CVE-2024-7895

The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 2.8.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-7132

The Page Builder Gutenberg Blocks WordPress plugin before 3.1.13 does not escape the content of post embed via one of its block, which could allow users with the capability to publish posts editor and admin by default to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml...

CVE-2024-7132

The Page Builder Gutenberg Blocks WordPress plugin before 3.1.13 does not escape the content of post embed via one of its block, which could allow users with the capability to publish posts editor and admin by default to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml...

CVE-2024-7895

The CVE-2024-7895 entry corresponds to Beaver Builder – WordPress Page Builder and is corroborated by connected records. Red Hat’s CVE-2024-7895 entry describes a Stored Cross-Site Scripting flaw in Beaver Builder Lite (WordPress plugin) affecting all versions up to and including 2.8.3.5, trigger...

CVE-2024-7895 Beaver Builder (Lite Version) <= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter

The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 2.8.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-7895 Beaver Builder (Lite Version) <= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter

The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 2.8.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-5857 Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free <= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media Deletion

The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the af2handelfileremove AJAX action in all versions up to, and including, 3.7.3.2. This makes it...

CVE-2024-5857

CVE-2024-5857 affects Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free (WordPress). A missing capability check on the af2_handel_file_remove AJAX action in all versions up to 3.7.3.2 allows unauthenticated attackers to delete arbitrary media files. C...

WordPress Popup Builder plugin <= 4.3.6 - Sensitive Information Exposure via Imported Subscribers CSV File vulnerability

Sensitive Information Exposure via Imported Subscribers CSV File vulnerability discovered by Tim Coen in WordPress Plugin Popup Builder versions = 4.3.6...

WordPress Beaver Builder plugin <= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via type Parameter vulnerability discovered by zer0gh0st in WordPress Plugin Beaver Builder versions = 2.8.3.5...

WordPress Funnel Kit Funnel Builder PRO plugin <= 3.4.5 Authenticated(Contributor+) Stored Cross-Site Scripting via allow_iframe_tag_in_post vulnerability

WordPress Funnel Kit Funnel Builder PRO plugin = 3.4.5 AuthenticatedContributor+ Stored Cross-Site Scripting via allowiframetaginpost vulnerability discovered by Francesco Carlucci in WordPress Plugin Funnel Kit Funnel Builder PRO versions = 3.4.5...

WordPress plugin Beaver Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

WordPress plugin Cost Calculator Builder SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

WordPress plugin Page Builder Gutenberg Blocks 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2024-38666 · WordPress · Beaver Builder

Name of the Vulnerable Software and Affected Versions: Beaver Builder – WordPress Page Builder versions up to, and including, 2.8.3.5 Description: The issue is related to Stored Cross-Site Scripting via the type parameter due to insufficient input sanitization and output escaping. This allows...

WordPress plugin Beaver Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

WordPress Beaver Builder Plugin <= 2.8.3.5 is vulnerable to Cross Site Scripting (XSS)

Software Beaver Builder Type Plugin Vulnerable versions = 2.8.3.5 Fixed in 2.8.3.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7895 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 249291af5e88 Credits zer0gh0st Required...

WordPress plugin Funnel Kit Funnel Builder PRO 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

PT-2024-30815 · WordPress · Classic Addons – Wpbakery Page Builder

Name of the Vulnerable Software and Affected Versions: Classic Addons – WPBakery Page Builder versions prior to 3.0 Description: The issue is related to improper neutralization of input during web page generation, leading to a Cross-site Scripting XSS vulnerability, specifically Stored XSS. This...

PT-2024-20924 · WordPress · Popup Builder

Name of the Vulnerable Software and Affected Versions: Popup Builder plugin for WordPress versions up to, and including, 4.3.3 Description: The issue is a Sensitive Information Exposure vulnerability in the Popup Builder plugin for WordPress, specifically via the Subscribers Import feature. This...