Woostify develops WordPress plugins for site building and content management, with its exposure centered on authorization and input-handling issues in products such as the Boostify Header Footer Builder for Elementor and its Sites Library. The recurring weaknesses—missing authorization controls and cross-site scripting in page-generation contexts—reflect the attack surface inherent to plugins that handle user-supplied content and access controls in WordPress environments. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Woostify over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-6279HIGH The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blo | Jan 29, 2024 | 7.1 | 22 | NO | NO |
CVE-2024-5006MEDIUM The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all versions up to, and including, 1. | Jun 5, 2024 | 5.4 | 17 | NO | NO |
CVE-2024-4788MEDIUM The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_bhf_post fu | Jun 6, 2024 | 4.3 | 15 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Woostify.
Media articles that mention a CVE ID that affects a product developed by Woostify — matched by CVE ID, not by vendor name.