Vulnerabilities

TI-2025-30477 CVE-2025-48107 · GHSA-6rg7-w758-9g9f

WordPress Uncode theme < 2.9.4.4 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in undsgn Uncode uncode allows Reflected XSS.This issue affects Uncode: from n/a through < 2.9.4.4.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0025 Published 2025-09-26 No fix listed CWE-79

TI-2025-06314 CVE-2025-6944 · GHSA-qqj8-fpcc-c8fr

Uncode Core <= 2.9.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes

LOW 28

The Uncode Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uncode_hl_text' and 'uncode_text_icon' shortcodes in all versions up to, and including, 2.9.4.2 due to insufficient inpu…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00217 Published 2025-07-04 No fix listed CWE-79

TI-2024-12728 CVE-2024-13689 · GHSA-3947-v5cg-rpwj

Uncode Core <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary Shortcode Execution in uncode_get_medias

LOW 28

The Uncode Core plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.9.1.6.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00461 Published 2025-02-18 No fix listed CWE-94

TI-2024-12730 CVE-2024-13691 · GHSA-95c2-4826-wj9h

Uncode <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary File Read in uncode_recordMedia

LOW 31

The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_recordMedia' function in all versions up to, and including, 2.9.1.6.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00395 Published 2025-02-18 No fix listed CWE-20

TI-2024-12706 CVE-2024-13667 · GHSA-h3q6-j7c5-cmp5

Uncode <= 2.9.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via mle-description

LOW 24

The Uncode theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mle-description’ parameter in all versions up to, and including, 2.9.1.6 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00246 Published 2025-02-18 No fix listed CWE-79

TI-2024-12720 CVE-2024-13681 · GHSA-82cf-jc67-6j74

Uncode <= 2.9.1.6 - Unauthenticated Arbitrary File Read in uncode_admin_get_oembed

MEDIUM 42

The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_admin_get_oembed' function in all versions up to, and including, 2.9.1.6.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00628 Published 2025-02-18 No fix listed CWE-20

TI-2023-28152 CVE-2023-51500 · GHSA-36fg-m6m3-3q45

WordPress Uncode Core plugin <= 2.8.8 - Arbitrary File Deletion vulnerability

LOW 34

Missing Authorization vulnerability in Undsgn Uncode Core.This issue affects Uncode Core: from n/a through 2.8.8.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00468 Published 2024-04-17 No fix listed CWE-862

TI-2023-28167 CVE-2023-51515 · GHSA-46q4-w4hr-5v2p

WordPress Uncode Core plugin <= 2.8.8 - Privilege Escalation vulnerability

MEDIUM 41

Missing Authorization vulnerability in Undsgn Uncode Core allows Privilege Escalation.This issue affects Uncode Core: from n/a through 2.8.8.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00547 Published 2024-04-12 No fix listed CWE-862

TI-2023-28153 CVE-2023-51501 · GHSA-3p46-hrfw-c9xm

WordPress Uncode Core Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Undsgn Uncode - Creative & WooCommerce WordPress Theme allows Reflected XSS.This issue affects Uncode - Creative & Woo…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00351 Published 2023-12-28 No fix listed CWE-79

Vulnerabilities

Filters