Skip to content
Noroxi

iThemes records

25 published records for vendor ithemes.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
4%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 20
  4. 21
  5. 23

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

25 records
  • CVE-2020-14092
    67This week

    The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.

    CriticalCVSS 9.8Proof of conceptEPSS 94%

    ithemes · paypal proJul 2, 2020

  • CVE-2022-31474
    49Plan

    WordPress BackupBuddy Plugin 8.5.8.0-8.7.4.1 is vulnerable to Directory Traversal

    HighCVSS 7.5Proof of conceptEPSS 63%

    ithemes · backupbuddyMar 13, 2023

  • CVE-2018-12636
    37Monitor

    The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via th

    HighCVSS 7.2Proof of conceptEPSS 29%

    ithemes · securityJun 22, 2018

  • CVE-2013-2743
    31Monitor

    importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress allows remote attackers to bypass authentica

    HighCVSS 7.5No exploitEPSS 2%

    wordpress · wordpressApr 2, 2013

  • CVE-2013-2741
    31Monitor

    importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enab

    HighCVSS 7.5No exploitEPSS 2%

    wordpress · wordpressApr 2, 2013

  • CVE-2013-2742
    31Monitor

    importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not reliably delete itself after comple

    HighCVSS 7.5No exploitEPSS 2%

    wordpress · wordpressApr 2, 2013

  • CVE-2018-7433
    30Monitor

    The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.

    HighCVSS 7.5No exploitEPSS 1%

    ithemes · securityMar 2, 2018

  • CVE-2020-36176
    30Monitor

    The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an exis

    HighCVSS 7.5No exploitEPSS 1%

    ithemes · ithemes securityJan 6, 2021

  • CVE-2015-9371
    24Monitor

    Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

    MediumCVSS 6.1No exploitEPSS 0%

    ithemes · manual purchasesAug 28, 2019

  • CVE-2015-9374
    24Monitor

    Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

    MediumCVSS 6.1No exploitEPSS 0%

    ithemes · stripeAug 28, 2019

  • CVE-2015-9375
    24Monitor

    Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

    MediumCVSS 6.1No exploitEPSS 0%

    ithemes · table rate shippingAug 28, 2019

  • CVE-2015-9376
    24Monitor

    iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg().

    MediumCVSS 6.1No exploitEPSS 0%

    ithemes · mobileAug 28, 2019

  • CVE-2015-9377
    24Monitor

    iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg().

    MediumCVSS 6.1No exploitEPSS 0%

    ithemes · builder theme depotAug 28, 2019

  • CVE-2015-9378
    24Monitor

    iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().

    MediumCVSS 6.1No exploitEPSS 0%

    ithemes · builder theme marketAug 28, 2019

  • CVE-2015-9379
    24Monitor

    iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().

    MediumCVSS 6.1No exploitEPSS 0%

    ithemes · builder style managerAug 28, 2019

  • CVE-2015-9372
    24Monitor

    Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

    MediumCVSS 6.1No exploitEPSS 0%

    ithemes · membershipAug 28, 2019

  • CVE-2015-9363
    24Monitor

    iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

    MediumCVSS 6.1No exploitEPSS 0%

    ithemes · exchangeAug 28, 2019

  • CVE-2015-9365
    24Monitor

    Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

    MediumCVSS 6.1No exploitEPSS 0%

    ithemes · authorize.netAug 28, 2019

  • CVE-2015-9366
    24Monitor

    Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

    MediumCVSS 6.1No exploitEPSS 0%

    ithemes · custom url trackingAug 28, 2019

  • CVE-2015-9367
    24Monitor

    Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

    MediumCVSS 6.1No exploitEPSS 0%

    ithemes · easy canadian sales taxesAug 28, 2019

  • CVE-2015-9368
    24Monitor

    Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

    MediumCVSS 6.1No exploitEPSS 0%

    ithemes · easy eu value added \(vat\) taxesAug 28, 2019

  • CVE-2015-9369
    24Monitor

    Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

    MediumCVSS 6.1No exploitEPSS 0%

    ithemes · easy us sales taxesAug 28, 2019

  • CVE-2015-9370
    24Monitor

    Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

    MediumCVSS 6.1No exploitEPSS 0%

    ithemes · invoicesAug 28, 2019

  • CVE-2022-4897
    24Monitor

    BackupBuddy < 8.8.3 - Multiple Reflected Cross-Site Scripting

    MediumCVSS 6.1Proof of conceptEPSS 0%

    ithemes · backupbuddyFeb 21, 2023

  • CVE-2013-2744
    21Monitor

    importbuddy.php in the BackupBuddy plugin 2.2.25 for WordPress allows remote attackers to obtain configuration information via a step 0 phpi

    MediumCVSS 5.0No exploitEPSS 2%

    wordpress · wordpressApr 2, 2013