thirtybees vulnerabilities

Products

• thirty bees 2
• bees blog 1
• thirtybees/thirtybees 1

Latest thirtybees CVEs

Newest publication first

1. CVE-2026-109394 Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout

   Published 2026-10-12

   Critical·CVSS 9.1 EPSS 0.45%

   Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email,...

2. CVE-2023-52264 The beesblog (aka Bees Blog) component before 1.6.2 for thirty bees allows Reflected XSS because controllers/front/post.php sharing_url is mishandled.

   Published 2023-12-30

   Medium·CVSS 6.1 EPSS 0.43%

   The beesblog (aka Bees Blog) component before 1.6.2 for thirty bees allows Reflected XSS because controllers/front/post.php sharing_url is mishandled.

3. CVE-2023-45957 A stored cross-site scripting (XSS) vulnerability in the component admin/AdminRequestSqlController.php of thirty bees before 1.5.0 allows attackers to execute arbitrary web script or HTML via $e->getM...

   Published 2023-12-22

   Medium·CVSS 5.4 EPSS 0.38%

   A stored cross-site scripting (XSS) vulnerability in the component admin/AdminRequestSqlController.php of thirty bees before 1.5.0 allows attackers to execute arbitrary web script or HTML via $e->getMessage() error mishandling.

4. CVE-2023-45958 Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter at /controller/AdminController.php. This vulnerability allows...

   Published 2023-10-18

   Medium·CVSS 6.1 EPSS 0.36%

   Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a cr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.