Ithemes vulnerabilities
27 vulnerabilities
Known vulnerabilities in Ithemes products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 21 products.
Products
21- Backupbuddy6 vulnerabilities
- Security2 vulnerabilities
- Authorize.Net1 vulnerabilities
- Builder Style Manager1 vulnerabilities
- Builder Theme Depot1 vulnerabilities
- Builder Theme Market1 vulnerabilities
- Custom Url Tracking1 vulnerabilities
- Easy Canadian Sales Taxes1 vulnerabilities
- Easy Eu Value Added \(Vat\) Taxes1 vulnerabilities
- Easy Us Sales Taxes1 vulnerabilities
- Exchange1 vulnerabilities
- Invoices1 vulnerabilities
- Ithemes Security1 vulnerabilities
- Manual Purchases1 vulnerabilities
- Membership1 vulnerabilities
- Mobile1 vulnerabilities
- Paypal Pro1 vulnerabilities
- Serverbuddy By Pluginbuddy.Com1 vulnerabilities
- Stripe1 vulnerabilities
- Table Rate Shipping1 vulnerabilities
- Wpcomplete1 vulnerabilities
CVE-2018-7433ithemessecurity+1
EPSS score1.38%
The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.CVE-2018-12636ithemessecurity+1EPSS score29.78%
The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs page.CVE-2013-2743ithemesbackupbuddy+1EPSS score2.56%
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress allows remote attackers to bypass authentication via a crafted integer in the step parameter.CVE-2013-2744ithemesbackupbuddy+1EPSS score2.14%
importbuddy.php in the BackupBuddy plugin 2.2.25 for WordPress allows remote attackers to obtain configuration information via a step 0 phpinfo action, which calls the phpinfo function.CVE-2013-2742ithemesbackupbuddy+1EPSS score2.43%
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not reliably delete itself after completing a restore operation, which makes it easier for remote attackers to obtain access via subsequent requests to this script.CVE-2013-2741ithemesbackupbuddy+1EPSS score2.56%
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite or delete files, via vectors involving a (1) direct request, (2) step=1 request, (3) step=2 or step=3 request, or (4) step=7 request.CVE-2015-9369ithemeseasy_us_sales_taxes+1EPSS score0.95%
Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9377ithemesbuilder_theme_depot+1EPSS score0.95%
iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9378ithemesbuilder_theme_market+1EPSS score0.95%
iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9374ithemesstripe+1EPSS score0.95%
Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9372ithemesmembership+1EPSS score0.95%
Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9370ithemesinvoices+1EPSS score0.95%
Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9371ithemesmanual_purchases+1EPSS score0.95%
Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9363ithemesexchange+1EPSS score0.95%
iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9376ithemesmobile+1EPSS score0.95%
iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9375ithemestable_rate_shipping+1EPSS score0.95%
Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9366ithemescustom_url_tracking+1EPSS score0.95%
Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9365ithemesauthorize.net+1EPSS score0.95%
Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9367ithemeseasy_canadian_sales_taxes+1EPSS score0.95%
Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9379ithemesbuilder_style_manager+1EPSS score0.95%
iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().