WordPress Plugin Vulnerabilities

Multiple iThemes plugins, themes and add-ons - XSS via add_query_arg() and remove_query_arg()

Affects Plugins

Plugin icon
ithemes-exchange
Fixed in 1.12.0
Plugin icon
exchange-addon-2checkout
Fixed in 1.1.0
Plugin icon
exchange-addon-authorize-net
Fixed in 1.1.0
Plugin icon
exchange-addon-custom-url-tracking
Fixed in 1.1.0
Plugin icon
exchange-addon-easy-canadian-sales-taxes
Fixed in 1.1.0
Plugin icon
exchange-addon-easy-ue-vat-taxes
Fixed in 1.2.0
Plugin icon
exchange-addon-easy-us-sales-taxes
Fixed in 1.1.0
Plugin icon
exchange-addon-manual-purchases
Fixed in 1.1.0
Plugin icon
exchange-addon-membership
Fixed in 1.3.0
Plugin icon
exchange-addon-paypal-pro
Fixed in 1.1.0
Plugin icon
exchange-addon-stripe
Fixed in 1.2.0
Plugin icon
exchange-addon-table-rate-shipping
Fixed in 1.1.0
Plugin icon
ithemes-mobile
Fixed in 1.2.8
Plugin icon
builder-style-manager
Fixed in 0.7.7
Plugin icon
exchange-addon-invoices
Fixed in 1.4.0

Affects Themes

BuilderChild-Depot
Fixed in 5.0.30
BuilderChild-Market
Fixed in 5.1.27

References

CVE
CVE-2015-9363
CVE
CVE-2015-9364
CVE
CVE-2015-9365
CVE
CVE-2015-9366
CVE
CVE-2015-9367
CVE
CVE-2015-9368
CVE
CVE-2015-9369
CVE
CVE-2015-9370
CVE
CVE-2015-9371
CVE
CVE-2015-9372
CVE
CVE-2015-9373
CVE
CVE-2015-9374
CVE
CVE-2015-9375
CVE
CVE-2015-9376
CVE
CVE-2015-9377
CVE
CVE-2015-9378
CVE
CVE-2015-9379
URL
https://ithemes.com/coordinated-wordpress-plugin-security-update/
URL
https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Verified
No
WPVDB ID
b32f28d8-84a4-4c21-9ace-39a9de38bf2e

Timeline

Publicly Published
2015-04-20 (about 11 years ago)
Added
2019-08-29 (about 6 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2022-05-11
Title
WooCommerce Green Wallet Gateway < 1.0.2 - Reflected Cross Site Scripting in checkout page
Published
2025-07-23
Title
Voltax Video Player <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
Published
2024-04-26
Title
WordPress Ad Widget <= 2.20.0 - Authenticated (Admin+) Stored Cross-Site Scripting
Published
2018-02-22
Title
Photo Gallery by WD <= 1.3.66 - Cross-Site Scripting (XSS)
Published
2024-02-12
Title
Bold Page Builder < 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL