PT-2023-17683 · WordPress · Essential Blocks

Name of the Vulnerable Software and Affected Versions: The Essential Blocks plugin for WordPress versions up to, and including, 4.0.6 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the save function. This allows unauthenticated...

FUEL CMS SQL注入漏洞

FUEL CMS is a content management system CMS based on the Codelgniter framework. A security vulnerability exists in FUEL CMS v1.5.2, which is caused by an SQL injection vulnerability in the id parameter of the /controllers/Blocks.php page...

PT-2023-24382 · Fuel Cms · Fuel Cms

Name of the Vulnerable Software and Affected Versions: Fuel CMS version 1.5.2 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the id parameter at the "/controllers/Blocks.php" endpoint. Recommendations: For Fuel CMS version 1.5.2, consider restricting...

WordPress Getwid – Gutenberg Blocks Plugin <= 1.8.3 is vulnerable to Server Side Request Forgery (SSRF)

Software Getwid – Gutenberg Blocks Type Plugin Vulnerable versions = 1.8.3 Fixed in 1.8.4 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2023-1895 Patch priority Medium CVSS severity Medium 5 Developer Claim ownership PSID 688f43f1f9c1 Credits Ramuel Gall...

WordPress Getwid – Gutenberg Blocks Plugin <= 1.8.3 is vulnerable to Broken Access Control

Software Getwid – Gutenberg Blocks Type Plugin Vulnerable versions = 1.8.3 Fixed in 1.8.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-1910 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID bae53bb70dd5 Credits Ramuel Gall...

WordPress Getwid Gutenberg Blocks 1.8.3 Improper Authorization / SSRF

On April 6, 2023, the Wordfence Threat Intelligence team initiated the responsible disclosure process for two vulnerabilities in Getwid – Gutenberg Blocks, a plugin installed on over 50,000 WordPress sites. The plugin’s developers responded immediately, and we sent over the full disclosure the sa...

WordPress Plugin Gutenberg Blocks 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

WordPress Plugin Getwid Gutenberg Blocks 授权问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An authorization issue...

WordPress VK Blocks Plugin <= 1.57.0.5 is vulnerable to Broken Access Control

Software VK Blocks Type Plugin Vulnerable versions = 1.57.0.5 Fixed in 1.57.1.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0583 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 16379aba277f Credits Ramuel Gall Required privilege...

WordPress VK Blocks Plugin <= 1.57.1.2 is vulnerable to Broken Access Control

Software VK Blocks Type Plugin Vulnerable versions = 1.57.1.2 Fixed in 1.58.0.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0584 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3eea6caee3d8 Credits Ramuel Gall Required privilege...

CVE-2023-0584

The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'updateoptions' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change the 'vkfontawesomeversion' option to an arbitrar...

CVE-2023-0583

The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'updatevkblocksoptions' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change plugin settings including default icons...

CVE-2023-0584

The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'updateoptions' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change the 'vkfontawesomeversion' option to an arbitrar...

Authorization

The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'updatevkblocksoptions' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change plugin settings including default icons...

Authorization

The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'updateoptions' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change the 'vkfontawesomeversion' option to an arbitrar...

CVE-2023-0584 VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update

The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'updateoptions' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change the 'vkfontawesomeversion' option to an arbitrar...

CVE-2023-0584

The CVE-2023-0584 entry concerns the WordPress VK Blocks plugin. Affected versions: up to 1.57.0.5. Issue: improper authorization via the REST update_options function, allowing authenticated attackers with contributor-level permissions or higher to set vk_font_awesome_version to any value. Impact...

CVE-2023-0584 VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update

The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'updateoptions' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change the 'vkfontawesomeversion' option to an arbitrar...

CVE-2023-0584 VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update

The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'updateoptions' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change the 'vkfontawesomeversion' option to an arbitrar...

CVE-2023-0583

The CVE-2023-0583 entry concerns the VK Blocks plugin for WordPress. Affected component: REST endpoint for updating settings (update_vk_blocks_options). Root cause: improper authorization enabling attackers with contributor-level permissions or higher to change plugin settings, including default ...