443 matches found
CVE-2023-6842
The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the name field label and description field label parameter in all versions up to 6.7 inclusive due to insufficient input...
VulnCheck KEV: CVE-2022-1386
The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the...
WordPress Ultimate Addons for Beaver Builder Plugin <= 1.35.13 is vulnerable to Arbitrary File Download
Software Ultimate Addons for Beaver Builder Type Plugin Vulnerable versions = 1.35.13 Fixed in 1.35.14 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2023-51401 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID 8fb95010e714 Credits Rafi...
Photo Gallery by 10Web < 1.8.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget
Description The Photo Gallery by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in versions up to, and including, 1.8.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...
CVE-2023-48325 WordPress Landing Page Builder Plugin <= 1.5.1.5 is vulnerable to Open Redirection
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in PluginOps Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages.This issue affects Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages: from n/a through 1.5.1.5...
CVE-2023-5990
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not have CSRF checks on some of its form actions such as deletion and duplication, which could allow attackers to make logged in admin perform such actions via CSRF attacks...
CVE-2023-47757: Missing Authorization
Missing Authorization, Cross-Site Request Forgery CSRF vulnerability in AWeber AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth allows Accessing Functionality Not Properly Constrained by ACLs, Cross-Site Request Forgery.This issue affects...
CVE-2023-47669 WordPress Profile Builder Plugin <= 3.10.3 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin = 3.10.3 versions...
CVE-2023-46823 WordPress ImageLinks Interactive Image Builder Plugin <= 1.5.4 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Avirtum ImageLinks Interactive Image Builder for WordPress allows SQL Injection.This issue affects ImageLinks Interactive Image Builder for WordPress: from n/a through 1.5.4...
CVE-2023-46211
CVE-2023-46211 is a stored Cross-Site Scripting (XSS) vulnerability in the Brainstorm Force Ultimate Addons for WPBakery Page Builder plugin, affected versions
CVE-2022-46841
Cross-Site Request Forgery CSRF vulnerability in Soflyy Oxygen Builder plugin = 4.4 versions...
CVE-2022-46841 WordPress Oxygen Builder Plugin < 4.4 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Soflyy Oxygen Builder plugin = 4.4 versions...
CVE-2022-46841 WordPress Oxygen Builder Plugin < 4.4 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Soflyy Oxygen Builder plugin = 4.4 versions...
CVE-2023-44474
CVE-2023-44474 concerns the Tiger Forms – Drag and Drop Form Builder WordPress plugin. The vulnerability is an unauthenticated, reflected Cross-Site Scripting (XSS) flaw affecting versions ≤ 2.0.0. Root cause details are not explicitly provided beyond the XSS classification, but public sources co...
CVE-2023-4059
The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated users to create the register, log-in and edit-profile pages from the plugin on the blog...
WordPress Cost Calculator Builder Plugin <= 3.1.42 is vulnerable to Broken Access Control
Software Cost Calculator Builder Type Plugin Vulnerable versions = 3.1.42 Fixed in 3.1.43 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-40011 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 3a6163be14b7 Credits Rafshanzani Suhada...
CVE-2023-25443
Cross-Site Request Forgery CSRF vulnerability in Wow-Company Button Generator – easily Button Builder plugin = 2.3.5 versions...
CVE-2023-25443
Cross-Site Request Forgery CSRF vulnerability in Wow-Company Button Generator – easily Button Builder plugin = 2.3.5 versions...