Duongancol Woostify vulnerabilities

2 vulnerabilities

Known vulnerabilities in Duongancol Woostify, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.9MediumCVE-2025-60101duongancol · woostify +1 moreWordPress Woostify Theme <= 2.4.2 - Cross Site Scripting (XSS) VulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in duongancol Woostify woostify allows Stored XSS.This issue affects Woostify: from n/a through <= 2.4.2.EPSS0.22%6.4MediumCVE-2026-4805duongancol · woostify +1 moreWoostify <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lity.js Library via data-lity Attribute in Custom HTML BlockThe Woostify plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 This is due to insufficient input sanitization and output escaping in the bundled Lity.js lightbox library, where user-controlled input from the href attribute is concatenated directly into a jQuery HTML string without sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.35%