Vowelweb vulnerabilities
22 vulnerabilities
Known vulnerabilities in Vowelweb products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 16 products.
Products
16- Ibtana6 vulnerabilities
- Ibtana – Wordpress Website Builder5 vulnerabilities
- Ibtana – Ecommerce Product Addons1 vulnerabilities
- Industrial Lite1 vulnerabilities
- Sirat1 vulnerabilities
- VW Automobile Lite1 vulnerabilities
- VW Education Lite1 vulnerabilities
- VW Fitness1 vulnerabilities
- VW Food Corner1 vulnerabilities
- VW Pet Shop1 vulnerabilities
- VW Photography1 vulnerabilities
- VW Portfolio1 vulnerabilities
- VW School Education1 vulnerabilities
- VW Storefront1 vulnerabilities
- VW Wedding1 vulnerabilities
- VW Writer Blog1 vulnerabilities
CVE-2021-25014unknownibtana – wordpress website builder+2
EPSS score0.59%
The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to Stored Cross-Site Scripting issue.CVE-2025-26955vowelwebindustrial lite+1EPSS score0.34%
Missing Authorization vulnerability in vowelweb Industrial Lite industrial-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Industrial Lite: from n/a through <= 1.0.8.CVE-2025-39385vowelwebsirat+1EPSS score0.32%
Missing Authorization vulnerability in vowelweb Sirat sirat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sirat: from n/a through <= 1.5.1.CVE-2025-5092famethemesonepress+15EPSS score0.26%
Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2022-4674unknownibtana+2EPSS score0.56%
The Ibtana WordPress plugin before 1.1.8.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attackCVE-2024-13686vowelwebvw storefront+2EPSS score0.29%
The VW Storefront theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vw_storefront_reset_all_settings() function in all versions up to, and including, 0.9.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the themes settings.CVE-2024-37123vowelwebibtanaEPSS score0.36%
Missing Authorization vulnerability in VowelWeb Ibtana allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ibtana: from n/a through 1.2.3.3.CVE-2024-56234vowelwebvw automobile lite+1EPSS score0.32%
Missing Authorization vulnerability in vowelweb VW Automobile Lite vw-automobile-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Automobile Lite: from n/a through <= 2.1.CVE-2024-5541vowelwebibtana+2EPSS score0.46%
The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ibtana_visual_editor_register_ajax_json_endpont' function in all versions up to, and including, 1.2.3.3. This makes it possible for unauthenticated attackers to update option values for reCAPTCHA keys on the WordPress site. This can be leveraged to bypass reCAPTCHA on the site. CVE-2024-37123 is likely a duplicate of this issue.CVE-2024-8282vowelwebibtana+2EPSS score0.33%
The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:ive/ive-productscarousel' Gutenberg block in all versions up to, and including, 1.2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2026-2278vowelwebvw writer blog+1EPSS score0.20%
The VW Writer Blog theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'vw_writer_blog_reset_all_settings' function in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset all theme customizer settings to their defaults.CVE-2026-1984vowelwebibtana – ecommerce product addons+1EPSS score0.23%
The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepa_use_gt_editor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update or delete arbitrary post meta entries via the 'iepa_builder' meta key.CVE-2026-1834vowelwebibtana – wordpress website builder+1EPSS score0.20%
The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ive' shortcode in all versions up to, and including, 1.2.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2026-57774vowelwebvw food corner+1EPSS score0.41%
Missing Authorization vulnerability in vowelweb VW Food Corner vw-food-corner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Food Corner: from n/a through <= 1.1.0.CVE-2026-57776vowelwebvw wedding+1EPSS score0.41%
Missing Authorization vulnerability in vowelweb VW Wedding vw-wedding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Wedding: from n/a through <= 1.3.7.CVE-2026-32434vowelwebvw fitness+1EPSS score0.33%
Missing Authorization vulnerability in vowelweb VW Fitness vw-fitness allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Fitness: from n/a through <= 4.3.4.CVE-2026-32435vowelwebvw pet shop+1EPSS score0.33%
Missing Authorization vulnerability in vowelweb VW Pet Shop vw-pet-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Pet Shop: from n/a through <= 1.4.7.CVE-2026-32438vowelwebvw school education+1EPSS score0.33%
Missing Authorization vulnerability in vowelweb VW School Education vw-school-education allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW School Education: from n/a through <= 1.4.6.CVE-2026-32427vowelwebvw education lite+1EPSS score0.33%
Missing Authorization vulnerability in vowelweb VW Education Lite vw-education-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Education Lite: from n/a through <= 2.2.0.CVE-2026-32436vowelwebvw photography+1EPSS score0.33%
Missing Authorization vulnerability in vowelweb VW Photography vw-photography allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Photography: from n/a through <= 1.3.8.