Templately
Monthly
Cross-site scripting in the Templately WordPress plugin (versions ≤ 3.7.1) enables unauthenticated remote attackers to inject arbitrary JavaScript that executes in victim browsers upon user interaction, with scope change indicating cross-context impact. The CVSS vector (PR:N, S:C) confirms exploitation requires no authentication and that injected scripts escape the plugin's security context into the broader browser environment, enabling session hijacking, credential theft, or malicious content injection. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cloud credential hijacking in the Templately WordPress plugin (all versions before 3.7.1) allows any remote attacker to overwrite the site administrator's stored cloud service connection with an account under their control. This severs the legitimate administrator's access to the cloud template library and redirects the site's template source to attacker-controlled infrastructure, enabling supply-chain-style content injection against the WordPress admin. A publicly available proof-of-concept exists per WPScan, though EPSS remains very low (0.14%, 3rd percentile), and no CISA KEV listing confirms active widespread exploitation at time of analysis.
Missing Authorization vulnerability in WPDeveloper Templately templately.1.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 40.9%.
The Templately WordPress plugin before 2.2.6 does not properly authorize the `saved-templates/delete` REST API call, allowing unauthenticated users to delete arbitrary posts. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting in the Templately WordPress plugin (versions ≤ 3.7.1) enables unauthenticated remote attackers to inject arbitrary JavaScript that executes in victim browsers upon user interaction, with scope change indicating cross-context impact. The CVSS vector (PR:N, S:C) confirms exploitation requires no authentication and that injected scripts escape the plugin's security context into the broader browser environment, enabling session hijacking, credential theft, or malicious content injection. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cloud credential hijacking in the Templately WordPress plugin (all versions before 3.7.1) allows any remote attacker to overwrite the site administrator's stored cloud service connection with an account under their control. This severs the legitimate administrator's access to the cloud template library and redirects the site's template source to attacker-controlled infrastructure, enabling supply-chain-style content injection against the WordPress admin. A publicly available proof-of-concept exists per WPScan, though EPSS remains very low (0.14%, 3rd percentile), and no CISA KEV listing confirms active widespread exploitation at time of analysis.
Missing Authorization vulnerability in WPDeveloper Templately templately.1.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 40.9%.
The Templately WordPress plugin before 2.2.6 does not properly authorize the `saved-templates/delete` REST API call, allowing unauthenticated users to delete arbitrary posts. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.