TI-2026-12908 CVE-2026-15336 · GHSA-pp39-pq9r-8cpp
Missing authorization in Catch Themes Demo Import
Priority LOW 20
The Catch Themes Demo Import plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.3.
Vulnerabilities
6 records
TI-2024-20655 CVE-2024-31279 · GHSA-p6f3-ww46-8prr
WordPress Generate Child Theme plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerability
Priority LOW 24
Cross-Site Request Forgery (CSRF) vulnerability in Catch Plugins Generate Child Theme.This issue affects Generate Child Theme: from n/a through 2.0.
TI-2022-00363 CVE-2022-0440 · GHSA-8h3q-6j29-4729
Catch Themes Demo Import < 2.1.1 - Admin+ Remote Code Execution
Priority LOW 35
The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload an arbitrary PHP file and gain RCE even in the case of an ha…
TI-2021-16719 CVE-2021-39352 · GHSA-p6rq-prcm-f9fw
Catch Themes Demo Import <= 1.7 Admin+ Arbitrary File Upload
Priority HIGH 67
The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficie…
TI-2021-07034 CVE-2021-24752 · GHSA-qcgq-c97q-26vw
Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting Change
Priority LOW 26
Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPres…
TI-2020-09712 CVE-2020-12054 · GHSA-jx7x-5r8p-6rpc
The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s…
Priority LOW 34
The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query).