CVE-2022-47597

The CVE-2022-47597 entry affects the WordPress plugin Popup Maker (Popup for opt-ins, lead gen, & more) up to version 1.17.1. Multiple sources confirm an information disclosure vulnerability where sensitive data could be exposed to unauthenticated actors. NVD scores it CVSS v3.1 at 7.5 (High) wit...

CVE-2022-47597: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Popup Maker Popup Maker – Popup for opt-ins, lead gen, & more.This issue affects Popup Maker – Popup for opt-ins, lead gen, & more: from n/a through 1.17.1...

CVE-2023-48325 WordPress Landing Page Builder Plugin <= 1.5.1.5 is vulnerable to Open Redirection

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in PluginOps Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages.This issue affects Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages: from n/a through 1.5.1.5...

AWeber < 7.3.10 - Missing Authorization via AJAX actions

Description The AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions hooked by AJAX actions in all versio...

CVE-2023-47757

Missing Authorization, Cross-Site Request Forgery CSRF vulnerability in AWeber AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth allows Accessing Functionality Not Properly Constrained by ACLs, Cross-Site Request Forgery.This issue affects...

Cross site request forgery (csrf)

Missing Authorization, Cross-Site Request Forgery CSRF vulnerability in AWeber AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth allows Accessing Functionality Not Properly Constrained by ACLs, Cross-Site Request Forgery.This issue affects...

CVE-2023-47757

CVE-2023-47757 affects the AWeber – Free Sign Up Form and Landing Page Builder WordPress plugin. The vulnerability is due to missing authorization and CSRF, enabling access to functionality not properly constrained by ACLs. Affected versions are listed as n/a through 7.3.9; exploitation could all...

CVE-2023-47757 WordPress AWeber Plugin <= 7.3.9 is vulnerable to Broken Access Control

Missing Authorization, Cross-Site Request Forgery CSRF vulnerability in AWeber AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth allows Accessing Functionality Not Properly Constrained by ACLs, Cross-Site Request Forgery.This issue affects...

CVE-2023-47757: Missing Authorization

Missing Authorization, Cross-Site Request Forgery CSRF vulnerability in AWeber AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth allows Accessing Functionality Not Properly Constrained by ACLs, Cross-Site Request Forgery.This issue affects...

CVE-2023-45047

Cross-Site Request Forgery CSRF vulnerability in LeadSquared, Inc LeadSquared Suite plugin = 0.7.4 versions...

WordPress Plugin Fast & Effective Popups & Lead-Generation for WordPress - HollerBox Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

WordPress plugin Landing Page Builder - Lead Page - Optin Page - Squeeze Page - WordPress Landing Pages Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

WordPress plugin notifyvisitors-lead-form 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress Lead Generated Plugin < 1.25 Object Injection Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:leadgenerated:leadgenerated"; ifdescription...

LinkedIn: HTML injection at Company Name or Product Name and can be shown on Contact Sales form

A vulnerability was discovered that allowed HTML injection into the company name and product name fields on a contact sales form. Attackers could exploit this to conduct phishing attacks or distribute malware. The issue was addressed...

WordPress WP Lead Stream Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)

Software WP Lead Stream Type Plugin Vulnerable versions = 1.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d2971cba9459 Credits Rafie Muhammad Patchstack Required...

WordPress Pretty Opt In Lite – Content Locker for Lead Generation Plugin <= 1.3.13 is vulnerable to Cross Site Scripting (XSS)

Software Pretty Opt In Lite – Content Locker for Lead Generation Type Plugin Vulnerable versions = 1.3.13 Fixed in 1.3.14 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 550b1e29c12...

WordPress Contact Form & Lead Form Elementor Builder Plugin <= 1.8.4 is vulnerable to Broken Access Control

Software Contact Form & Lead Form Elementor Builder Type Plugin Vulnerable versions = 1.8.4 Fixed in 1.8.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-25969 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 970570cbeaa7 Credits...

WordPress CRM and Lead Management by vcita Plugin <= 2.7.1 is vulnerable to Cross Site Scripting (XSS)

Software CRM and Lead Management by vcita Type Plugin Vulnerable versions = 2.7.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2405 Patch priority Low CVSS severity Low 6.1 Developer Claim ownership PSID b8d44a43844f Credits Jonas...

WordPress CRM and Lead Management by vcita Plugin <= 2.6.2 is vulnerable to Cross Site Scripting (XSS)

Software CRM and Lead Management by vcita Type Plugin Vulnerable versions = 2.6.2 Fixed in 2.7.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2404 Patch priority Medium CVSS severity Medium 6.4 Developer Claim ownership PSID 13e385882b8d Credits...