codetipi vulnerabilities

Products

• 15zine 1
• Valenti 1
• Valenti Engine 1

Latest codetipi CVEs

Newest publication first

1. CVE-2026-23544 WordPress Valenti theme <= 5.6.3.5 - PHP Object Injection vulnerability

   Published 2026-02-19

   High·CVSS 8.8

   Deserialization of Untrusted Data vulnerability in codetipi Valenti valenti allows Object Injection.This issue affects Valenti: from n/a through <= 5.6.3.5.

2. CVE-2025-63021 WordPress Valenti Engine plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability

   Published 2025-12-31

   Medium·CVSS 6.5

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetipi Valenti Engine valenti-engine allows DOM-Based XSS.This issue affects Valenti Engine: from n/a through <= 1.0.3.

3. CVE-2020-36510 15Zine < 3.3.0 - Reflected Cross-Site Scripting

   Published 2022-02-28

   Medium·CVSS 6.1

   The 15Zine WordPress theme before 3.3.0 does not sanitise and escape the cbi parameter before outputing it back in the response via the cb_s_a AJAX action, leading to a Reflected Cross-Site Scripting

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.