CVE-2024-7414 PDF Builder for WPForms <= 1.2.116 - Unauthenticated Full Path Disclosure

The PDF Builder for WPForms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.116. This is due to the plugin allowing direct access to the composer-setup.php file which has displayerrors on. This makes it possible for unauthenticated attackers to...

CVE-2024-7414 PDF Builder for WPForms <= 1.2.116 - Unauthenticated Full Path Disclosure

The PDF Builder for WPForms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.116. This is due to the plugin allowing direct access to the composer-setup.php file which has displayerrors on. This makes it possible for unauthenticated attackers to...

CVE-2024-7414

CVE-2024-7414 affects the PDF Builder for WPForms WordPress plugin. It allows Full Path Disclosure in all versions up to 1.2.116 via direct access to composer-setup.php (display_errors enabled), letting unauthenticated users retrieve the web app’s full path. This information can aid other attacks...

PT-2024-38330 · WordPress · Pdf Builder For Wpforms

Name of the Vulnerable Software and Affected Versions: PDF Builder for WPForms plugin for WordPress versions up to, and including, 1.2.116 Description: The issue is related to Full Path Disclosure, which occurs because the plugin allows direct access to the composer-setup.php file with display...

CVE-2024-6254

The Brizy – Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on form submissions. This makes it possible for unauthenticated attackers to submit forms intended for public...

CVE-2024-6254 Brizy – Page Builder <= 2.5.1 - Cross-Site Request Forgery

The Brizy – Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on form submissions. This makes it possible for unauthenticated attackers to submit forms intended for public...

CVE-2024-6254 Brizy – Page Builder <= 2.5.1 - Cross-Site Request Forgery

The Brizy – Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on form submissions. This makes it possible for unauthenticated attackers to submit forms intended for public...

CVE-2024-6254

CVE-2024-6254 affects Brizy – Page Builder for WordPress. The WordPress plugin is vulnerable to Cross-Site Request Forgery in all versions up to 2.5.1 due to missing nonce validation on form submissions, enabling unauthenticated attackers to trigger actions by tricking an admin. On sites with unf...

WordPress Brizy Plugin <= 2.5.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Brizy Type Plugin Vulnerable versions = 2.5.1 Fixed in 2.5.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-6254 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 9fdb14a0892f Credits Xetnus Required privilege...

WordPress Ultimate Addons for Beaver Builder – Lite plugin <= 1.5.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Khalid Patchstack Alliance in WordPress Plugin Ultimate Addons for Beaver Builder – Lite versions = 1.5.9...

WordPress Cost Calculator Builder plugin <= 3.2.15 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Cost Calculator Builder versions = 3.2.15...

WordPress WP Table Builder plugin <= 1.4.15 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin WP Table Builder versions = 1.4.15...

WordPress Ultimate Addons for Beaver Builder – Lite Plugin <= 1.5.9 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Addons for Beaver Builder – Lite Type Plugin Vulnerable versions = 1.5.9 Fixed in 1.5.10 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43151 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a2ad79bb3d87 Credits Khalid Yusu...

WordPress Cost Calculator Builder Plugin <= 3.2.15 is vulnerable to SQL Injection

Software Cost Calculator Builder Type Plugin Vulnerable versions = 3.2.15 Fixed in 3.2.16 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-43144 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID fbb21d9d89fe Credits Trương Hữu Phúc truonghuuphuc Require...

WordPress WPBakery plugin <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by João Pedro Soares de Alcântara in WordPress Plugin WPBakery Page Builder versions = 7.7...

WordPress WPBakery plugin <= 7.7 - Authenticated (Author+) Local File Inclusion vulnerability

Authenticated Author+ Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara in WordPress Plugin WPBakery Page Builder versions = 7.7...

WordPress Blox Page Builder plugin <= 1.0.65 - Authenticated (Contributor+) Arbitrary File Upload vulnerability

Authenticated Contributor+ Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin Blox Page Builder versions = 1.0.65...

CVE-2024-6315

The Blox Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handleUploadFile' function in all versions up to, and including, 1.0.65. This makes it possible for authenticated attackers, with contributor-level and above permissions,...

CVE-2024-6315 Blox Page Builder <= 1.0.65 - Authenticated (Contributor+) Arbitrary File Upload

The Blox Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handleUploadFile' function in all versions up to, and including, 1.0.65. This makes it possible for authenticated attackers, with contributor-level and above permissions,...

CVE-2024-6315

CVE-2024-6315 concerns Blox Page Builder for WordPress. The vulnerability stems from missing file-type validation in the handleUploadFile function across versions up to 1.0.65, enabling authenticated users with contributor+ permissions to upload arbitrary files to the server; this could enable re...