Themify

Portfolio Post

6 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.5

CVE-2025-67533

  • EPSS 0.05%
  • Veröffentlicht 09.12.2025 14:14:03
  • Zuletzt bearbeitet 20.01.2026 15:19:18

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Portfolio Post themify-portfolio-post allows Stored XSS.This issue affects Themify Portfolio Post: from n/a through <= 1.3.0.

5.4

CVE-2022-32970

  • EPSS 0.09%
  • Veröffentlicht 10.05.2023 09:15:09
  • Zuletzt bearbeitet 21.11.2024 07:07:20

Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Themify Themify Portfolio Post plugin <= 1.2.4 versions.

5.4

CVE-2023-0362

Exploit
  • EPSS 0.18%
  • Veröffentlicht 13.02.2023 15:15:22
  • Zuletzt bearbeitet 21.03.2025 18:15:30

Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to...

5.4

CVE-2022-4464

Exploit
  • EPSS 0.25%
  • Veröffentlicht 16.01.2023 16:15:12
  • Zuletzt bearbeitet 08.04.2025 20:15:18

Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scri...

5.4

CVE-2022-0200

Exploit
  • EPSS 0.21%
  • Veröffentlicht 14.02.2022 12:15:16
  • Zuletzt bearbeitet 21.11.2024 06:38:07

Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading...

5.4

CVE-2021-24129

Exploit
  • EPSS 0.16%
  • Veröffentlicht 18.03.2021 15:15:14
  • Zuletzt bearbeitet 21.11.2024 05:52:24

Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting (XSS) vulnerabilities allowing low-privileged users (Contributor+) to inject arbitrary JavaScript...