción AJAX themify_create_popup_page_pagination (disponible para cualquier usuario autenticado), conllevando a un problema de tipo Cross-Site Scripting Reflejado • https://wpscan.com/vulnerability/bbc0b812-7b30-4ab4-bac8-27c706b3f146 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24129 – Themify Portfolio Post < 1.1.6 - Authenticated Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-24129
Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting (XSS) vulnerabilities allowing low-privileged users (Contributor+) to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Panel is embedded, which could lead to privilege escalation. Una entrada no comprobada y una falta de codificación de salida en el plugin Themify Portfolio Post de WordPress, versiones anteriores a 1.1.6, conlleva a vulnerabilidades de tipo Cross-Site Scripting (XSS) Almacenado que permiten a usuarios pocos privilegiados (Colaborador+) inyectar código JavaScript o HTML arbitrario en publicaciones donde Themify Custom Panel está embebido, lo que podría conllevar a una escalada de privilegios • https://wpscan.com/vulnerability/c8537e5f-1948-418b-9d29-3cf50cd8f9a6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 1CVE-2013-20002 – Elemin < 1.4.3 - Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2013-20002
Elemin allows remote attackers to upload and execute arbitrary PHP code via the Themify framework (before 1.2.2) wp-content/themes/elemin/themify/themify-ajax.php file. Elemin permite a atacantes remotos cargar y ejecutar código PHP arbitrario por medio del archivo wp-content/themes/elemin/themify/themify-ajax.php del framework Themify (versiones anteriores a 1.2.2) • https://en.0day.today/exploit/22090 https://packetstormsecurity.com/files/124149/WordPress-Elemin-Shell-Upload.html https://themify.me/blog/updated-themify-framework-to-fix-the-vulnerability https://themify.me/blog/urgent-vulnerability-found-in-themify-framework-please-read • CWE-434: Unrestricted Upload of File with Dangerous Type •