Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: wpweaver Component: Weaver Xtreme Theme Support Clear all filters
TI-2024-04592 CVE-2024-4939 · GHSA-74g2-v5gc-hj7f

Weaver Xtreme Theme Support <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via div Shortcode

Priority LOW 28

The Weaver Xtreme Theme Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's div shortcode in all versions up to, and including, 6.4 due to insufficient input sanitization and output…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00273 Published 2024-06-05 No fix listed CWE-79
TI-2023-06391 CVE-2023-6990 · GHSA-p44f-cgp3-q8cf

Weaver Xtreme <= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 24

The Weaver Xtreme theme for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta in all versions up to, and including, 6.3.0 due to insufficient input sanitization and output escaping on user suppl…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00312 Published 2024-01-11 No fix listed CWE-79
TI-2023-04576 CVE-2023-4971 · GHSA-q8w9-3c5w-2mhv

Weaver Xtreme Theme Support < 6.3.1 - Admin+ PHP Object Injection

Priority HIGH 67

The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitab…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01186 Published 2023-10-16 Fixed in 6.3.1 CWE-502
TI-2023-00261 CVE-2023-0276 · GHSA-2237-qj4m-4cpq

Weaver Xtreme Theme Support < 6.2.7 - Contributor+ Stored XSS

Priority MEDIUM 58

The Weaver Xtreme Theme Support WordPress plugin before 6.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00471 Published 2023-04-24 Fixed in 6.2.7