CVE-2023-45609

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in POWR.Io Contact Form – Custom Builder, Payment Form, and More allows Stored XSS.This issue affects Contact Form – Custom Builder, Payment Form, and More: from n/a through 2.1.0...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in POWR.Io Contact Form – Custom Builder, Payment Form, and More allows Stored XSS.This issue affects Contact Form – Custom Builder, Payment Form, and More: from n/a through 2.1.0...

CVE-2023-45609

CVE-2023-45609 affects the POWR.Io Contact Form – Custom Builder, Payment Form, and More (Powr Pack) for WordPress. The issue is a Stored XSS caused by improper input neutralization during web page generation, affecting versions n/a through 2.1.0. The root cause is insufficient sanitization of in...

PT-2023-29590 · Unknown · Contact Form – Custom Builder

Name of the Vulnerable Software and Affected Versions: Contact Form – Custom Builder, Payment Form, and More versions n/a through 2.1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting'. This allows for Stored XS...

WordPress Plugin Elementor Website Builder Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Landing Page Builder < 1.5.1.6 - Open Redirect

Description The Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.5.1.5. This is due to insufficient validation on the redirect url supplied via user input or request...

10Web Map Builder for Google Maps < 1.0.74 - Cross-Site Request Forgery to Notice Dismissal

Description The 10Web Map Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.73. This is due to missing or incorrect nonce validation on the gmwdbpinstallnoticestatus function. This makes it possible for unauthenticated attackers to...

Metform Elementor Contact Form Builder < 3.3.2 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode

Description The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mffirstname' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information...

CVE-2023-47835

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder plugin = 1.2.32 versions...

ChatBot 4.8.6 - 4.9.6 - Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder

Description The ChatBot for WordPress is vulnerable to Stored Cross-Site Scripting via the FAQ Builder in versions 4.8.6 through 4.9.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to...

WordPress Landing Page Builder Plugin <= 1.5.1.5 is vulnerable to Open Redirection

Software Landing Page Builder Type Plugin Vulnerable versions = 1.5.1.5 Fixed in 1.5.1.6 OWASP Top 10 A1: Injection Classification Open Redirection CVE CVE-2023-48325 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID cde57cbd94f8 Credits minhtuanact Required privilege...

Thrive Theme Builder < 3.24.0 - Subscriber+ Privilege Escalation

Description The them is vulnerable to privilege escalation, allowing any authenticated users, such as subscribers to elevate their privileges...

Thrive Theme Builder < 3.24.2 - Cross-Site Request Forgery

Description The theme does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

Thrive Theme Builder < 3.24.0 - Missing Authorization

Description The theme is vulnerable to unauthorized use of functionality due to missing capability check in one of its functions. This makes it possible for authenticated attackers, with subscriber-level access and above, to invoke this function intended for higher-privileged users. The exact...

CVE-2023-47835

CVE-2023-47835 — ARI Stream Quiz (WordPress)

CVE-2023-47835 WordPress ARI Stream Quiz Plugin <= 1.2.32 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder plugin = 1.2.32 versions...

CVE-2023-47781

Cross-Site Request Forgery CSRF vulnerability in Thrive Themes Thrive Theme Builder 3.24.2 versions...

CVE-2023-47781

Cross-Site Request Forgery CSRF vulnerability in Thrive Themes Thrive Theme Builder 3.24.2 versions...

CVE-2023-47781

Thrive Theme Builder (WordPress) before version 3.24.2 is vulnerable to Cross-Site Request Forgery (CSRF). Root cause: missing CSRF checks in the affected theme builder, enabling unauthorized actions by forged requests from logged-in users. Impact per CVSS: high (8.8/10), affecting confidentialit...

CVE-2023-47781 WordPress Thrive Theme Builder Theme < 3.24.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Thrive Themes Thrive Theme Builder 3.24.2 versions...