Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 100

Export CSV
CVE-2023-0500

WP Film Studio < 1.3.5 - Arbitrary Plugin Activation via CSRF

The WP Film Studio WordPress plugin before 1.3.5 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hasthemes
Products
Wp Film Studio
CVE-2023-0484

Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks < 1.1.6 - Arbitrary Plugin Activation via CSRF

The Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hasthemes
Products
Contact Form 7 Widget For Elementor Page Builder \& Gutenberg Blocks
CVE-2023-1089

Coupon Zen < 1.0.6 - Arbitrary Plugin Activation via CSRF

The Coupon Zen WordPress plugin before 1.0.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hasthemes
Products
Coupon Zen
CVE-2023-0504

HT Politic < 2.3.8 - Arbitrary Plugin Activation via CSRF

The HT Politic WordPress plugin before 2.3.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hasthemes
Products
Ht Politic
CVE-2023-1087

WC Sales Notification < 1.2.3 - Arbitrary Plugin Activation via CSRF

The WC Sales Notification WordPress plugin before 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hasthemes
Products
Wc Sales Notification
CVE-2023-0496

HT Event < 1.4.6 - Arbitrary Plugin Activation via CSRF

The HT Event WordPress plugin before 1.4.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hasthemes
Products
Ht Event
CVE-2023-23899

WordPress Extensions For CF7 Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Extensions For CF7 plugin <= 2.0.8 versions leads to arbitrary plugin activation.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hasthemes
Products
Extensions For Cf7
CVE-2023-23801

WordPress Really Simple Google Tag Manager Plugin <= 1.0.6 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Really Simple Google Tag Manager plugin <= 1.0.6 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hasthemes
Products
Really Simple Google Tag Manager
CVE-2024-35699

WordPress HT Feed plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HasThemes HT Feed allows Stored XSS.This issue affects HT Feed: from n/a through 1.2.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hasthemes
Products
Ht Feed
CVE-2023-32962

WordPress WishSuite Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in HasTheme WishSuite – Wishlist for WooCommerce plugin <= 1.3.4 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Hasthemes
Products
Wishsuite
CVE-2023-23804

WordPress HT Feed Plugin <= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Feed plugin <= 1.2.7 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hasthemes
Products
Ht Feed
CVE-2023-23803

WordPress JustTables – WooCommerce Product Table Plugin <= 1.4.9 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in HasThemes JustTables plugin <= 1.4.9 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hasthemes
Products
Justtables
CVE-2023-23792

WordPress Swatchly – WooCommerce Variation Swatches for Products Plugin <= 1.2.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Swatchly plugin <= 1.2.0 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hasthemes
Products
Swatchly
CVE-2023-23791

WordPress HT Menu Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Menu plugin <= 1.2.1 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hasthemes
Products
Ht Menu
CVE-2023-23731

WordPress WishSuite Plugin <= 1.3.3 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in HasTheme WishSuite plugin <= 1.3.3 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hasthemes
Products
Wishsuite
CVE-2021-24262

WooLentor - WooCommerce Elementor Addons + Builder < 1.8.6 - Contributor+ Stored XSS

The “WooLentor – WooCommerce Elementor Addons + Builder” WordPress Plugin before 1.8.6 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Hasthemes
Products
Woolentor - Woocommerce Elementor Addons \+ Builder
CVE-2021-24261

HT Mega - Absolute Addons for Elementor Page Builder < 1.5.7 - Contributor+ Stored XSS

The “HT Mega – Absolute Addons for Elementor Page Builder” WordPress Plugin before 1.5.7 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Hasthemes
Products
Ht Mega