Not rated
CVE-2022-0200 Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before…
Description
Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Themify Portfolio Post 1.1 | earliest → < 1.1.7 | 1.1.7 |
Other CVEs of Themify Portfolio Post
The 4 CVEs of Themify Portfolio Post →
CVE-2023-0362
Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes…
5.4
Medium
CVE-2022-4464
Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes…
5.4
Medium
CVE-2021-24129
Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6,…
Not rated