Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: ApusThemes Clear all filters
TI-2024-11406 CVE-2024-12296 · GHSA-4vxh-jq3c-5rhw

Apus Framework <= 2.4 - Authenticated (Subscriber+) Arbitrary Options Update in import_page_options

Priority MEDIUM 41

The Apus Framework plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'import_page_options' function in all versions up…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00519 Published 2025-02-12 No fix listed CWE-862
TI-2023-00428 CVE-2023-0453 · GHSA-849q-f682-346f

WP Private Message < 1.0.6 - Private Message Disclosure via IDOR

Priority MEDIUM 53

The WP Private Message WordPress plugin (bundled with the Superio theme as a required plugin) before 1.0.6 does not ensure that private messages to be accessed belong to the user making the requests.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00551 Published 2023-02-21 Fixed in 1.0.6
TI-2022-03761 CVE-2022-4114 · GHSA-g5x7-r2mh-cg68

Superio - Job Board < 1.2.33 - Subscriber+ Stored Cross-Site Scripting

Priority MEDIUM 58

The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perform Cross-Site Scripting attacks.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00508 Published 2023-01-02 Fixed in 1.2.33
TI-2022-01056 CVE-2022-1167 · GHSA-rq6x-9xq3-jm42

CareerUp < 2.3.1 - Unauthenticated Reflected Cross-Site Scripting

Priority LOW 29

There are unauthenticated reflected Cross-Site Scripting (XSS) vulnerabilities in CareerUp Careerup WordPress theme before 2.3.1, via the filter parameters.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01118 Published 2022-04-04 Fixed in 2.3.1 CWE-79