YellowPencil

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

YellowPencil records in CISA KEV

No YellowPencil vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Visual Css Style Editor 2 records MEDIUM

Records

3 records

TI-2019-08912 CVE-2019-11886 · GHSA-hrmr-jgrx-82h5

The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin…

MEDIUM 42

The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.02281 Published 2019-05-13 No fix listed CWE-352

TI-2024-31666 CVE-2024-47348 · GHSA-6h8v-9rcv-rf6g

WordPress Visual CSS Style Editor plugin <= 7.6.4 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YellowPencil YellowPencil Visual CSS Style Editor yellow-pencil-visual-theme-customizer allows Reflected XSS.This issu…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0032 Published 2024-10-06 No fix listed CWE-79

TI-2021-07213 CVE-2021-24934 · GHSA-7579-2v4g-9grv

Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site Scripting

LOW 30

The Visual CSS Style Editor WordPress plugin before 7.5.4 does not sanitise and escape the wyp_page_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01397 Published 2022-02-01 Fixed in 7.5.4 CWE-79

Open these records in search →

Critical	0
High	2
Medium	1
Low	0
No CVSS	0