WordPress plugin Contact Form Builder by vcita 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress plugin Contact Form Builder by vcita 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2023-3052

CVE-2023-3052 refers to the Page Builder by AZEXO WordPress plugin. A CSRF flaw exists in versions up to 1.27.133 caused by missing/incorrect nonce validation in the azh_add_post, azh_duplicate_post, azh_update_post, and azh_remove_post actions, enabling unauthenticated attackers to create, modif...

CVE-2023-3053 Page Builder by AZEXO <= 1.27.133 - Missing Authorization to Post Creation

The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'azhaddpost' function in versions up to, and including, 1.27.133. This makes it possible for authenticated attackers to create a post with any post type and...

CVE-2023-3053

CVE-2023-3053 affects Page Builder by AZEXO for WordPress. The vulnerability is due to a missing capability check in the azh_add_post function, present up to version 1.27.133. This Broken Access Control allows authenticated attackers to create posts with any post type and post status. The Initial...

CVE-2023-3053 Page Builder by AZEXO <= 1.27.133 - Missing Authorization to Post Creation

The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'azhaddpost' function in versions up to, and including, 1.27.133. This makes it possible for authenticated attackers to create a post with any post type and...

CVE-2023-3051 Page Builder by AZEXO <= 1.27.133 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Page Builder by AZEXO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'azhpost' shortcode in versions up to, and including, 1.27.133 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web...

CVE-2023-3055 Page Builder by AZEXO <= 1.27.133 - Cross-Site Request Forgery to Stored Cross-Site Scripting via azh_save

The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing or incorrect nonce validation on the 'azhsave' function. This makes it possible for unauthenticated attackers to update the post content an...

CVE-2023-3051

CVE-2023-3051 concerns the WordPress plugin “Page Builder by AZEXO” (AZEXO Page Builder). The vulnerability is a stored XSS via the shortcode attribute shown as ‘azh_post’ in versions up to and including 1.27.133, caused by insufficient input sanitization and inadequate output escaping. The impac...

Contact Form Builder by vcita <= 4.10.2 - Settings Update Via CSRF

The plugin does not protect its settings page against CSRF attacks, allowing an unauthenticated attacker to change the plugin's settings, and on older versions alert1;...

PT-2023-22776 · Azexo · The Page Builder By Azexo

Name of the Vulnerable Software and Affected Versions: The Page Builder by AZEXO plugin for WordPress versions up to, and including, 1.27.133 Description: The issue is due to missing or incorrect nonce validation on the azh save function, making it possible for unauthenticated attackers to update...

Page Builder by AZEXO <= 1.27.133 - Cross-Site Request Forgery (CSRF)

The plugin does not protect the ajax actions azhaddpost, azhduplicatepost, azhupdatepost and azhremovepost against CSRF attacks, allowing an unauthenticated attacker to add, modify and delete posts by tricking a logged in user to submit a crafted request...

PT-2023-22740 · Azexo · The Page Builder By Azexo

Name of the Vulnerable Software and Affected Versions: The Page Builder by AZEXO plugin for WordPress versions up to, and including, 1.27.133 Description: The issue is related to Stored Cross-Site Scripting via the azh post shortcode due to insufficient input sanitization and output escaping. Thi...

WordPress Elementor Website Builder Plugin < 3.12.2 SQLi Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:elementor:websitebuilder"; ifdescription...

WordPress Elementor Website Builder Plugin < 3.18.2 RCE Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:elementor:websitebuilder"; ifdescription...

Page Builder by AZEXO <= 1.27.133 - Subscriber+ Post Creation

The plugin does not properly authorize post creation in it's azhaddpost ajax action, allowing any authenticated users to create posts with any post type and status, even when that should not have this capability...

Page Builder by AZEXO <= 1.27.133 - Contributor+ Stored Cross-Site Scripting via shortcode

The plugin does not validate and escape the attributes of the azhpost shortcode before outputting them back into the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins...

WordPress Elementor Website Builder Plugin < 3.16.5 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:elementor:websitebuilder"; ifdescription...

Exploit for Cross-site Scripting in Elementor Website_Builder

CVE-2022-29455 Mass Sca...

Important: Red Hat Security Advisory: ACS 4.0 enhancement and security update

Updated images are now available for Red Hat Advanced Cluster Security RHACS. The updated image includes security and bug fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...