Udesign Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Long Watch Studio MyRewards allows Stored XSS. This issue affects MyRewards: from n/a through 5.4.13.1.

Affected:

up to 4.11.3

Fixed in:

4.11.3

Disclosed:

Jul 4, 2025

CVE-2025-24757 on NVD →

The udesign theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.11.2. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 4.11.2

Fixed in:

4.11.3

Disclosed:

Jan 24, 2025

CVE-2025-24757 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AndonDesign UDesign allows Reflected XSS.This issue affects UDesign: from n/a through 4.7.3.

Affected:

up to 4.7.3

Fix:

No patched version reported

Disclosed:

Apr 25, 2024

CVE-2024-4077 on NVD →

[en] Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via a fragment identifier, as demonstrated by #<svg onload=alert(1)>.

Affected:

1.8.0 – 2.7.9

Fixed in:

2.7.9

Disclosed:

Oct 2, 2017

CVE-2015-7357 on NVD →

This WordPress uDesign theme is prone to a DOM cross site scripting vulnerability. Update the theme.

Affected:

up to 2.7.10

Fixed in:

2.7.10

Disclosed:

Sep 8, 2015