Vulnerabilities

TI-2026-21549 CVE-2026-27090 · GHSA-j9vh-hh8h-9h88

WordPress Kenta Companion plugin <= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in WP Moose Kenta Companion kenta-companion allows Cross Site Request Forgery.This issue affects Kenta Companion: from n/a through <= 1.3.3.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00117 Published 2026-02-19 No fix listed CWE-352

TI-2022-04562 CVE-2022-4974 · GHSA-p5fp-r7v7-h5q7

Freemius SDK <= 2.4.2 - Missing Authorization Checks

LOW 28

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_de…

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00442 Published 2024-10-16 Fixed in 2.0.2, 1.9.8 +273 CWE-862

TI-2024-23600 CVE-2024-35731 · GHSA-68gf-jrwr-p596

WordPress Kenta Gutenberg Blocks plugin <= 1.3.9 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Moose Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor allows Store…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0027 Published 2024-06-08 No fix listed CWE-79

TI-2024-01810 CVE-2024-1943 · GHSA-j5gc-9h38-mfq7

Yuki <= 1.3.14 - Cross-Site Request Forgery to Theme Setting Reset

LOW 19

The Yuki theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including 1.3.14.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.0021 Published 2024-02-28 No fix listed CWE-352

TI-2024-01295 CVE-2024-1388 · GHSA-pf5w-4v9j-2h6f

Yuki <= 1.3.13 - Missing Authorization to Authenticated (Subscriber+) Theme Setting Reset

LOW 20

The Yuki theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_customizer_options() function in all versions up to, and including, 1.3.13.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0034 Published 2024-02-28 No fix listed CWE-862