CVE-2023-50856 WordPress Funnel Builder for WordPress by FunnelKit Plugin <= 2.14.3 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in FunnelKit Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits.This issue affects Funnel Builder for WordPress by FunnelKit –...

WordPress NEX-Forms – Ultimate Form Builder Plugin <= 8.5.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software NEX-Forms – Ultimate Form Builder Type Plugin Vulnerable versions = 8.5.2 Fixed in 8.5.5 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-52120 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 6c987b0249e3 Credits...

PT-2023-31688 · WordPress · Funnelkit Funnel Builder

Name of the Vulnerable Software and Affected Versions: FunnelKit Funnel Builder for WordPress versions through 2.14.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitati...

WordPress Plugin Funnel Builder for WordPress by FunnelKit SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress Plugin Funnel...

WordPress Brave Popup Builder Plugin <= 0.6.2 is vulnerable to Cross Site Scripting (XSS)

Software Brave Popup Builder Type Plugin Vulnerable versions = 0.6.2 Fixed in 0.6.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-51534 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 5a6ce464d1fb Credits Huynh Tien Si Required privilege...

WordPress WooCommerce PDF Invoice Builder Plugin <= 1.2.101 is vulnerable to Cross Site Request Forgery (CSRF)

Software WooCommerce PDF Invoice Builder Type Plugin Vulnerable versions = 1.2.101 Fixed in 1.2.102 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-51486 Patch priority Low CVSS severity Low 5.4 Developer Edgar Rojas PSID 0520b4dedf5c Credits...

WordPress Colibri Page Builder Plugin <= 1.0.239 is vulnerable to Cross Site Scripting (XSS)

Software Colibri Page Builder Type Plugin Vulnerable versions = 1.0.239 Fixed in 1.0.240 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6988 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID de0346984396 Credits Hung -mov Nguye...

WordPress Ultimate Addons for Beaver Builder Plugin <= 1.35.14 is vulnerable to Privilege Escalation

Software Ultimate Addons for Beaver Builder Type Plugin Vulnerable versions = 1.35.14 Fixed in 1.35.15 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-51398 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID...

Colibri Page Builder < 1.0.240 - Contributor+ Stored XSS

Description The plugin does not validate and escape some its extendbuilderrenderjs shortcode content before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress Ultimate Addons for Beaver Builder Plugin <= 1.35.13 is vulnerable to Arbitrary File Download

Software Ultimate Addons for Beaver Builder Type Plugin Vulnerable versions = 1.35.13 Fixed in 1.35.14 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2023-51401 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID 8fb95010e714 Credits Rafi...

Colibri Page Builder < 1.0.240 - Contributor+ Stored XSS

Description The plugin does not validate and escape some its extendbuilderrenderjs shortcode content before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC...

Colibri Page Builder < 1.0.248 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress Ultimate Addons for WPBakery Page Builder Plugin <= 3.19.17 is vulnerable to Cross Site Request Forgery (CSRF)

Software Ultimate Addons for WPBakery Page Builder Type Plugin Vulnerable versions = 3.19.17 Fixed in 3.19.18 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-51402 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c4cacdb211...

WordPress Metform Elementor Contact Form Builder Plugin <= 3.4.0 is vulnerable to Broken Access Control

Software Metform Elementor Contact Form Builder Type Plugin Vulnerable versions = 3.4.0 Fixed in 3.4.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-50903 Patch priority Low CVSS severity Low 5.3 Developer Wpmet PSID a863ac993a04 Credits Revan Arifio...

WordPress Beaver Builder Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)

Software Beaver Builder Type Plugin Vulnerable versions = 2.7.2 Fixed in 2.7.2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-50889 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c34e72dc456f Credits Rafie Muhammad Patchstack Required...

Photo Gallery by 10Web < 1.8.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget

Description The Photo Gallery by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in versions up to, and including, 1.8.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

CVE-2023-50833

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExtendThemes Colibri Page Builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through 1.0.239...

CVE-2023-50833

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExtendThemes Colibri Page Builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through 1.0.239...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExtendThemes Colibri Page Builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through 1.0.239...

CVE-2023-50833

CVE-2023-50833 affects Colibri Page Builder (WordPress) via Stored Cross-Site Scripting (XSS) in shortcode processing. Vulnerable versions: Colibri Page Builder up to 1.0.239 (tests indicate patch/mitigation in 1.0.240+). Root cause per connected Red Hat/Wordfence entries points to improper neutr...