CVE-2024-37936

CVE-2024-37936 describes a Stored XSS in Tabs For WPBakery Page Builder (WordPress) due to improper input neutralization during web page generation. Affected: Tabs For WPBakery Page Builder versions n/a through 1.2 (plugin name: Tabs For WPBakery Page Builder, formerly Visual Composer). Impact is...

WordPress Livemesh Addons for Beaver Builder plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Livemesh Addons for Beaver Builder versions = 3.6.1...

WordPress Livemesh Addons for Beaver Builder Plugin <= 3.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Livemesh Addons for Beaver Builder Type Plugin Vulnerable versions = 3.6.1 Fixed in 3.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38784 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 43cde8d51b14 Credits João Pedro S Alcântar...

CVE-2024-3242

The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the validateImageContent function called via storeImages in all versions up to, and including, 2.4.43. This makes it possible for authenticated attackers, with...

CVE-2024-3242 Brizy – Page Builder <= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload

The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the validateImageContent function called via storeImages in all versions up to, and including, 2.4.43. This makes it possible for authenticated attackers, with...

CVE-2024-3242 Brizy – Page Builder <= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload

The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the validateImageContent function called via storeImages in all versions up to, and including, 2.4.43. This makes it possible for authenticated attackers, with...

CVE-2024-3242

CVE-2024-3242 concerns Brizy – Page Builder for WordPress. The issue is an arbitrary file upload vulnerability caused by missing file extension validation in validateImageContent (via storeImages) in all versions up to 2.4.43. This could allow authenticated attackers with contributor+ privileges ...

BIT-WORDPRESS-2024-30453

Server-Side Request Forgery SSRF vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.6.5...

BIT-WORDPRESS-MULTISITE-2024-30453

Server-Side Request Forgery SSRF vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.6.5...

BIT-WORDPRESS-2024-35655

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Brave Brave Popup Builder allows Stored XSS.This issue affects Brave Popup Builder: from n/a through 0.6.9...

WordPress Brizy – Page Builder plugin <= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload vulnerability

Authenticated Contributor+ Arbitrary File Upload vulnerability discovered by stealthcopter in WordPress Plugin Brizy versions = 2.4.44...

WordPress Brizy Plugin <= 2.4.44 is vulnerable to Arbitrary File Upload

Software Brizy Type Plugin Vulnerable versions = 2.4.44 Fixed in 2.4.45 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-3242 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID cefdc004eccb Credits stealthcopter Required privilege Contributor...

WordPress Ultimate Addons for WPBakery Page Builder plugin <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by haidv35 in WordPress Plugin Ultimate Addons for WPBakery Page Builder versions = 3.19.20...

WordPress Ultimate Addons for WPBakery Page Builder Plugin <= 3.19.20 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Addons for WPBakery Page Builder Type Plugin Vulnerable versions = 3.19.20 Fixed in 3.19.20.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5251 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 581cfa0b62a8...

CVE-2024-1937

The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateitem' function in all versions up to, and including, 2.4.44. This makes it possible for authenticated attackers, with contributor access and above, to...

CVE-2024-1937

The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateitem' function in all versions up to, and including, 2.4.44. This makes it possible for authenticated attackers, with contributor access and above, to...

CVE-2024-1937 Brizy – Page Builder <= 2.4.44 - Missing Authorization to Authenticated (Contributor+) Post Modification

The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateitem' function in all versions up to, and including, 2.4.44. This makes it possible for authenticated attackers, with contributor access and above, to...

CVE-2024-1937 Brizy – Page Builder <= 2.4.44 - Missing Authorization to Authenticated (Contributor+) Post Modification

The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateitem' function in all versions up to, and including, 2.4.44. This makes it possible for authenticated attackers, with contributor access and above, to...

CVE-2024-1937

CVE-2024-1937 (Brizy – Page Builder for WordPress) affects Brizy up to version 2.4.44. The vulnerability is caused by a missing capability check in the update_item function, allowing authenticated attackers with contributor access and above to modify content of arbitrary published posts, includin...

CVE-2024-6565

CVE-2024-6565 (AForms – Form Builder for Price Calculator & Cost Estimation, WordPress) is an information disclosure vulnerability in all versions up to 2.2.6, caused by the plugin’s use of the aura library and direct access to phpunit test files, enabling unauthenticated full path disclosure. Pu...