Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: canva ortto 1.0.25 Clear all filters
TI-2026-82267 CVE-2026-113409 · GHSA-j6f8-hmf7-xg6g

Stored cross-site scripting in Ortto plugin for WordPress

Priority LOW 21

The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00196 Published 2026-10-29 Fixed in 1.0.25 CWE-79
TI-2026-82266 CVE-2026-113387 · GHSA-jqqj-mjjm-8jrv

Ortto WordPress plugin missing authentication on config updates

Priority MEDIUM 43

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00287 Published 2026-10-29 Fixed in 1.0.25 CWE-306