Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Themify 1.4.4 Clear all filters
TI-2024-02115 CVE-2024-2278 · GHSA-492v-6h78-6p3g

WooCommerce Product Filter < 1.4.4 - Admin+ Stored XSS

Priority LOW 28

Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltere…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0042 Published 2024-04-01 Fixed in 1.4.4 CWE-79
TI-2024-02100 CVE-2024-2263 · GHSA-363m-3jp4-qg24

WooCommerce Product Filter < 1.4.4 - Reflected XSS

Priority MEDIUM 55

Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as a…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00402 Published 2024-04-01 Fixed in 1.4.4 CWE-79
TI-2024-02099 CVE-2024-2262 · GHSA-mqx4-g9cq-jvc6

WooCommerce Product Filter < 1.4.4 - Filter Deletion via CSRF

Priority MEDIUM 55

Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00237 Published 2024-04-01 Fixed in 1.4.4 CWE-352