CVE-2024-10591

The CVE CVE-2024-10591 concerns the MWB HubSpot for WooCommerce plugin for WordPress (versions up to 1.5.9). The vulnerability is a missing capability check in hubwoo_save_updates(), allowing authenticated attackers with Contributor-level access or higher to modify arbitrary options, potentially ...

WordPress plugin MWB HubSpot for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-1597 · WordPress · Mwb Hubspot For Woocommerce

Name of the Vulnerable Software and Affected Versions: MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics plugin for WordPress versions up to, and including, 1.5.9 Description: The issue concerns unauthorized modification of data that can lead to...

CVE-2024-10591: Missing Authorization

The MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hubwoosaveupdates function in all version...

PT-2024-10624 · WordPress · Webuidesigning Nebulax Theme

Name of the Vulnerable Software and Affected Versions: webuidesigning NebulaX Theme versions up to 5.0 on WordPress Description: A critical vulnerability has been found in the webuidesigning NebulaX Theme, affecting the function nebula send to hubspot of the file libs/Legacy/Legacy.php. The...

HubPhish Abuses HubSpot Tools to Target 20,000 European Users for Credential Theft

Cybersecurity researchers have disclosed a new phishing campaign that has targeted European companies with an aim to harvest account credentials and take control of the victims' Microsoft Azure cloud infrastructure. The campaign has been codenamed HubPhish by Palo Alto Networks Unit 42 owing to t...

CVE-2024-8628 Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin <= 1.2.70.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'post-meta' shortcode in all versions up to, and including, 1.2.70.3 due to insufficient input sanitization and output escaping o...

CVE-2024-5879

The HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute of the HubSpot Meeting Widget in all versions up to, and including, 11.1.22 due to insufficient input sanitization and output escaping. This...

CVE-2024-5879

The HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute of the HubSpot Meeting Widget in all versions up to, and including, 11.1.22 due to insufficient input sanitization and output escaping. This...

CVE-2024-5879 HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics <= 11.1.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via HubSpot Meeting Widget

The HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute of the HubSpot Meeting Widget in all versions up to, and including, 11.1.22 due to insufficient input sanitization and output escaping. This...

CVE-2024-5879 HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics <= 11.1.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via HubSpot Meeting Widget

The HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute of the HubSpot Meeting Widget in all versions up to, and including, 11.1.22 due to insufficient input sanitization and output escaping. This...

CVE-2024-5879

CVE-2024-5879 —HubSpot plugin for WordPress is vulnerable to Stored XSS via the url attribute in the HubSpot Meeting Widget. Reported as affecting all versions up to 11.1.22 due to insufficient input sanitization and output escaping; exploitation requires Contributor-level access or higher and ca...

WordPress HubSpot plugin <= 11.1.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via HubSpot Meeting Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via HubSpot Meeting Widget vulnerability discovered by wesley wcraft in WordPress Plugin HubSpot versions = 11.1.22...

WordPress HubSpot Plugin <= 11.1.22 is vulnerable to Cross Site Scripting (XSS)

Software HubSpot Type Plugin Vulnerable versions = 11.1.22 Fixed in 11.1.34 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5879 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID db39dc037825 Credits wesley wcraft Required...

WordPress plugin HubSpot 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

CVE-2024-5879: Improper Neutralization of Input During Web Page Generation

The HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute of the HubSpot Meeting Widget in all versions up to, and including, 11.1.22 due to insufficient input sanitization and output escaping. This...

PT-2024-37216 · Hubspot · Hubspot

Name of the Vulnerable Software and Affected Versions: HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics plugin for WordPress versions up to, and including, 11.1.22 Description: The issue is related to Stored Cross-Site Scripting via the url attribute of the HubSpot Meeting Widget due ...

CVE-2024-7389

The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integration developer API key and make...

CVE-2024-7389

The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integration developer API key and make...

CVE-2024-7389 Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure

The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integration developer API key and make...