Vendor CVEs

Ithemes

All CVEs

25 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2020-14092	WordPress Payment Form For Paypal Pro	Cri	0.71	9.8	0.95	Jul 2, 2020	The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.
CVE-2022-31474	Ithemes Backupbuddy	Hig	0.54	7.5	0.64	Mar 13, 2023	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1.
CVE-2018-12636	Ithemes Security	Hig	0.52	7.2	0.30	Jun 22, 2018	The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs page.
CVE-2020-36176	Ithemes Ithemes Security	Hig	0.49	7.5	0.01	Jan 6, 2021	The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until the second login occurs.
CVE-2018-7433	Ithemes Security	Hig	0.49	7.5	0.01	Mar 2, 2018	The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.
CVE-2022-4897	WordPress BackupBuddy	Med	0.40	6.1	0.01	Feb 21, 2023	The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, leading to Reflected Cross-Site Scripting
CVE-2015-9379	Ithemes Builder Style Manager	Med	0.40	6.1	0.01	Aug 28, 2019	iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9378	Ithemes Builder Theme Market	Med	0.40	6.1	0.01	Aug 28, 2019	iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9377	Ithemes Builder Theme Depot	Med	0.40	6.1	0.01	Aug 28, 2019	iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9376	Ithemes Mobile	Med	0.40	6.1	0.01	Aug 28, 2019	iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9375	Ithemes Table Rate Shipping	Med	0.40	6.1	0.01	Aug 28, 2019	Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9374	Ithemes Stripe	Med	0.40	6.1	0.01	Aug 28, 2019	Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9372	Ithemes Membership	Med	0.40	6.1	0.01	Aug 28, 2019	Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9371	Ithemes Manual Purchases	Med	0.40	6.1	0.01	Aug 28, 2019	Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9370	Ithemes Invoices	Med	0.40	6.1	0.01	Aug 28, 2019	Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9369	Ithemes Easy Us Sales Taxes	Med	0.40	6.1	0.01	Aug 28, 2019	Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9368	WordPress Easy EU Value Added (VAT) Taxes Add-on	Med	0.40	6.1	0.01	Aug 28, 2019	Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9367	Ithemes Easy Canadian Sales Taxes	Med	0.40	6.1	0.01	Aug 28, 2019	Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9366	Ithemes Custom URL Tracking	Med	0.40	6.1	0.01	Aug 28, 2019	Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9365	Ithemes Authorize.net	Med	0.40	6.1	0.01	Aug 28, 2019	Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9363	Ithemes Exchange	Med	0.40	6.1	0.01	Aug 28, 2019	iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2013-2744	WordPress BackupBuddy		0.00	—	0.02	Apr 2, 2013	importbuddy.php in the BackupBuddy plugin 2.2.25 for WordPress allows remote attackers to obtain configuration information via a step 0 phpinfo action, which calls the phpinfo function.
CVE-2013-2743	WordPress BackupBuddy		0.00	—	0.03	Apr 2, 2013	importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress allows remote attackers to bypass authentication via a crafted integer in the step parameter.
CVE-2013-2742	WordPress BackupBuddy		0.00	—	0.02	Apr 2, 2013	importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not reliably delete itself after completing a restore operation, which makes it easier for remote attackers to obtain access via subsequent requests to this script.
CVE-2013-2741	WordPress BackupBuddy		0.00	—	0.03	Apr 2, 2013	importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite or delete files, via vectors involving a (1) direct…

CVE-2020-14092CriJul 2, 2020
WordPress
Payment Form For Paypal Pro
risk 0.71cvss 9.8epss 0.95
The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.
CVE-2022-31474HigMar 13, 2023
Ithemes
Backupbuddy
risk 0.54cvss 7.5epss 0.64
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1.
CVE-2018-12636HigJun 22, 2018
Ithemes
Security
risk 0.52cvss 7.2epss 0.30
The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs page.
CVE-2020-36176HigJan 6, 2021
Ithemes
Ithemes Security
risk 0.49cvss 7.5epss 0.01
The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until the second login occurs.
CVE-2018-7433HigMar 2, 2018
Ithemes
Security
risk 0.49cvss 7.5epss 0.01
The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.
CVE-2022-4897MedFeb 21, 2023
WordPress
BackupBuddy
risk 0.40cvss 6.1epss 0.01
The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, leading to Reflected Cross-Site Scripting
CVE-2015-9379MedAug 28, 2019
Ithemes
Builder Style Manager
risk 0.40cvss 6.1epss 0.01
iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9378MedAug 28, 2019
Ithemes
Builder Theme Market
risk 0.40cvss 6.1epss 0.01
iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9377MedAug 28, 2019
Ithemes
Builder Theme Depot
risk 0.40cvss 6.1epss 0.01
iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9376MedAug 28, 2019
Ithemes
Mobile
risk 0.40cvss 6.1epss 0.01
iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9375MedAug 28, 2019
Ithemes
Table Rate Shipping
risk 0.40cvss 6.1epss 0.01
Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9374MedAug 28, 2019
Ithemes
Stripe
risk 0.40cvss 6.1epss 0.01
Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9372MedAug 28, 2019
Ithemes
Membership
risk 0.40cvss 6.1epss 0.01
Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9371MedAug 28, 2019
Ithemes
Manual Purchases
risk 0.40cvss 6.1epss 0.01
Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9370MedAug 28, 2019
Ithemes
Invoices
risk 0.40cvss 6.1epss 0.01
Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9369MedAug 28, 2019
Ithemes
Easy Us Sales Taxes
risk 0.40cvss 6.1epss 0.01
Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9368MedAug 28, 2019
WordPress
Easy EU Value Added (VAT) Taxes Add-on
risk 0.40cvss 6.1epss 0.01
Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9367MedAug 28, 2019
Ithemes
Easy Canadian Sales Taxes
risk 0.40cvss 6.1epss 0.01
Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9366MedAug 28, 2019
Ithemes
Custom URL Tracking
risk 0.40cvss 6.1epss 0.01
Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9365MedAug 28, 2019
Ithemes
Authorize.net
risk 0.40cvss 6.1epss 0.01
Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2015-9363MedAug 28, 2019
Ithemes
Exchange
risk 0.40cvss 6.1epss 0.01
iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
CVE-2013-2744Apr 2, 2013
WordPress
BackupBuddy
risk 0.00cvss —epss 0.02
importbuddy.php in the BackupBuddy plugin 2.2.25 for WordPress allows remote attackers to obtain configuration information via a step 0 phpinfo action, which calls the phpinfo function.
CVE-2013-2743Apr 2, 2013
WordPress
BackupBuddy
risk 0.00cvss —epss 0.03
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress allows remote attackers to bypass authentication via a crafted integer in the step parameter.
CVE-2013-2742Apr 2, 2013
WordPress
BackupBuddy
risk 0.00cvss —epss 0.02
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not reliably delete itself after completing a restore operation, which makes it easier for remote attackers to obtain access via subsequent requests to this script.
CVE-2013-2741Apr 2, 2013
WordPress
BackupBuddy
risk 0.00cvss —epss 0.03
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite or delete files, via vectors involving a (1) direct…