Filtered by vendor Radiustheme Subscriptions
Total 13 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-39923 1 Radiustheme 1 The Post Grid 2024-09-19 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme The Post Grid plugin <= 7.2.7 versions.
CVE-2024-37520 1 Radiustheme 1 Shopbuilder 2024-08-29 6.5 Medium
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons allows Path Traversal.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through 2.1.12.
CVE-2021-24742 1 Radiustheme 1 Logo Slider And Showcase 2024-08-03 6.5 Medium
The Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the rtWLSSettings AJAX action because it uses a nonce for authorisation instead of a capability check.
CVE-2022-46853 1 Radiustheme 1 Post Grid 2024-08-03 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme The Post Grid plugin <= 5.0.4 versions.
CVE-2022-2654 1 Radiustheme 5 Classified Listing - Classified Ads \& Business Directory, Classified Listing Pro - Classified Ads \& Business Directory, Classified Listing Store \& Membership and 2 more 2024-08-03 6.1 Medium
The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store & Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting
CVE-2022-2655 1 Radiustheme 1 Classified Listing Pro - Classified Ads \& Business Directory 2024-08-03 6.1 Medium
The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
CVE-2022-2557 1 Radiustheme 1 Team - Wordpress Team Members Showcase 2024-08-03 8.8 High
The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is returned to the user
CVE-2023-37894 1 Radiustheme 1 Variation Images Gallery For Woocommerce 2024-08-02 7.1 High
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RadiusTheme Variation Images Gallery for WooCommerce plugin <= 2.3.3 versions.
CVE-2023-37387 1 Radiustheme 1 Classified Listing Pro - Classified Ads \& Business Directory 2024-08-02 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Classified Listing plugin <= 2.4.5 versions.
CVE-2023-23685 1 Radiustheme 1 Portfolio 2024-08-02 6.5 Medium
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in RadiusTheme Portfolio – WordPress Portfolio plugin <= 2.8.10 versions.
CVE-2024-35739 1 Radiustheme 1 Post Grid 2024-08-02 6.5 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in RadiusTheme The Post Grid allows Stored XSS.This issue affects The Post Grid: from n/a through 7.7.1.
CVE-2024-1427 1 Radiustheme 1 The Post Grid 2024-08-01 6.4 Medium
The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the section title tag attribute in all versions up to, and including, 7.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-0836 1 Radiustheme 1 Review Schema 2024-08-01 4.3 Medium
The WordPress Review & Structure Data Schema Plugin – Review Schema plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtrs_review_edit() function in all versions up to, and including, 2.1.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary reviews.