CVE-2024-12206: Cross-Site Request Forgery (CSRF)

The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.8. This is due to missing or incorrect nonce validation on the stmheaderbuilder page. This makes it possible for unauthenticated attackers to dele...

CVE-2024-5468: Missing Authorization

The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to unauthorized site option deletion due to a missing validation and capability checks on the stmhbdelete function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to...

PT-2024-36403

Name of the Vulnerable Software and Affected Versions WordPress Header Builder Plugin – Pearl versions up to, and including, 1.3.7 Description The issue is related to unauthorized site option deletion due to missing validation and capability checks on the stm hb delete function. This allows...

CVE-2024-4000: Improper Neutralization of Input During Web Page Generation

The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stmhb' shortcode in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib...

PT-2023-13599

Name of the Vulnerable Software and Affected Versions StylemixThemes WordPress Header Builder Plugin – Pearl versions prior to 1.3.4 Description The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

CVE-2022-38356: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in StylemixThemes WordPress Header Builder Plugin – Pearl plugin = 1.3.4 versions...