ithemes vulnerabilities

Products

• backupbuddy 6
• security 2
• authorize.net 1
• builder style manager 1
• builder theme depot 1
• builder theme market 1
• custom url tracking 1
• easy canadian sales taxes 1
• easy eu value added vat taxes 1
• easy us sales taxes 1
• exchange 1
• invoices 1
• ithemes security 1
• manual purchases 1
• membership 1
• mobile 1
• paypal pro 1
• ServerBuddy by PluginBuddy.com 1
• stripe 1
• table rate shipping 1
• WPComplete 1

Latest ithemes CVEs

Newest publication first · page 1 of 2

1. CVE-2025-49895 WordPress ServerBuddy by PluginBuddy.com plugin <= 1.0.5 - CSRF to PHP Object Injection vulnerability

   Published 2025-08-16

   Medium·CVSS 6.5 EPSS 0.17%

   Cross-Site Request Forgery (CSRF) vulnerability in iThemes ServerBuddy by PluginBuddy.Com allows Object Injection.This issue affects ServerBuddy by PluginBuddy.Com: from n/a through 1.0.5.

2. CVE-2022-45825 WordPress WPComplete Plugin <= 2.9.4 is vulnerable to Cross Site Scripting (XSS)

   Published 2023-03-28

   Medium·CVSS 6.1 EPSS 0.52%

   Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in iThemes WPComplete plugin <= 2.9.2 versions.

3. CVE-2022-31474 WordPress BackupBuddy Plugin 8.5.8.0-8.7.4.1 is vulnerable to Directory Traversal

   Published 2023-03-13

   High·CVSS 7.5 EPSS 63.8%

   Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1.

4. CVE-2022-4897 BackupBuddy < 8.8.3 - Multiple Reflected Cross-Site Scripting

   Published 2023-02-21

   Medium·CVSS 6.1 EPSS 0.86%

   The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, leading to Reflected Cross-Site Scripting

5. CVE-2020-36176 iThemes Security <= 7.6.1 - Broken Password Mechanism

   Published 2021-01-06

   High·CVSS 7.5 EPSS 1.3%

   The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until the second login occurs.

6. CVE-2020-14092 Payment Form for PayPal Pro < 1.1.65 - SQL Injection

   Published 2020-07-02

   Critical·CVSS 9.8 EPSS 94.5%

   The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.

7. CVE-2015-9379 iThemes Builder Style Manager < 0.7.7 - Cross-Site Scripting

   Published 2019-08-28

   Medium·CVSS 6.1 EPSS 0.95%

   iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().

8. CVE-2015-9378 Market < 5.1.27 - Reflected Cross-Site Scripting

   Published 2019-08-28

   Medium·CVSS 6.1 EPSS 0.95%

   iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().

9. CVE-2015-9377 iThemes Builder Depot Theme < 5.0.30 - Reflected Cross-Site Scripting

   Published 2019-08-28

   Medium·CVSS 6.1 EPSS 0.95%

   iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg().

10. CVE-2015-9376 iThemes Mobile < 1.2.8 - Reflected Cross-Site Scripting

    Published 2019-08-28

    Medium·CVSS 6.1 EPSS 0.95%

    iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg().

11. CVE-2015-9375 Exchange Addon Table Rate Shipping < 1.1.0 - Cross-Site Scripting

    Published 2019-08-28

    Medium·CVSS 6.1 EPSS 0.95%

    Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

12. CVE-2015-9374 Stripe Add-on for iThemes Exchange < 1.2.0 - Reflected Cross-Site Scripting

    Published 2019-08-28

    Medium·CVSS 6.1 EPSS 0.95%

    Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

13. CVE-2015-9372 Exchange Addon Membership < 1.3.0 - Reflected Cross-Site Scripting

    Published 2019-08-28

    Medium·CVSS 6.1 EPSS 0.95%

    Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

14. CVE-2015-9371 Manual Purchases < 1.1.0 - Reflected Cross-Site Scripting

    Published 2019-08-28

    Medium·CVSS 6.1 EPSS 0.95%

    Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

15. CVE-2015-9370 Exchange Addon Invoices < 1.4.0 - Reflected Cross-Site Scripting

    Published 2019-08-28

    Medium·CVSS 6.1 EPSS 0.95%

    Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

16. CVE-2015-9369 Easy US Sales Taxes Add-on for iThemes Exchange < 1.1.0 - Reflected Cross-Site Scripting

    Published 2019-08-28

    Medium·CVSS 6.1 EPSS 0.95%

    Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

17. CVE-2015-9368 Easy EU Value Added (VAT) Taxes < 1.2.0 - Reflected Cross-Site Scripting

    Published 2019-08-28

    Medium·CVSS 6.1 EPSS 0.95%

    Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

18. CVE-2015-9367 Easy Canadian Sales Taxes Add-On for iThemes Exchange < 1.1.0 - Reflected Cross-Site Scripting

    Published 2019-08-28

    Medium·CVSS 6.1 EPSS 0.95%

    Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

19. CVE-2015-9366 Exchange Addon Custom URL Tracking < 1.1.0 - Reflected Cross-Site Scripting

    Published 2019-08-28

    Medium·CVSS 6.1 EPSS 0.95%

    Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

20. CVE-2015-9365 Authorize.net Add-on for iThemes Exchange < 1.1.0 - Reflected Cross-Site Scripting

    Published 2019-08-28

    Medium·CVSS 6.1 EPSS 0.95%

    Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

21. CVE-2015-9363 iThemes Exchange < 1.12.0 - Cross-Site Scripting

    Published 2019-08-28

    Medium·CVSS 6.1 EPSS 0.95%

    iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

22. CVE-2018-12636 iThemes Security <= 7.0.2 - Authenticated SQL Injection

    Published 2018-06-22

    High·CVSS 7.2 EPSS 28.8% Public exploit

    The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs page.

23. CVE-2018-7433 iThemes Security <= 6.9.0 - Cross-Site Scripting

    Published 2018-03-02

    High·CVSS 7.5 EPSS 1.4%

    The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.

24. CVE-2013-2744 BackupBuddy <= 2.2.28 - Sensitive Information Disclosure

    Published 2013-04-02

    Medium·CVSS 5.0 EPSS 2.1%

    importbuddy.php in the BackupBuddy plugin 2.2.25 for WordPress allows remote attackers to obtain configuration information via a step 0 phpinfo action, which calls the phpinfo function.

25. CVE-2013-2743 BackupBuddy < 3.0 - Authentication Bypass

    Published 2013-04-02

    High·CVSS 7.5 EPSS 2.6%

    importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress allows remote attackers to bypass authentication via a crafted integer in the step parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.