Orbisius Child Theme Creator — known CVE vulnerabilities

Every CVE whose affected-product data names Orbisius Child Theme Creator, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (3)

• CVE-2020-28649 — CVSS 8.8 (high): The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisius_ctc_theme_editor_manage_file.
• CVE-2024-43276 — CVSS 7.1 (high): Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Svetoslav Marinov (Slavi)…
• CVE-2015-9456 — CVSS 6.5 (medium): The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the…