Over 1 Million Sites Impacted by Vulnerability in Starter Templates Plugin

On October 4, 2021, the Wordfence Threat Intelligence team initiated the responsible disclosure process for the Starter Templates plugin, which is installed on over 1 Million WordPress websites. The full name of the WordPress plugin is “Starter Templates — Elementor, Gutenberg & Beaver Builder...

CVE-2021-24158

Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for...

Default configuration

Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for...

Critical WordPress-Plugin Bug Found in 'Orbit Fox' Allows Site Takeover

Two vulnerabilities one critical in a WordPress plugin called Orbit Fox could allow attackers to inject malicious code into vulnerable websites and/or take control of a website. Orbit Fox is a multi-featured WordPress plugin that works with the Elementor, Beaver Builder and Gutenberg site-buildin...

Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege Escalation

Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for...

Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege Escalation

Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for...

PT-2020-6783 · WordPress · Beaver Builder

Name of the Vulnerable Software and Affected Versions: Beaver Builder versions up to, and including, 2.5.5.2 Description: The issue exists due to insufficient input sanitization and output escaping in the 'Text Editor' block of the Beaver Builder plugin for WordPress. This allows authenticated...

PT-2020-6782 · Unknown · Beaver Builder

Name of the Vulnerable Software and Affected Versions: Beaver Builder versions up to, and including, 2.5.5.2 Description: The issue arises from insufficient input sanitization and output escaping in the 'Caption - On Hover' value associated with images. This allows authenticated attackers with...

PT-2020-6784 · Unknown · Beaver Builder

Name of the Vulnerable Software and Affected Versions: Beaver Builder versions up to, and including, 2.5.5.2 Description: The issue arises from insufficient input sanitization and output escaping of the caption parameter when uploading media files through the Beaver Builder editor. This allows...

PT-2020-6779 · WordPress · Beaver Builder

Name of the Vulnerable Software and Affected Versions: The Beaver Builder – WordPress Page Builder versions up to, and including, 2.5.5.2 Description: The issue is related to Stored Cross-Site Scripting via the Image URL value in the Media block due to insufficient input sanitization and output...

Ultimate Addons for Beaver Builder < 1.25.0 - Cross-Site Scripting (XSS)

From the plugin's changelog file: "22 Jan 2020 Important Security Update: Update Now! A security researcher privately reported a bug about cross-site scripting XSS vulnerability. Our team immediately took action, and provided the required patch within 2 hours, releasing the update on the same day...

WordPress Ultimate Addons for Beaver Builder <= 1.24.3 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability discovered in WordPress Ultimate Addons for Beaver Builder versions = 1.24.3. Solution Update the WordPress Ultimate Addons for Beaver Builder to the latest available version at least 1.25.0...

Wordpress Ultimate Addons for Beaver Builder Authentication Bypass Vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. An authentication bypass vulnerability exists in Wordpress Ultimate Addons for Beaver...

WordPress Ultimate Addons For Beaver Builder 1.2.4.1 Authentication Bypass

Exploit Title: Wordpress Ultimate Addons for Beaver Builder 1.2.4.1 - Authentication Bypass Date: 2019-12-21 Exploit Authors: Raphael Karger & Nathan Hrncirik Vendor Homepage: https://www.ultimatebeaver.com/ Version: Ultimate Addons for Beaver Builder | || | |/| / /| / //\ | /|//|||| / / / /...

Wordpress Ultimate Addons for Beaver Builder 1.2.4.1 - Authentication Bypass Exploit

Exploit for php platform in category web applications Exploit Title: Wordpress Ultimate Addons for Beaver Builder 1.2.4.1 - Authentication Bypass Exploit Authors: Raphael Karger & Nathan Hrncirik Vendor Homepage: https://www.ultimatebeaver.com/ Version: Ultimate Addons for Beaver Builder | || |...

Wordpress Ultimate Addons for Beaver Builder 1.2.4.1 - Authentication Bypass

Wordpress Ultimate Addons for Beaver Builder 1.2.4.1 - Authentication Bypass Exploit Title: Wordpress Ultimate Addons for Beaver Builder 1.2.4.1 - Authentication Bypass Date: 2019-12-21 Exploit Authors: Raphael Karger & Nathan Hrncirik Vendor Homepage: https://www.ultimatebeaver.com/ Version:...

WordPress Plugin Ultimate Addons for Beaver Builder 1.2.4.1 - Authentication Bypass

Exploit Title: Wordpress Ultimate Addons for Beaver Builder 1.2.4.1 - Authentication Bypass Date: 2019-12-21 Exploit Authors: Raphael Karger & Nathan Hrncirik Vendor Homepage: https://www.ultimatebeaver.com/ Version: Ultimate Addons for Beaver Builder | || | |/| / /| / //\ | /|//|||| / / / /...

WordPress Beaver Builder and Elementor plugin authentication bypass vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language.Beaver Builder and Elementor are among the plugins. An authentication bypass vulnerability exists in the WordPress Beaver Builder and Elementor plugins, which can be exploited by an attacker to gain...

PT-2026-51139

Name of the Vulnerable Software and Affected Versions WordPress Ultimate Addons for Beaver Builder version 1.2.4.1 Description An authentication bypass exists in the social media login form functionality. Attackers can gain unauthorized access by submitting a POST request to the 'admin-ajax.php'...

WordPress Ultimate Addons for Beaver Builder plugin <= 1.24.0 - Authentication Bypass vulnerability

Authentication Bypass vulnerability found by MalCare in WordPress Ultimate Addons for Beaver Builder plugin versions = 1.24.0. Solution Update the WordPress Ultimate Addons for Beaver Builder plugin to the latest available version at least 1.24.1...