Envato vulnerabilities and threats

5 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	6.8	EPSS 0.4%	CVE-2026-96824Template Kit (WordPress plugin) · Path Traversal Medium6.8EPSS 0.4%2026-09-30CVE Database V5CVE-2026-96824 Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions. EPSS 0.4%Vulnerability envato CWE-22	CVE Database V5	2026-09-30
Medium	5.3	EPSS 0.3%	CVE-2025-66123BookPro (WordPress plugin) · Insecure Direct Object Reference Medium5.3EPSS 0.3%2026-06-26CVE Database V5CVE-2025-66123 Unauthenticated Insecure Direct Object References (IDOR) in BookPro <= 1.1.0 versions. EPSS 0.3%Vulnerability About Envato CWE-639	CVE Database V5	2026-06-26
Medium	4.1	EPSS 0.4%	CVE-2024-56275Envato Elements (WordPress plugin) · Server-Side Request Forgery (SSRF) Medium4.1EPSS 0.4%2025-01-07CVE Database V5CVE-2024-56275 Server-Side Request Forgery (SSRF) vulnerability in Envato Envato Elements allows Server Side Request Forgery.This issue affects Envato Elements: from n/a through 2.0.14. EPSS 0.4%Vulnerability CWE-918	CVE Database V5	2025-01-07
Medium	5.9	EPSS 0.3%	CVE-2024-37550Template Kit (WordPress plugin) · XSS or 'Cross-site Scripting' Medium5.9EPSS 0.3%2024-07-21CVE Database V5CVE-2024-37550 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Envato Template Kit – Export allows Stored XSS.This issue affects Template Kit – Export: from n/a through 1.0.22. EPSS 0.3%Vulnerability Envato CWE-79	CVE Database V5	2024-07-21
Medium	6.4	EPSS 0.4%	CVE-2024-2334Template Kit (WordPress plugin) · Unrestricted File Upload Medium6.4EPSS 0.4%2024-04-09CVE Database V5CVE-2024-2334 The Template Kit – Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the template upload functionality in all versions up to, and including, 1.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. EPSS 0.4%Vulnerability envato CWE-434	CVE Database V5	2024-04-09

Page 1 of 1