Orbisius Child Theme Creator Vulnerabilities

The Child Theme Creator by Orbisius plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cloud_delete() and cloud_update() functions in all versions up to, and including, 1.5.5. This makes it possible for authenticated attackers, with Subscriber-level access a...

CVSS:

4.3

Affected:

up to 1.5.5

Fixed in:

1.5.6

Disclosed:

Dec 11, 2024

CVE-2024-12263 on NVD →

The Child Theme Creator by Orbisius plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if t...

CVSS:

6.1

Affected:

up to 1.5.4

Fixed in:

1.5.5

Disclosed:

Aug 16, 2024

CVE-2024-43276 on NVD →

The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisius_ctc_theme_editor_manage_file that makes it possible for attackers to modify arbitrary files and create new files to achieve remote code execution.

CVSS:

8.8

Affected:

up to 1.5.2

Fixed in:

1.5.2

Disclosed:

Oct 14, 2020

CVE-2020-28649 on NVD →

The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbisius_ctc_theme_editor_ajax&sub_cmd=save_file theme_1, theme_1_file, or theme_1_file_contents parameter.

CVSS:

6.5

Affected:

up to 1.2.8

Fixed in:

1.2.8

Disclosed:

Jul 8, 2015

CVE-2015-9456 on NVD →