Weaver Xtreme Vulnerabilities

The Weaver Xtreme theme for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta in all versions up to, and including, 6.3.0 due to insufficient input sanitization and output escaping on user supplied meta (page-head-code). This makes it possible for authenticated attackers with contributor-level...

CVSS:

5.4

Affected:

up to 6.3.0

Fixed in:

6.4

Disclosed:

Jan 5, 2024

CVE-2023-6990 on NVD →

The Weaver Xtreme Theme for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name in versions up to, and including, 5.0.7. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages th...

CVSS:

6.4

Affected:

up to 5.0.7

Fixed in:

6.2

Disclosed:

Apr 5, 2023

CVE-2023-1403 on NVD →