Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: extendify Clear all filters
TI-2026-58791 CVE-2026-85679 · GHSA-xx9f-33qf-3g5j

Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key

Priority LOW 31

The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00307 Published 2026-10-01 No fix listed CWE-79
TI-2023-06081 CVE-2023-6635 · GHSA-q54q-m468-q77v

EditorsKit <= 1.40.3 - Authenticated (Administrator+) Arbitrary File Upload

Priority LOW 37

The EditorsKit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the 'import_styles' function in versions up to, and including, 1.40.3.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01537 Published 2024-02-05 No fix listed CWE-434
TI-2021-06831 CVE-2021-24546 · GHSA-69mw-rrjx-rv39

EditorsKit < 1.31.6 - Contributor+ Arbitrary PHP Code Execution

Priority MEDIUM 42

The Gutenberg Block Editor Toolkit – EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility settings, allowing users with a role as low contributor to exec…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01811 Published 2021-10-11 Fixed in 1.31.6 CWE-94