| CVE-2022-31474 | ALTO7.5 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1. | 13/03/2023 |
| CVE-2022-4897 | MEDIO6.1 | The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, leading to Reflected Cross-Site Scripting | 21/02/2023 |
| CVE-2020-36176 | ALTO7.5 | The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until the second login occurs. | 06/01/2021 |
| CVE-2020-14092 | CRÍTICO9.8 | The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection. | 02/07/2020 |
| CVE-2015-9379 | MEDIO6.1 | iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg(). | 28/08/2019 |
| CVE-2015-9378 | MEDIO6.1 | iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg(). | 28/08/2019 |
| CVE-2015-9377 | MEDIO6.1 | iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg(). | 28/08/2019 |
| CVE-2015-9376 | MEDIO6.1 | iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg(). | 28/08/2019 |
| CVE-2015-9375 | MEDIO6.1 | Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | 28/08/2019 |
| CVE-2015-9374 | MEDIO6.1 | Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | 28/08/2019 |
| CVE-2015-9372 | MEDIO6.1 | Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | 28/08/2019 |
| CVE-2015-9371 | MEDIO6.1 | Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | 28/08/2019 |
| CVE-2015-9370 | MEDIO6.1 | Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | 28/08/2019 |
| CVE-2015-9369 | MEDIO6.1 | Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | 28/08/2019 |
| CVE-2015-9368 | MEDIO6.1 | Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | 28/08/2019 |
| CVE-2015-9367 | MEDIO6.1 | Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | 28/08/2019 |
| CVE-2015-9366 | MEDIO6.1 | Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | 28/08/2019 |
| CVE-2015-9365 | MEDIO6.1 | Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | 28/08/2019 |
| CVE-2015-9363 | MEDIO6.1 | iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | 28/08/2019 |
| CVE-2018-12636 | ALTO7.2 | The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs page. | 22/06/2018 |