Cththemes

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-36502 1Cththemes 1Balkon Jun 17, 2026 Jul 25, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cththemes Balkon plugin <= 1.3.2 versions.
CVE-2023-29430 1Cththemes 1Theroof Jun 17, 2026 Jun 26, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CTHthemes TheRoof theme <= 1.0.3 versions.
CVE-2023-29236 1Cththemes 1Outdoor Jun 17, 2026 Apr 7, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cththemes Outdoor theme <= 3.9.6 versions.
CVE-2023-25041 1Cththemes 1Monolit Jun 17, 2026 Apr 7, 2023 N/A· v4 6.1 MEDIUM· v3 N/A· v2 Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cththemes Monolit theme <= 2.0.6 versions.
CVE-2019-20212 1Cththemes 3Citybook EasybookTownhub Jun 17, 2026 Jan 13, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat widget/page message form.
CVE-2019-20211 1Cththemes 3Citybook EasybookTownhub Jun 17, 2026 Jan 13, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via Listing Address, Listing Latitude, Listing Longitude, Email Address, Description, Name, J...Show more The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via Listing Address, Listing Latitude, Listing Longitude, Email Address, Description, Name, Job or Position, Description, Service Name, Address, Latitude, Longitude, Phone Number, or Website.Show less
CVE-2019-20210 1Cththemes 3Citybook EasybookTownhub Jun 17, 2026 Jan 13, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search query.
CVE-2019-20209 1Cththemes 3Citybook EasybookTownhub Jun 17, 2026 Jan 13, 2020 N/A· v4 7.5 HIGH· v3 6.4 MEDIUM· v2 The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Reference (IDOR) via wp-admin/admin-ajax.php to delete any page/post/listing.