Ithemes develops a focused portfolio of WordPress security, backup, and site-building products that serve a large installed base of small-to-medium site operators and agencies. The vendor's vulnerability profile is characterized by application-layer weaknesses endemic to web software: cross-site scripting, SQL injection, authentication flaws, path traversal, and sensitive information exposure recur across products such as BackupBuddy, Security, and Builder Theme Market. While severity remains modest, the vulnerabilities frequently attract public exploit code, reflecting the appeal of WordPress-targeted tooling and the accessibility of these products to non-specialist attackers. Defenders managing WordPress deployments should treat Ithemes plugin and theme updates as routine maintenance rather than crisis-driven patching, though the public availability of exploit code warrants prompt application once updates are released. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Ithemes over time
Signals from CVEs in this vendor scope (25 CVEs).
25 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-14092CRITICAL The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection. | Jul 2, 2020 | 9.8 | 88 | NO | YES |
CVE-2022-31474HIGH Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8 | Mar 13, 2023 | 7.5 | 70 | NO | YES |
CVE-2018-12636HIGH The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs page. | Jun 22, 2018 | 7.2 | 50 | NO | YES |
CVE-2022-4897MEDIUM The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, leading to Reflected Cross-Site Scripting | Feb 21, 2023 | 6.1 | 31 | NO | YES |
CVE-2018-7433HIGH The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page. | Mar 2, 2018 | 7.5 | 25 | NO | NO |
CVE-2020-36176HIGH The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until the second login occu | Jan 6, 2021 | 7.5 | 22 | NO | NO |
CVE-2013-2741HIGH importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to ob | Apr 2, 2013 | 7.5 | 22 | NO | NO |
CVE-2015-9379MEDIUM iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg(). | Aug 28, 2019 | 6.1 | 21 | NO | NO |
CVE-2015-9378MEDIUM iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg(). | Aug 28, 2019 | 6.1 | 21 | NO | NO |
CVE-2015-9372MEDIUM Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). | Aug 28, 2019 | 6.1 | 21 | NO | NO |
Signals from CVEs in this vendor scope (25 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Ithemes.
Media articles that mention a CVE ID that affects a product developed by Ithemes — matched by CVE ID, not by vendor name.