Ithemes vulnerabilities, page 2

27 vulnerabilities

Known vulnerabilities in Ithemes products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 21 products.

6.1CVE-2015-9368ithemeseasy_eu_value_added_\(vat\)_taxes+1
EPSS score
0.95%
Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().7.5CVE-2025-49895ithemesserverbuddy by pluginbuddy.com+1
EPSS score
0.16%
Cross-Site Request Forgery (CSRF) vulnerability in iThemes ServerBuddy by PluginBuddy.Com allows Object Injection.This issue affects ServerBuddy by PluginBuddy.Com: from n/a through 1.0.5.9.8CVE-2020-14092ithemespaypal_pro+1
EPSS score
94.53%
The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.7.5CVE-2020-36176ithemesithemes_security+1
EPSS score
1.31%
The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until the second login occurs.7.5CVE-2022-31474ithemesbackupbuddy+1
EPSS score
63.76%
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1.6.1CVE-2022-4897ithemesbackupbuddy+2
EPSS score
0.86%
The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, leading to Reflected Cross-Site Scripting7.1CVE-2022-45825ithemeswpcomplete+2
EPSS score
0.52%
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in iThemes WPComplete plugin <= 2.9.2 versions.