WordPress PageLayer plugin <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode vulnerability

Authenticated Contributor+ Private Post Disclosure in pagelayerbuilderpostsshortcode vulnerability discovered by Nishiv in WordPress Plugin PageLayer versions = 1.9.8...

CVE-2025-28864

Cross-Site Request Forgery CSRF vulnerability in planetstudio Builder for Contact Form 7 by Webconstruct cf7-builder allows Cross Site Request Forgery.This issue affects Builder for Contact Form 7 by Webconstruct: from n/a through = 1.2.2...

CVE-2025-28864

Cross-Site Request Forgery CSRF vulnerability in Planet Studio Builder for Contact Form 7 by Webconstruct allows Cross Site Request Forgery. This issue affects Builder for Contact Form 7 by Webconstruct: from n/a through 1.2.2...

CVE-2025-28864 WordPress Builder for Contact Form 7 by Webconstruct plugin <= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in planetstudio Builder for Contact Form 7 by Webconstruct cf7-builder allows Cross Site Request Forgery.This issue affects Builder for Contact Form 7 by Webconstruct: from n/a through = 1.2.2...

CVE-2025-28864

CVE-2025-28864 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Builder for Contact Form 7 by Webconstruct . The vulnerability affects plugin versions up to and including 1.2.2 (reported as affected “from n/a through 1.2.2”). Public sources in the Connected Docu...

WordPress plugin Builder for Contact Form 7 by Webconstruct 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2025-1926

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.8. This is due to missing or incorrect nonce validation on the pagelayersavepost function. This makes it possible for...

CVE-2025-26989

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in softdiscover Zigaform zigaform-form-builder-lite allows Stored XSS.This issue affects Zigaform: from n/a through = 7.4.2...

CVE-2025-26994

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in softdiscover Zigaform – Price Calculator & Cost Estimation Form Builder Lite allows Stored XSS. This issue affects Zigaform – Price Calculator & Cost Estimation Form Builder Lite: from n/a through...

CVE-2025-26989

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in softdiscover Zigaform zigaform-form-builder-lite allows Stored XSS.This issue affects Zigaform: from n/a through = 7.4.2...

CVE-2025-26994

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in softdiscover Zigaform – Price Calculator & Cost Estimation Form Builder Lite zigaform-calculator-cost-estimation-form-builder-lite allows Stored XSS.This issue affects Zigaform – Price Calculator &...

CVE-2025-26989

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in softdiscover Zigaform – Form Builder Lite allows Stored XSS. This issue affects Zigaform – Form Builder Lite: from n/a through 7.4.2...

CVE-2025-26989

CVE-2025-26989 describes an unauthenticated Stored XSS in Zigaform – Form Builder Lite (WordPress plugin) up to version 7.4.2. The vulnerability stems from improper input neutralization during web page generation, enabling stored cross-site scripting. Affected software is the Zigaform Form Builde...

Flask App Builder 安全漏洞

Flask App Builder is a simple and fast application development framework by Daniel Vaz Gaspar Personal Developer. A security vulnerability exists in Flask App Builder versions prior to 4.5.3, which stems from an unauthenticated user being able to enumerate existing usernames...

WordPress plugin Zigaform – Form Builder Lite 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-1459

The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Embedded VideoPB widget in all versions up to, and including, 2.31.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-1459

CVE-2025-1459 describes a stored XSS in the WordPress Page Builder by SiteOrigin plugin. Affected: Page Builder by SiteOrigin (WP plugin) up to version 2.31.4. Root cause: insufficient input sanitization and output escaping in the Embedded Video (PB) widget, enabling authenticated attackers with ...

PT-2025-9158 · WordPress · The Page Builder By Siteorigin

Name of the Vulnerable Software and Affected Versions: The Page Builder by SiteOrigin plugin for WordPress versions up to, and including, 2.31.4 Description: The issue is related to Stored Cross-Site Scripting via the Embedded VideoPB widget due to insufficient input sanitization and output...

WordPress Page Builder by SiteOrigin plugin <= 2.31.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin Page Builder by SiteOrigin versions = 2.31.4...

CVE-2025-1757

The WordPress Portfolio Builder – Portfolio Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pfhubportfolio' and 'pfhubportfolioportfolio' shortcodes in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping o...