SayenThemes Vulnerabilities and Affected Products
Vulnerabilities associated with Kaswara Modern VC Addons.
Products
Clear product- Kaswara Modern VC Addons2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2021-4448HIGH | Kaswara Modern VC Addons <= 3.0.1 - Missing AuthorizationThe Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions such as importing data, uploading arbitrary files, deleting arbitrary files, and more. | CVSS7.3v3.1 | EPSS1.38% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2021-24284CRITICAL | Kaswara Modern VC Addons <= 3.0.1 - Unauthenticated Arbitrary File UploadThe Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zipfile being unzipped in the wp-content/uploads/kaswara/fonts_icon directory with no checks for malicious files such as PHP. | CVSS9.8v3.1 | EPSS42.1% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |