Vulnerabilities

Filters

1 selected

27 records

Sort

Vendor: iThemes Clear all filters

TI-2025-31810 CVE-2025-49895 · GHSA-xwf4-mvc8-9xvx

WordPress ServerBuddy by PluginBuddy.com plugin <= 1.0.5 - CSRF to PHP Object Injection vulnerability

LOW 30

Cross-Site Request Forgery (CSRF) vulnerability in iThemes ServerBuddy by PluginBuddy.Com allows Object Injection.This issue affects ServerBuddy by PluginBuddy.Com: from n/a through 1.0.5.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00172 Published 2025-08-16 No fix listed CWE-352

TI-2022-22629 CVE-2022-45825 · GHSA-g42j-f43v-6x6m

WordPress WPComplete Plugin <= 2.9.4 is vulnerable to Cross Site Scripting (XSS)

LOW 32

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in iThemes WPComplete plugin <= 2.9.2 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00521 Published 2023-03-28 No fix listed CWE-79

TI-2022-13400 CVE-2022-31474 · GHSA-mvpf-v9m4-52gp

WordPress BackupBuddy Plugin 8.5.8.0-8.7.4.1 is vulnerable to Directory Traversal

HIGH 74

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.63761 Published 2023-03-13 No fix listed CWE-22

TI-2022-04488 CVE-2022-4897 · GHSA-p8wr-66q2-pvj4

BackupBuddy < 8.8.3 - Multiple Reflected Cross-Site Scripting

MEDIUM 60

The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, leading to Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00858 Published 2023-02-21 Fixed in 8.8.3

TI-2020-18496 CVE-2020-36176 · GHSA-v943-hr28-2mp8

The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does…

LOW 35

The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until the second login occurs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01308 Published 2021-01-06 No fix listed CWE-287

TI-2020-11034 CVE-2020-14092 · GHSA-5mq6-276f-rr67

The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.

CRITICAL 86

The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.9453 Published 2020-07-02 No fix listed CWE-89

TI-2015-07756 CVE-2015-9379 · GHSA-9cfm-hvjx-m4cp

iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().

LOW 29

iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0095 Published 2019-08-28 No fix listed CWE-79

TI-2015-07755 CVE-2015-9378 · GHSA-cr29-m84p-98f7

iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().

LOW 29

iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0095 Published 2019-08-28 No fix listed CWE-79

TI-2015-07754 CVE-2015-9377 · GHSA-vw5m-26rp-p472

iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg().

LOW 29

iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg().

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0095 Published 2019-08-28 No fix listed CWE-79

TI-2015-07753 CVE-2015-9376 · GHSA-vvv4-v4cq-h4xw

iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg().

LOW 29

iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg().

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0095 Published 2019-08-28 No fix listed CWE-79

TI-2015-07752 CVE-2015-9375 · GHSA-m3h6-h28v-jjqw

Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via…

LOW 29

Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0095 Published 2019-08-28 No fix listed CWE-79

TI-2015-07751 CVE-2015-9374 · GHSA-c786-q76j-q88p

Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

LOW 29

Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0095 Published 2019-08-28 No fix listed CWE-79

TI-2015-07749 CVE-2015-9372 · GHSA-g92w-jcmx-pv7h

Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

LOW 29

Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0095 Published 2019-08-28 No fix listed CWE-79

TI-2015-07748 CVE-2015-9371 · GHSA-83wr-cv67-fhj5

Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via…

LOW 29

Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0095 Published 2019-08-28 No fix listed CWE-79

TI-2015-07747 CVE-2015-9370 · GHSA-qc49-6v9h-j9r8

Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

LOW 29

Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0095 Published 2019-08-28 No fix listed CWE-79

TI-2015-07746 CVE-2015-9369 · GHSA-34jj-27w8-h7cm

Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via…

LOW 29

Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0095 Published 2019-08-28 No fix listed CWE-79

TI-2015-07745 CVE-2015-9368 · GHSA-wx2x-3mhq-g643

Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress…

LOW 29

Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0095 Published 2019-08-28 No fix listed CWE-79

TI-2015-07744 CVE-2015-9367 · GHSA-x27x-v2w2-jvfw

Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS…

LOW 29

Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0095 Published 2019-08-28 No fix listed CWE-79

TI-2015-07743 CVE-2015-9366 · GHSA-g7gc-7fp9-789g

Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via…

LOW 29

Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0095 Published 2019-08-28 No fix listed CWE-79

TI-2015-07742 CVE-2015-9365 · GHSA-849m-2f4c-x22v

Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

LOW 29

Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0095 Published 2019-08-28 No fix listed CWE-79

TI-2015-07740 CVE-2015-9363 · GHSA-w8p5-2cw9-xx96

iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

LOW 29

iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0095 Published 2019-08-28 No fix listed CWE-79

TI-2018-09073 CVE-2018-12636 · GHSA-7wrw-mvgr-jqmr

The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL…

MEDIUM 55

The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs page.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.28844 Published 2018-06-22 No fix listed CWE-89

TI-2018-05358 CVE-2018-7433 · GHSA-mhjj-g9cv-766w

The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.

LOW 36

The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01377 Published 2018-03-02 No fix listed CWE-532

TI-2013-02403 CVE-2013-2744 · GHSA-p56h-5fx4-p722

importbuddy.php in the BackupBuddy plugin 2.2.25 for WordPress allows remote attackers to…

LOW 27

importbuddy.php in the BackupBuddy plugin 2.2.25 for WordPress allows remote attackers to obtain configuration information via a step 0 phpinfo action, which calls the phpinfo function.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02136 Published 2013-04-02 No fix listed CWE-200

TI-2013-02402 CVE-2013-2743 · GHSA-pjrx-65pg-8jmf

importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for…

LOW 38

importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress allows remote attackers to bypass authentication via a crafted integer in the step parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02563 Published 2013-04-02 No fix listed CWE-287