WordPress Plugin Elementor Website Builder Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Landing Page Builder < 1.5.1.6 - Open Redirect

Description The Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.5.1.5. This is due to insufficient validation on the redirect url supplied via user input or request...

10Web Map Builder for Google Maps < 1.0.74 - Cross-Site Request Forgery to Notice Dismissal

Description The 10Web Map Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.73. This is due to missing or incorrect nonce validation on the gmwdbpinstallnoticestatus function. This makes it possible for unauthenticated attackers to...

Metform Elementor Contact Form Builder < 3.3.2 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode

Description The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mffirstname' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information...

CVE-2023-47835

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder plugin = 1.2.32 versions...

ChatBot 4.8.6 - 4.9.6 - Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder

Description The ChatBot for WordPress is vulnerable to Stored Cross-Site Scripting via the FAQ Builder in versions 4.8.6 through 4.9.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to...

WordPress Landing Page Builder Plugin <= 1.5.1.5 is vulnerable to Open Redirection

Software Landing Page Builder Type Plugin Vulnerable versions = 1.5.1.5 Fixed in 1.5.1.6 OWASP Top 10 A1: Injection Classification Open Redirection CVE CVE-2023-48325 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID cde57cbd94f8 Credits minhtuanact Required privilege...

Thrive Theme Builder < 3.24.2 - Cross-Site Request Forgery

Description The theme does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

Thrive Theme Builder < 3.24.0 - Subscriber+ Privilege Escalation

Description The them is vulnerable to privilege escalation, allowing any authenticated users, such as subscribers to elevate their privileges...

Thrive Theme Builder < 3.24.0 - Missing Authorization

Description The theme is vulnerable to unauthorized use of functionality due to missing capability check in one of its functions. This makes it possible for authenticated attackers, with subscriber-level access and above, to invoke this function intended for higher-privileged users. The exact...

CVE-2023-47835 WordPress ARI Stream Quiz Plugin <= 1.2.32 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder plugin = 1.2.32 versions...

CVE-2023-47835

CVE-2023-47835 — ARI Stream Quiz (WordPress)

CVE-2023-47781

Cross-Site Request Forgery CSRF vulnerability in Thrive Themes Thrive Theme Builder 3.24.2 versions...

CVE-2023-47781

Cross-Site Request Forgery CSRF vulnerability in Thrive Themes Thrive Theme Builder 3.24.2 versions...

CVE-2023-47781

Thrive Theme Builder (WordPress) before version 3.24.2 is vulnerable to Cross-Site Request Forgery (CSRF). Root cause: missing CSRF checks in the affected theme builder, enabling unauthorized actions by forged requests from logged-in users. Impact per CVSS: high (8.8/10), affecting confidentialit...

CVE-2023-47781 WordPress Thrive Theme Builder Theme < 3.24.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Thrive Themes Thrive Theme Builder 3.24.2 versions...

CVE-2023-5048

CVE-2023-5048 affects the WDContactFormBuilder WordPress plugin (versions

PT-2023-30604 · Unknown · Thrive Theme Builder

Name of the Vulnerable Software and Affected Versions: Thrive Theme Builder versions prior to 3.24.2 Description: A Cross-Site Request Forgery CSRF issue exists, which is a type of attack that tricks a user into performing unintended actions on a web application. Recommendations: For versions pri...

PT-2023-31577 · WordPress · Contact Form Builder

Name of the Vulnerable Software and Affected Versions: WDContactFormBuilder plugin for WordPress versions up to, and including, 1.0.72 Description: The issue arises from insufficient input sanitization and output escaping on the id user-supplied attribute in the 'Contact Form Builder' shortcode...

This Week in Spring - Spring Boot 3.2 edition - November 21st, 2023

Hi, Spring fans! Welcome to another epic installment of This Week in Spring! As amazing as the week's already been, it's all leading up to this Thursday - Thanksgiving day! - when we release Spring Boot 3.2! and yes, I am very grateful. This release is stuffed to the gills with a ton of new...