iThemes

Records27All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

iThemes records in CISA KEV

No iThemes vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Backupbuddy 6 records HIGH Security 2 records MEDIUM Authorize.net 1 record LOW Builder Style Manager 1 record LOW Builder Theme Depot 1 record LOW Builder Theme Market 1 record LOW Custom Url Tracking 1 record LOW Easy Canadian Sales Taxes 1 record LOW

Records

27 records

TI-2020-11034 CVE-2020-14092 · GHSA-5mq6-276f-rr67

The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.

CRITICAL 86

The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.9453 Published 2020-07-02 No fix listed CWE-89

TI-2022-13400 CVE-2022-31474 · GHSA-mvpf-v9m4-52gp

WordPress BackupBuddy Plugin 8.5.8.0-8.7.4.1 is vulnerable to Directory Traversal

HIGH 74

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.63761 Published 2023-03-13 No fix listed CWE-22

TI-2022-04488 CVE-2022-4897 · GHSA-p8wr-66q2-pvj4

BackupBuddy < 8.8.3 - Multiple Reflected Cross-Site Scripting

MEDIUM 60

The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, leading to Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00858 Published 2023-02-21 Fixed in 8.8.3

TI-2018-09073 CVE-2018-12636 · GHSA-7wrw-mvgr-jqmr

The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL…

MEDIUM 55

The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs page.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.28844 Published 2018-06-22 No fix listed CWE-89

TI-2013-02402 CVE-2013-2743 · GHSA-pjrx-65pg-8jmf

importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for…

LOW 38

importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress allows remote attackers to bypass authentication via a crafted integer in the step parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02563 Published 2013-04-02 No fix listed CWE-287

TI-2013-02400 CVE-2013-2741 · GHSA-443f-w88g-369p

importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for…

LOW 38

importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02563 Published 2013-04-02 No fix listed CWE-287

TI-2013-02401 CVE-2013-2742 · GHSA-wrrh-7p36-j3qq

importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for…

LOW 37

importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not reliably delete itself after completing a restore operation, which makes it easier for remote attackers to obtain a…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0243 Published 2013-04-02 No fix listed

TI-2018-05358 CVE-2018-7433 · GHSA-mhjj-g9cv-766w

The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.

LOW 36

The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01377 Published 2018-03-02 No fix listed CWE-532

TI-2020-18496 CVE-2020-36176 · GHSA-v943-hr28-2mp8

The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does…

LOW 35

The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until the second login occurs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01308 Published 2021-01-06 No fix listed CWE-287

TI-2022-22629 CVE-2022-45825 · GHSA-g42j-f43v-6x6m

WordPress WPComplete Plugin <= 2.9.4 is vulnerable to Cross Site Scripting (XSS)

LOW 32

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in iThemes WPComplete plugin <= 2.9.2 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00521 Published 2023-03-28 No fix listed CWE-79

TI-2025-31810 CVE-2025-49895 · GHSA-xwf4-mvc8-9xvx

WordPress ServerBuddy by PluginBuddy.com plugin <= 1.0.5 - CSRF to PHP Object Injection vulnerability

LOW 30

Cross-Site Request Forgery (CSRF) vulnerability in iThemes ServerBuddy by PluginBuddy.Com allows Object Injection.This issue affects ServerBuddy by PluginBuddy.Com: from n/a through 1.0.5.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00172 Published 2025-08-16 No fix listed CWE-352

TI-2015-07756 CVE-2015-9379 · GHSA-9cfm-hvjx-m4cp

iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().

LOW 29

iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().