Popup Builder < 4.2.7 - Contributor Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's sgpopup shortcode due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject...

WordPress Plugin Colibri Page Builder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-23461 · Builderall · Builderall Builder For Wordpress

Name of the Vulnerable Software and Affected Versions: Builderall Builder for WordPress versions n/a through 2.0.1 Description: A Server-Side Request Forgery SSRF issue affects Builderall Team Builderall Builder for WordPress. This issue allows for unauthorized requests to be made from the server...

Elementor Website Builder SQL Injection

EXPLOIT Elementor Website Builder Replace URL page. On the Replace URL page, enter any random string as the "New URL" and the following malicious payload as the "Old URL": code : http://localhost:8080/?test',metakey='key4'where+metaid=SLEEP2; Press "Replace URL" on the Replace URL page. Burp Suit...

WordPress Ultimate Addons for Beaver Builder – Lite plugin <= 1.5.7 - Multiple Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Multiple Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Francesco Carlucci in WordPress Plugin Ultimate Addons for Beaver Builder – Lite versions = 1.5.7...

PDF Builder for WPForms < 1.2.89 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The PDF Builder for WPForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' variable in versions up to, and including, 1.2.88 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WC Builder < 1.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The WC Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject...

PT-2024-23734 · Jjwt · Jjwt

Name of the Vulnerable Software and Affected Versions: JJWT aka Java JWT through 0.12.5 Description: The issue concerns JJWT ignoring certain characters, potentially leading a user to falsely conclude they have a strong key. The impacted code includes the setSigningKey method within the...

WordPress Ultimate Addons for Beaver Builder – Lite Plugin <= 1.5.7 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Addons for Beaver Builder – Lite Type Plugin Vulnerable versions = 1.5.7 Fixed in 1.5.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2141 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e2332e71a3c3 Credit...

CVE-2024-31116

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in 10Web 10Web Map Builder for Google Maps.This issue affects 10Web Map Builder for Google Maps: from n/a through 1.0.74...

CVE-2024-31116

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in 10Web 10Web Map Builder for Google Maps.This issue affects 10Web Map Builder for Google Maps: from n/a through 1.0.74...

CVE-2024-30489

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in loopus WP Cost Estimation & Payment Forms Builder.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through 10.1.75...

CVE-2024-30535

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WhiteStudio Easy Form Builder.This issue affects Easy Form Builder: from n/a through 3.7.4...

CVE-2024-30489 WordPress WP Cost Estimation & Payment Forms Builder plugin <= 10.1.75 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in loopus WP Cost Estimation & Payment Forms Builder.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through 10.1.75...

CVE-2024-30489

CVE-2024-30489 affects WP Cost Estimation & Payment Forms Builder for WordPress. Root cause: improper neutralization of SQL elements in a query, enabling SQL injection. Affected versions are up to 10.1.75 (n/a–10.1.75). CVSS v3.1 base score 8.5 (HIGH) with Attack Vector: Network, Attack Complexit...

CVE-2024-30535

CVE-2024-30535 is an SQL Injection vulnerability in WordPress plugin Easy Form Builder (White Studio Easy Form Builder). Affected versions: Easy Form Builder from n/a through 3.7.4. Root cause: Improper Neutralization of Special Elements used in SQL Command. Impact as per CVSS: high (score 8.5) w...

CVE-2024-30535 WordPress Easy Form Builder plugin <= 3.7.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WhiteStudio Easy Form Builder.This issue affects Easy Form Builder: from n/a through 3.7.4...

CVE-2024-30535 WordPress Easy Form Builder plugin <= 3.7.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WhiteStudio Easy Form Builder.This issue affects Easy Form Builder: from n/a through 3.7.4...

CVE-2024-31116

CVE-2024-31116 affects 10Web Map Builder for Google Maps (WordPress plugin: wd-google-maps) up to version 1.0.74. The issue is an SQL Injection due to improper neutralization of inputs in the plugin’s map builder, exploitable by an authenticated attacker with Administrator privileges. The vulnera...

CVE-2024-31116 WordPress 10Web Map Builder for Google Maps plugin <= 1.0.74 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in 10Web 10Web Map Builder for Google Maps.This issue affects 10Web Map Builder for Google Maps: from n/a through 1.0.74...