Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-113387

Authentication Bypass in Ortto WordPress Plugin Enables Arbitrary Script Overwrite

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Canva Wordpress-extensions
Products
Ortto Ortto
CVE-2026-114173

Ortto WordPress Plugin Unfiltered WooCommerce Data Exposure

The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Canva Wordpress-extensions
Products
Ortto Ortto
CVE-2026-113409

Stored XSS in Ortto WordPress Plugin Settings

The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted page.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Canva Wordpress-extensions
Products
Ortto Ortto