colorlib records

10 published records for vendor colorlib.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 20%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

10 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
59Plan	CVE-2020-36708Proof of concept	Epsilon Framework Themes (Various Versions) - Function Injectioncolorlib · activello · CWE-94 pre-auth RCE	Critical9.8	—	65.3%	Jun 6, 2023
26Monitor	CVE-2020-36721No exploit	Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivationcolorlib · activello · CWE-284 Pre-auth Broken access control (IDOR)	Medium6.5	—	1.0%	Jun 6, 2023
24Monitor	CVE-2025-3662No exploit	FancyBox for WordPress < 3.3.6 - Unauthenticated Stored XSScolorlib · fancybox · CWE-79 Pre-auth XSS	Medium6.1	—	0.2%	Jun 3, 2025
21Monitor	CVE-2024-1473No exploit	Coming Soon & Maintenance Mode by Colorlib <= 1.0.99 - Information Exposurecolorlib · coming soon \& maintenance mode · CWE-284 Pre-auth Broken access control (IDOR)	Medium5.3	—	0.5%	Mar 20, 2024
21Monitor	CVE-2022-45849No exploit	WordPress Activello Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)colorlib · activello theme · CWE-79 XSS	Medium5.4	—	0.5%	Apr 16, 2023
21Monitor	CVE-2022-45358No exploit	WordPress Activello Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)colorlib · activello · CWE-79 XSS	Medium5.4	—	0.4%	Apr 13, 2023
19Monitor	CVE-2015-1494Proof of concept	The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct crocolorlib · fancybox · CWE-79 Pre-auth XSS	Medium4.3	—	6.4%	Feb 17, 2015
19Monitor	CVE-2022-1945No exploit	Coming Soon and Maintenance by Colorlib < 1.0.99 - Admin+ Stored Cross Site Scriptingcolorlib · coming soon \& maintenance mode · CWE-79 XSS	Medium4.8	—	0.6%	Jun 20, 2022
19Monitor	CVE-2024-0662No exploit	The FancyBox for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions 3.0.2 to 3.3.3 dcolorlib · fancybox · CWE-79 XSS	Medium4.8	—	0.5%	Apr 9, 2024
17Monitor	CVE-2024-49321No exploit	WordPress Simple Custom Post Order plugin <= 2.5.7 - Broken Access Control vulnerabilitycolorlib · simple custom post order · CWE-862 Broken access control (IDOR)	Medium4.3	—	0.3%	Oct 21, 2024

CVE-2020-36708
59Plan
Epsilon Framework Themes (Various Versions) - Function Injection
CriticalCVSS 9.8Proof of conceptEPSS 65%
- pre-auth RCE
colorlib · activelloJun 6, 2023
CVE-2020-36721
26Monitor
Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation
MediumCVSS 6.5No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
colorlib · activelloJun 6, 2023
CVE-2025-3662
24Monitor
FancyBox for WordPress < 3.3.6 - Unauthenticated Stored XSS
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
colorlib · fancyboxJun 3, 2025
CVE-2024-1473
21Monitor
Coming Soon & Maintenance Mode by Colorlib <= 1.0.99 - Information Exposure
MediumCVSS 5.3No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
colorlib · coming soon \& maintenance modeMar 20, 2024
CVE-2022-45849
21Monitor
WordPress Activello Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)
MediumCVSS 5.4No exploitEPSS 0%
- XSS
colorlib · activello themeApr 16, 2023
CVE-2022-45358
21Monitor
WordPress Activello Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)
MediumCVSS 5.4No exploitEPSS 0%
- XSS
colorlib · activelloApr 13, 2023
CVE-2015-1494
19Monitor
The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cro
MediumCVSS 4.3Proof of conceptEPSS 6%
- Pre-auth
- XSS
colorlib · fancyboxFeb 17, 2015
CVE-2022-1945
19Monitor
Coming Soon and Maintenance by Colorlib < 1.0.99 - Admin+ Stored Cross Site Scripting
MediumCVSS 4.8No exploitEPSS 1%
- XSS
colorlib · coming soon \& maintenance modeJun 20, 2022
CVE-2024-0662
19Monitor
The FancyBox for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions 3.0.2 to 3.3.3 d
MediumCVSS 4.8No exploitEPSS 0%
- XSS
colorlib · fancyboxApr 9, 2024
CVE-2024-49321
17Monitor
WordPress Simple Custom Post Order plugin <= 2.5.7 - Broken Access Control vulnerability
MediumCVSS 4.3No exploitEPSS 0%
- Broken access control (IDOR)
colorlib · simple custom post orderOct 21, 2024