Vulnerabilities and security researches forenvo-extra envo-extra

Jun 07, 2024

CVE, Research URL: 4370a080274d0696a00c0cf989f84692dbe2e074
Home page URL: Security reports for Envo Extra
Application: Envo Extra
Date: Oct 17, 2023
Research Description: Envo Extra [envo-extra] < 1.8.4 Envo Extra <= 1.8.3 - Cross-Site Request Forgery The Envo Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.3. This is due to missing or incorrect nonce validation on the ajax_required_plugins_activate function. This makes it possible for unauthenticated attackers to activate plugins required by Envo Extra via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2024-32456
Home page URL: Security reports for Envo Extra
Application: Envo Extra
Date: Apr 17, 2024
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvoThemes Envo Extra allows Stored XSS.This issue affects Envo Extra: from n/a through 1.8.11.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2024-4385
Home page URL: Security reports for Envo Extra
Application: Envo Extra
Date: May 16, 2024
Research Description: The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 1.8.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

Jun 08, 2024

CVE, Research URL: CVE-2024-5645
Home page URL: Security reports for Envo Extra
Application: Envo Extra
Date: Jun 07, 2024
Research Description: The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_css_id’ parameter within the Button widget in all versions up to, and including, 1.8.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

Nov 10, 2024

CVE, Research URL: CVE-2024-10770
Home page URL: Security reports for Envo Extra
Application: Envo Extra
Date: Nov 09, 2024
Research Description: The Envo Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.3 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
Affected versions: Min -, max -.
Status: vulnerable

May 09, 2025

CVE, Research URL: CVE-2025-47471
Home page URL: Security reports for Envo Extra
Application: Envo Extra
Date: May 07, 2025
Research Description: Missing Authorization vulnerability in EnvoThemes Envo Extra allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Envo Extra: from n/a through 1.9.9.
Affected versions: Min -, max -.
Status: vulnerable