Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

20 records

Vendor: frenify Clear all filters
TI-2026-22417 CVE-2026-28076 · GHSA-xh96-fgxf-4776

WordPress Guff theme <= 1.0.1 - Broken Access Control vulnerability

Priority LOW 39

Missing Authorization vulnerability in Frenify Guff guff allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Guff: from n/a through <= 1.0.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00333 Published 2026-03-05 No fix listed CWE-862
TI-2025-42536 CVE-2025-69082 · GHSA-83wc-rp5h-7428

WordPress Arlo theme <= 6.0.3 - Cross Site Scripting (XSS) vulnerability

Priority LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frenify Arlo arlo allows Reflected XSS.This issue affects Arlo: from n/a through <= 6.0.3.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00173 Published 2026-01-07 No fix listed CWE-79
TI-2025-36648 CVE-2025-59005 · GHSA-x484-hwjq-gwhw

WordPress Categorify plugin <= 1.0.7.5 - Broken Access Control vulnerability

Priority LOW 19

Missing Authorization vulnerability in frenify Categorify categorify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Categorify: from n/a through <= 1.0.7.5.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00192 Published 2025-09-09 No fix listed CWE-862
TI-2025-26217 CVE-2025-39475 · GHSA-cg65-x457-rg79

WordPress Arlo theme <= 6.0.3 - Local File Inclusion Vulnerability

Priority LOW 38

Path Traversal: '.../...//' vulnerability in Frenify Arlo arlo allows PHP Local File Inclusion.This issue affects Arlo: from n/a through <= 6.0.3.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00678 Published 2025-06-09 No fix listed CWE-35
TI-2022-04562 CVE-2022-4974 · GHSA-p5fp-r7v7-h5q7

Freemius SDK <= 2.4.2 - Missing Authorization Checks

Priority LOW 28

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_de…

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00442 Published 2024-10-16 Fixed in 2.0.2, 1.9.8 +273 CWE-862
TI-2024-00351 CVE-2024-0385 · GHSA-j6vr-hf47-35cx

Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxAddCategory

Priority LOW 21

The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxAddCategory function in all versions up to, and including, 1.0.7.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00578 Published 2024-03-13 No fix listed CWE-862
TI-2024-01533 CVE-2024-1650 · GHSA-mh5w-fqqj-wc98

Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxRenameCategory

Priority LOW 20

The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxRenameCategory function in all versions up to, and including, 1.0.7.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0034 Published 2024-02-27 No fix listed CWE-862
TI-2024-01532 CVE-2024-1649 · GHSA-qpqx-323c-39p3

Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxDeleteCategory

Priority LOW 20

The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxDeleteCategory function in all versions up to, and including, 1.0.7.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0034 Published 2024-02-27 No fix listed CWE-862
TI-2024-01535 CVE-2024-1652 · GHSA-4jc2-fxpv-j9j3

Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxClearCategory

Priority LOW 20

The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxClearCategory function in all versions up to, and including, 1.0.7.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0034 Published 2024-02-27 No fix listed CWE-862
TI-2024-01536 CVE-2024-1653 · GHSA-cg84-jfhr-gr28

Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxUpdateFolderPosition

Priority LOW 20

The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxUpdateFolderPosition in all versions up to, and including, 1.0.7.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0034 Published 2024-02-27 No fix listed CWE-862
TI-2023-00278 CVE-2023-0293 · GHSA-p7xw-hxjp-35w2

Mediamatic – Media Library Folders <= 2.8.1 - Missing Authorization

Priority LOW 21

The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.8.1.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00594 Published 2023-01-13 No fix listed CWE-862
TI-2021-07130 CVE-2021-24848 · GHSA-wp8f-r7rg-qrpg

Mediamatic < 2.8.1 - Subscriber+ SQL Injection

Priority MEDIUM 41

The mediamaticAjaxRenameCategory AJAX action of the Mediamatic WordPress plugin before 2.8.1, available to any authenticated user, does not sanitise the categoryID parameter before using it in a SQL statement, leading to…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01361 Published 2021-12-13 Fixed in 2.8.1 CWE-89