Read the docs

Catch Plugins

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

Catch Plugins records in CISA KEV

No Catch Plugins vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Catch Themes Demo Import 3 records HIGH Catch Breadcrumb 1 record LOW Catch Scroll Progress Bar 1 record LOW Catch Sticky Menu 1 record LOW Catch Under Construction 1 record LOW Catch Web Tools 1 record LOW Essential Content Types 1 record LOW Essential Widgets 1 record LOW

Records

3 records in Catch Themes Demo Import · all components

TI-2021-16719 CVE-2021-39352 · GHSA-p6rq-prcm-f9fw

Catch Themes Demo Import <= 1.7 Admin+ Arbitrary File Upload

Priority HIGH 67

The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficie…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.56259 Published 2021-10-21 No fix listed CWE-434
TI-2022-00363 CVE-2022-0440 · GHSA-8h3q-6j29-4729

Catch Themes Demo Import < 2.1.1 - Admin+ Remote Code Execution

Priority LOW 35

The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload an arbitrary PHP file and gain RCE even in the case of an ha…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01442 Published 2022-03-07 Fixed in 2.1.1 CWE-434
TI-2021-07034 CVE-2021-24752 · GHSA-qcgq-c97q-26vw

Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting Change

Priority LOW 26

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPres…

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00422 Published 2021-10-18 Fixed in 1.9, 2.3 +6 CWE-284
Open these records in search →