Busiprof Vulnerabilities

The Busiprof theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a s...

CVSS:

4.3

Affected:

up to 2.5.2

Fix:

No patched version reported

Disclosed:

Feb 11, 2026

CVE-2026-39619 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in webriti Busiprof allows Stored XSS.This issue affects Busiprof: from n/a through 2.4.8.

Affected:

up to 2.4.8

Fix:

No patched version reported

Disclosed:

Aug 18, 2024

CVE-2024-43262 on NVD →

The Busiprof theme for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wil...

CVSS:

6.4

Affected:

up to 2.4.8

Fix:

No patched version reported

Disclosed:

Aug 12, 2024

CVE-2024-43262 on NVD →

Multiple themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'id' parameter found in the '[different-value]_customizer_notify_dismiss_action' and '[different-value]_customizer_notify_dismiss_recommended_plugins' AJAX actions in various versions due to insufficient input sanitization and output...

CVSS:

6.1

Affected:

up to 2.3.8

Fixed in:

2.3.8

Disclosed:

Feb 14, 2022

Multiple themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'id' parameter found in the '[different-value]_customizer_notify_dismiss_action' and '[different-value]_customizer_notify_dismiss_recommended_plugins' AJAX actions in various versions due to insufficient input sanitization and output...

Affected:

up to 2.3.8

Fixed in:

2.3.8

Disclosed:

Feb 14, 2022

The quality_customizer_notify_dismiss_action and ti_customizer_notify_dismiss_recommended_plugins AJAX actions (names can differ depending on the theme), available to authenticated users in multiple themes do not validate or escape the id parameter before outputting it back in the response, leading to Reflected Cross-S...

Affected:

up to 2.3.8

Fixed in:

2.3.8