← Back

Ithemes

ithemes

25 CVEs • 19 products

Products (19)

Click to collapse
Toggle
Backupbuddy
backupbuddy
6 CVEs
Security
security
2 CVEs
Exchange
exchange
1 CVE
Authorize.net
authorize.net
1 CVE
Custom Url Tracking
custom_url_tracking
1 CVE
Easy Canadian Sales Taxes
easy_canadian_sales_taxes
1 CVE
Easy Eu Value Added (vat) Taxes
easy_eu_value_added_(vat)_taxes
1 CVE
Easy Us Sales Taxes
easy_us_sales_taxes
1 CVE
Invoices
invoices
1 CVE
Manual Purchases
manual_purchases
1 CVE
Membership
membership
1 CVE
Stripe
stripe
1 CVE
Table Rate Shipping
table_rate_shipping
1 CVE
Mobile
mobile
1 CVE
Builder Theme Depot
builder_theme_depot
1 CVE
Builder Theme Market
builder_theme_market
1 CVE
Builder Style Manager
builder_style_manager
1 CVE
Paypal Pro
paypal_pro
1 CVE
Ithemes Security
ithemes_security
1 CVE

CVEs (25)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-7433
1Ithemes
1Security
Jun 17, 2026
Mar 2, 2018
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.
CVE-2013-2744
1Ithemes
1Backupbuddy
Apr 29, 2026
Apr 2, 2013
N/A· v4
N/A· v3
5.0 MEDIUM· v2
importbuddy.php in the BackupBuddy plugin 2.2.25 for WordPress allows remote attackers to obtain configuration information via a step 0 phpinfo action, which calls the phpinfo function.
CVE-2013-2743
1Ithemes
1Backupbuddy
Apr 29, 2026
Apr 2, 2013
N/A· v4
N/A· v3
7.5 HIGH· v2
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress allows remote attackers to bypass authentication via a crafted integer in the step parameter.
CVE-2013-2742
1Ithemes
1Backupbuddy
Apr 29, 2026
Apr 2, 2013
N/A· v4
N/A· v3
7.5 HIGH· v2
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not reliably delete itself after completing a restore operation, which makes it easier for remote attackers to obtain a...Show more
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not reliably delete itself after completing a restore operation, which makes it easier for remote attackers to obtain access via subsequent requests to this script.Show less
CVE-2013-2741
1Ithemes
1Backupbuddy
Apr 29, 2026
Apr 2, 2013
N/A· v4
N/A· v3
7.5 HIGH· v2
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite...Show more
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite or delete files, via vectors involving a (1) direct request, (2) step=1 request, (3) step=2 or step=3 request, or (4) step=7 request.Show less