Skip to content
Noroxi

Etoilewebdesign records

26 published records for vendor etoilewebdesign.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
23.1%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 19
  3. 20
  4. 22
  5. 23
  6. 24
  7. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

26 records
  • CVE-2025-2005
    46Plan

    Front-End-Only-Users <= 3.2.32 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 21%

    etoilewebdesign · front end usersApr 2, 2025

  • CVE-2017-12199
    40Plan

    The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue

    CriticalCVSS 9.8No exploitEPSS 1%

    etoilewebdesign · ultimate product catalogAug 2, 2017

  • CVE-2020-36726
    39Monitor

    Ultimate Reviews < 2.1.33 - PHP Object Injection

    CriticalCVSS 9.8No exploitEPSS 1%

    etoilewebdesign · ultimate reviewsJun 6, 2023

  • CVE-2025-47580
    39Monitor

    WordPress Front End Users plugin <= 3.2.35 - Broken Access Control vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    etoilewebdesign · front end usersMay 15, 2025

  • CVE-2024-7607
    35Monitor

    Front End Users <= 3.2.28 - Authenticated (Contributor+) Time-Based SQL Injection

    HighCVSS 8.8No exploitEPSS 0%

    etoilewebdesign · front end usersAug 29, 2024

  • CVE-2024-43343
    35Monitor

    WordPress Order Tracking – WordPress Status Tracking Plugin plugin < 3.3.13 - Broken Access Control vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    etoilewebdesign · order trackingNov 1, 2024

  • CVE-2023-34005
    35Monitor

    WordPress Front End Users Plugin <= 3.2.24 is vulnerable to Cross Site Request Forgery (CSRF)

    HighCVSS 8.8No exploitEPSS 0%

    etoilewebdesign · front end usersJul 17, 2023

  • CVE-2019-17232
    31Monitor

    Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.

    HighCVSS 7.5Proof of conceptEPSS 3%

    etoilewebdesign · ultimate faqOct 7, 2019

  • CVE-2024-13569
    28Monitor

    Front End Users <= 3.2.32 - Reflected XSS

    HighCVSS 7.1Proof of conceptEPSS 0%

    etoilewebdesign · front end usersApr 22, 2025

  • CVE-2021-24993
    26Monitor

    Ultimate Product Catalog < 5.0.26 - Subscriber+ Arbitrary Product Creation & Settings Update

    MediumCVSS 6.5No exploitEPSS 0%

    etoilewebdesign · ultimate product catalogFeb 7, 2022

  • CVE-2020-7107
    25Monitor

    The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.

    MediumCVSS 6.1Proof of conceptEPSS 2%

    etoilewebdesign · ultimate faqJan 16, 2020

  • CVE-2019-17233
    25Monitor

    Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.

    MediumCVSS 6.1Proof of conceptEPSS 1%

    etoilewebdesign · ultimate faqOct 7, 2019

  • CVE-2020-24313
    24Monitor

    Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "Appointmen

    MediumCVSS 6.1No exploitEPSS 1%

    etoilewebdesign · ultimate appointment booking \& schedulingAug 26, 2020

  • CVE-2019-15643
    24Monitor

    The ultimate-faqs plugin before 1.8.22 for WordPress has XSS.

    MediumCVSS 6.1No exploitEPSS 0%

    etoilewebdesign · ultimate faqAug 27, 2019

  • CVE-2017-12200
    24Monitor

    The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component.

    MediumCVSS 6.1No exploitEPSS 0%

    etoilewebdesign · ultimate product catalogAug 2, 2017

  • CVE-2023-4471
    24Monitor

    Order Tracking Pro <= 3.3.6 - Reflected Cross-Site Scripting

    MediumCVSS 6.1No exploitEPSS 0%

    etoilewebdesign · order trackingAug 31, 2023

  • CVE-2023-33322
    24Monitor

    WordPress Front End Users plugin < 3.2.25 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.1No exploitEPSS 0%

    etoilewebdesign · front end usersMar 26, 2024

  • CVE-2024-25597
    24Monitor

    WordPress Ultimate Reviews plugin <= 3.2.8 - Unauthenticated Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.1No exploitEPSS 0%

    etoilewebdesign · ultimate reviewsMar 15, 2024

  • CVE-2021-24968
    22Monitor

    Ultimate FAQ < 2.1.2 - Subscriber+ Arbitrary FAQ Creation

    MediumCVSS 5.7No exploitEPSS 0%

    etoilewebdesign · ultimate faqJan 24, 2022

  • CVE-2024-7606
    21Monitor

    Front End Users <= 3.2.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    MediumCVSS 5.4No exploitEPSS 0%

    etoilewebdesign · front end usersAug 29, 2024

  • CVE-2024-13563
    21Monitor

    Front End Users <= 3.2.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via forgot-password Shortcode

    MediumCVSS 5.4No exploitEPSS 0%

    etoilewebdesign · front end usersFeb 15, 2025

  • CVE-2025-26877
    21Monitor

    WordPress Front End Users Plugin <= 3.2.30 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.4No exploitEPSS 0%

    etoilewebdesign · front end usersFeb 25, 2025

  • CVE-2022-23979
    19Monitor

    WordPress Ultimate Reviews plugin <= 3.0.15 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

    MediumCVSS 4.8No exploitEPSS 0%

    etoilewebdesign · ultimate reviewsJan 28, 2022

  • CVE-2023-2711
    19Monitor

    Ultimate Product Catalog < 5.2.6 - Admin+ Stored XSS

    MediumCVSS 4.8No exploitEPSS 0%

    etoilewebdesign · ultimate product catalogJun 27, 2023

  • CVE-2024-12410
    19Monitor

    Front End Users <= 3.2.32 - Authenticated (Admin+) SQL injection

    MediumCVSS 4.9No exploitEPSS 0%

    etoilewebdesign · front end usersApr 2, 2025