Read the docs

extendify

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

extendify records in CISA KEV

No extendify vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Editorskit 2 records MEDIUM

Records

3 records

TI-2021-06831 CVE-2021-24546 · GHSA-69mw-rrjx-rv39

EditorsKit < 1.31.6 - Contributor+ Arbitrary PHP Code Execution

Priority MEDIUM 42

The Gutenberg Block Editor Toolkit – EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility settings, allowing users with a role as low contributor to exec…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01811 Published 2021-10-11 Fixed in 1.31.6 CWE-94
TI-2023-06081 CVE-2023-6635 · GHSA-q54q-m468-q77v

EditorsKit <= 1.40.3 - Authenticated (Administrator+) Arbitrary File Upload

Priority LOW 37

The EditorsKit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the 'import_styles' function in versions up to, and including, 1.40.3.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01537 Published 2024-02-05 No fix listed CWE-434
TI-2026-58791 CVE-2026-85679 · GHSA-xx9f-33qf-3g5j

Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key

Priority LOW 31

The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00307 Published 2026-10-01 No fix listed CWE-79
Open these records in search →