Vulnerabilities > Colorlib
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-06-07 | CVE-2020-36708 | Code Injection vulnerability in multiple products The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <= 1.1.8, Affluent <= 1.1.0, Bonkers <= 1.0.4, Antreas <= 1.0.2, Sparkling <= 2.4.8, and NatureMag Lite <= 1.0.4. | 9.8 |
| 2023-06-07 | CVE-2020-36721 | Missing Authorization vulnerability in multiple products The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. | 6.5 |
| 2023-04-16 | CVE-2022-45849 | Cross-site Scripting vulnerability in Colorlib Activello Theme Auth. | 5.4 |
| 2023-04-13 | CVE-2022-45358 | Cross-site Scripting vulnerability in Colorlib Activello Auth. | 5.4 |
| 2022-06-20 | CVE-2022-1945 | Cross-site Scripting vulnerability in Colorlib Coming Soon & Maintenance Mode The Coming Soon & Maintenance Mode by Colorlib WordPress plugin before 1.0.99 does not sanitize and escape some settings, allowing high privilege users such as admin to perform Stored Cross-Site Scripting when unfiltered_html is disallowed (for example in multisite setup) | 3.5 |
| 2015-02-17 | CVE-2015-1494 | Cross-site Scripting vulnerability in Colorlib Fancybox The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an mfbfw[*] parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfw[padding] parameter and exploited in the wild in February 2015. | 4.3 |