Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: envato Clear all filters
TI-2024-25050 CVE-2024-37550 · GHSA-4pmv-jg56-hh93

WordPress Template Kit – Export plugin <= 1.0.22 - Cross Site Scripting (XSS) vulnerability

Priority LOW 26

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Envato Template Kit – Export allows Stored XSS.This issue affects Template Kit – Export: from n/a through 1.0.2…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00276 Published 2024-07-21 No fix listed CWE-79
TI-2024-02169 CVE-2024-2334 · GHSA-gc37-9w9h-6m6g

Template Kit – Import <= 1.0.14 - Authenticated(Author+) Stored Cross-Site Scripting via template upload

Priority LOW 29

The Template Kit – Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the template upload functionality in all versions up to, and including, 1.0.14 due to insufficient input sanitization and ou…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00446 Published 2024-04-09 No fix listed CWE-434
TI-2021-03188 CVE-2021-4330 · GHSA-975q-7mxh-v8gj

Envato Elements <= 2.0.10 & Template Kit <= 1.0.13 - Authenticated (Contributor+) Arbitrary File Upload

Priority MEDIUM 43

The Envato Elements & Download and Template Kit – Import plugins for WordPress are vulnerable to arbitrary file uploads due to insufficient validation of file type upon extracting uploaded Zip files in the installFreeTem…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01514 Published 2023-03-07 No fix listed CWE-434