PT-2024-24626 · WordPress · Loopus Wp Cost Estimation & Payment Forms Builder

Name of the Vulnerable Software and Affected Versions: Loopus WP Cost Estimation & Payment Forms Builder versions through 10.1.76 Description: The issue is related to a Missing Authorization vulnerability in Loopus WP Cost Estimation & Payment Forms Builder. Recommendations: For versions through...

WordPress WPBITS Addons For Elementor Page Builder plugin <= 1.3.4.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Khalid Patchstack Alliance in WordPress Plugin WPBITS Addons For Elementor Page Builder versions = 1.3.4.2...

WordPress Void Elementor WHMCS Elements For Elementor Page Builder plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Khalid Patchstack Alliance in WordPress Plugin Void Elementor WHMCS Elements For Elementor Page Builder versions = 2.0...

WordPress App Builder plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin App Builder versions = 3.8.8...

UBUNTU-CVE-2024-22262

Applications that use UriComponentsBuilder to parse an externally provided URL e.g. through a query parameter AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is...

WordPress Void Elementor WHMCS Elements For Elementor Page Builder Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software Void Elementor WHMCS Elements For Elementor Page Builder Type Plugin Vulnerable versions = 2.0 Fixed in 2.0.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32592 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8da009f2807a Credits...

WordPress App Builder Plugin <= 3.8.8 is vulnerable to Cross Site Scripting (XSS)

Software App Builder Type Plugin Vulnerable versions = 3.8.8 Fixed in 3.8.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32565 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 17e0f44ec6e6 Credits LVT-tholv2k Required privilege Contributor...

WordPress WPBITS Addons For Elementor Page Builder Plugin <= 1.3.4.2 is vulnerable to Cross Site Scripting (XSS)

Software WPBITS Addons For Elementor Page Builder Type Plugin Vulnerable versions = 1.3.4.2 Fixed in 1.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32593 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0a8cef7cc1ce Credits Khalid Yusuf...

WordPress WP Cost Estimation & Payment Forms Builder plugin <= 10.1.75 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin WP Cost Estimation & Payment Forms Builder versions = 10.1.75...

WordPress WP Cost Estimation & Payment Forms Builder plugin <= 10.1.76 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin WP Cost Estimation & Payment Forms Builder versions = 10.1.76...

CVE-2024-31940

Cross-Site Request Forgery CSRF vulnerability in RedNao Extra Product Options Builder for WooCommerce.This issue affects Extra Product Options Builder for WooCommerce: from n/a through 1.2.104...

CVE-2024-31933

Cross-Site Request Forgery CSRF vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a through 1.5.35...

Using the LockBit builder to generate targeted ransomware

The previous Kaspersky research focused on a detailed analysis of the LockBit 3.0 builder leaked in 2022. Since then, attackers have been able to generate customized versions of the threat according to their needs. This opens up numerous possibilities for malicious actors to make their attacks mo...

WordPress WPBakery Visual Composer plugin <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Post Author vulnerability discovered by Nikolas in WordPress Plugin WPBakery Page Builder versions = 7.5...

CVE-2024-31933 WordPress Page Builder: Live Composer plugin <= 1.5.35 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a through 1.5.35...

CVE-2024-31933 WordPress Page Builder: Live Composer plugin <= 1.5.35 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a through 1.5.35...

CVE-2024-31933

Technical details for CVE-2024-31933 are not publicly provided in the supplied documents; monitor for updates from vendors and advisories.

WordPress WPBakery Visual Composer plugin <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via attributes vulnerability discovered by Nikolas in WordPress Plugin WPBakery Page Builder versions = 7.5...

CVE-2024-31940

CVE-2024-31940 is a CSRF vulnerability in the RedNao Extra Product Options Builder for WooCommerce, affecting versions from unlisted through 1.2.104. The issue allows unauthorized cross-site requests without user interaction. According to the initial data, CVSS v3.1 base score is 4.3 (Medium) wit...

WordPress Responsive Contact Form Builder & Lead Generation Plugin plugin <= 1.8.9 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Duc Manh in WordPress Plugin Contact Form & Lead Form Elementor Builder versions = 1.8.9...