xylusthemes - MidnightBSD Security Advisories

CVE-2020-24147 MEDIUM

Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	3.9	5.2

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-918,

Products Affected

Vendor	Product	Version
xylusthemes	wp_smart_import	1.0.0

CVE-2022-40209

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xylus Themes WP Smart Import plugin <= 1.0.2 on WordPress.

Products Affected

Vendor	Product	Version
xylusthemes	wp_smart_import	*

CVE-2024-30201

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WordPress Importer allows Reflected XSS.This issue affects WordPress Importer: from n/a through 1.0.4.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	7.1	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L	2.8	3.7

Products Affected

Vendor	Product	Version
xylusthemes	wp_smart_import	*

CVE-2024-31371

Cross-Site Request Forgery (CSRF) vulnerability in Xylus Themes WP Event Aggregator.This issue affects WP Event Aggregator: from n/a through 1.7.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	2.8	1.4

Products Affected

Vendor	Product	Version
xylusthemes	wp_event_aggregator	*

CVE-2024-32597

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WordPress Importer allows Stored XSS.This issue affects WordPress Importer: from n/a through 1.0.7.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	5.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L	1.7	3.7

Products Affected

Vendor	Product	Version
xylusthemes	wordpress_importer	*
xylusthemes	wp_smart_import	*

CVE-2024-38703

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator allows Stored XSS.This issue affects WP Event Aggregator: from n/a through 1.7.9.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L	2.3	3.7

Products Affected

Vendor	Product	Version
xylusthemes	wp_event_aggregator	*

CVE-2024-47352

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Bulk Delete wp-bulk-delete allows Stored XSS.This issue affects WP Bulk Delete: from n/a through <= 1.3.1.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	7.1	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L	2.8	3.7

Products Affected

Vendor	Product	Version
xylusthemes	wp_bulk_delete	*

CVE-2025-24700

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator wp-event-aggregator allows Reflected XSS.This issue affects WP Event Aggregator: from n/a through <= 1.8.2.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	7.1	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L	2.8	3.7

Products Affected

Vendor	Product	Version
xylusthemes	wp_event_aggregator	*

CVE-2025-47453

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Xylus Themes WP Smart Import wp-smart-import allows PHP Local File Inclusion.This issue affects WP Smart Import: from n/a through <= 1.1.3.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9

Products Affected

Vendor	Product	Version
xylusthemes	wp_smart_import	*

CVE-2025-47531

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Xylus Themes XT Event Widget for Social Events xt-facebook-events allows PHP Local File Inclusion.This issue affects XT Event Widget for Social Events: from n/a through <= 1.1.7.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	7.5	HIGH	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	1.6	5.9

Products Affected

Vendor	Product	Version
xylusthemes	xt_event_widget_for_social_events	*

CVE-2025-48256

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes Import Social Events import-facebook-events allows Stored XSS.This issue affects Import Social Events: from n/a through <= 1.8.5.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7
audit@patchstack.com	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L	2.3	3.7

Products Affected

Vendor	Product	Version
xylusthemes	import_social_events	*

CVE-2025-58192

Missing Authorization vulnerability in Xylus Themes WP Bulk Delete wp-bulk-delete allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Bulk Delete: from n/a through <= 1.3.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	2.8	1.4

Products Affected

Vendor	Product	Version
xylusthemes	wp_bulk_delete	*

Advisories for xylusthemes