Skip to content
OpenAdvisories

Vendor

codeworkweb

4 known vulnerabilities.

Products

CWW Companion 2 CWW Portfolio 1 Xews Lite 1
All Critical High Medium Low Exploited only

4 results · Feed

  • Medium 4.3
    CVE-2025-67473

    WordPress CWW Companion plugin <= 1.3.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in codeworkweb CWW Companion cww-companion allows Cross Site Request Forgery.This issue affects CWW Companion: from n/a through <= 1.3.2.

    codeworkweb CWW Companion
  • High 7.5
    CVE-2025-39359

    WordPress CWW Portfolio theme <= 1.3.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codeworkweb CWW Portfolio cww-portfolio allows PHP Local File Inclusion.This issue affects CWW Portfolio: from n/a through <= 1.3.1.

    codeworkweb CWW Portfolio
  • High 7.5
    CVE-2025-39383

    WordPress Xews Lite plugin <= 1.0.9 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codeworkweb Xews Lite xews-lite allows PHP Local File Inclusion.This issue affects Xews Lite: from n/a through <= 1.0.9.

    codeworkweb Xews Lite
  • Medium 6.4
    CVE-2024-2130

    CWW Companion <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The CWW Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Module2 widget in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib…

    codeworkweb CWW Companion Web / CMS