Vowelweb

Ibtana

7 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.4

CVE-2025-5092

  • EPSS 0.04%
  • Veröffentlicht 20.11.2025 06:38:41
  • Zuletzt bearbeitet 24.11.2025 20:15:49

Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various versions due to insufficient input sanitization and output escaping on user supplied attrib...

5.3

CVE-2024-37123

  • EPSS 0.14%
  • Veröffentlicht 01.11.2024 15:15:19
  • Zuletzt bearbeitet 01.11.2024 20:24:53

Missing Authorization vulnerability in VowelWeb Ibtana allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ibtana: from n/a through 1.2.3.3.

5.4

CVE-2024-8282

  • EPSS 0.18%
  • Veröffentlicht 02.10.2024 10:15:04
  • Zuletzt bearbeitet 07.10.2024 20:11:24

The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:ive/ive-productscarousel' Gutenberg block in all versions up to, and including, 1.2.4.4 due to insuffici...

5.3

CVE-2024-5541

  • EPSS 0.32%
  • Veröffentlicht 18.06.2024 03:15:10
  • Zuletzt bearbeitet 21.11.2024 09:47:53

The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ibtana_visual_editor_register_ajax_json_endpont' function in all versions up to, and including, 1...

5.4

CVE-2023-6684

  • EPSS 0.19%
  • Veröffentlicht 11.01.2024 09:15:51
  • Zuletzt bearbeitet 03.06.2025 14:15:40

The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ive' shortcode in versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on 'width' and 'height...

5.4

CVE-2022-4674

Exploit
  • EPSS 0.46%
  • Veröffentlicht 06.02.2023 20:15:11
  • Zuletzt bearbeitet 26.03.2025 14:15:25

The Ibtana WordPress plugin before 1.1.8.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack

3.5

CVE-2021-25014

Exploit
  • EPSS 0.14%
  • Veröffentlicht 14.02.2022 12:15:14
  • Zuletzt bearbeitet 21.11.2024 05:54:11

The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to ...