Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Vendor: FuturioWP Clear all filters
TI-2024-36000 CVE-2024-53802 · GHSA-7jrc-cqc8-pcqm

WordPress Futurio Extra plugin <= 2.0.14 - Cross Site Scripting (XSS) vulnerability

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio Extra futurio-extra allows Stored XSS.This issue affects Futurio Extra: from n/a through <= 2.0.14.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00317 Published 2024-12-06 No fix listed CWE-79
TI-2024-09910 CVE-2024-10695 · GHSA-h2f7-qhqc-h8gv

Futurio Extra <= 2.0.13 - Authenticated (Contributor+) Post Disclosure

Priority LOW 20

The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.13 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be incl…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00309 Published 2024-11-12 No fix listed CWE-639
TI-2024-33878 CVE-2024-50446 · GHSA-fvjx-c7j7-q6v8

WordPress Futurio Extra plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio Extra futurio-extra.This issue affects Futurio Extra: from n/a through <= 2.0.11.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00261 Published 2024-10-28 No fix listed CWE-79
TI-2024-05242 CVE-2024-5646 · GHSA-4hgh-53h4-32cw

Futurio Extra <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Text Block Widget

Priority LOW 28

The Futurio Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘header_size’ attribute within the Advanced Text Block widget in all versions up to, and including, 2.0.5 due to insufficient in…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00314 Published 2024-06-11 No fix listed CWE-79
TI-2021-07388 CVE-2021-25110 · GHSA-7vff-h48x-c683

Futurio Extra < 1.6.3 - Subscriber+ User Email Address Disclosure

Priority LOW 22

The Futurio Extra WordPress plugin before 1.6.3 allows any logged in user, such as subscriber, to extract any other user's email address.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00897 Published 2022-02-14 Fixed in 1.6.3 CWE-200
TI-2021-07387 CVE-2021-25109 · GHSA-m7g9-v8qx-6hfp

Futurio Extra < 1.6.3 - Authenticated SQL Injection

Priority LOW 15

The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the database as well as used to perform Cross-Site Scripting (X…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00846 Published 2022-02-14 Fixed in 1.6.3 CWE-89