Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: athemes Component: Sydney Toolbox Clear all filters
TI-2024-04161 CVE-2024-4473 · GHSA-7cf9-vp5v-3mxg

Sydney Toolbox <= 1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via aThemes: Portfolio Widget

Priority LOW 28

The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "aThemes: Portfolio" widget in all versions up to, and including, 1.31 due to insufficient input sanitization and output escapi…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00279 Published 2024-05-14 No fix listed CWE-79
TI-2024-03765 CVE-2024-4036 · GHSA-w4vp-v37v-r5rg

Sydney Toolbox <= 1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 29

The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the style parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00602 Published 2024-05-02 No fix listed CWE-79
TI-2024-03007 CVE-2024-3208 · GHSA-f993-46p6-8jh9

Sydney Toolbox <= 1.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery

Priority LOW 29

The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versions up to, and including, 1.28 due to insufficient input sanitization and output…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00387 Published 2024-04-09 No fix listed CWE-79
TI-2024-02744 CVE-2024-2936 · GHSA-p84f-xgwp-4frf

Sydney Toolbox <= 1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id

Priority LOW 28

The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id attribute of widgets in all versions up to, and including, 1.26 due to insufficient input sanitization and output escaping…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0034 Published 2024-03-29 No fix listed CWE-79
TI-2024-01351 CVE-2024-1447 · GHSA-xf62-wwm9-m968

Sydney Toolbox <= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 29

The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aThemes Slider button element in all versions up to, and including, 1.25 due to insufficient input sanitization and ou…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00428 Published 2024-02-20 No fix listed CWE-79