Skip to content
Sign in
4.8 Medium

CVE-2024-2263 Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page,…

Description

Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affected products and versions

Product Affected versions Fixed in
Themify 1.4 earliest → < 1.4.4 1.4.4
woocommerce_product_filter 1.4 earliest → < 1.4.4 1.4.4

Other CVEs of Themify

The 3 CVEs of Themify →
CVE-2024-2278 Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high… 6.1 Medium CVE-2024-2262 Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to… 4.7 Medium
Track this CVE