Sql injection

The Pricing Table Builder WordPress plugin through 1.1.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admins...

CVE-2023-0900 AP Pricing Tables Lite <= 1.1.6 - Admin+ SQLi

The Pricing Table Builder WordPress plugin through 1.1.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admins...

CVE-2023-0900

The CVE-2023-0900 issue affects the Pricing Table Builder WordPress plugin (versions 1.1.6 and earlier). A parameter used in a SQL statement is not properly sanitized/escaped, enabling SQL injection. The vulnerability can be exploited by high-privilege administrators (admin) to access database co...

WordPress Page Builder with Image Map by AZEXO Plugin <= 1.27.133 is vulnerable to Cross Site Scripting (XSS)

Software Page Builder with Image Map by AZEXO Type Plugin Vulnerable versions = 1.27.133 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3055 Patch priority Low CVSS severity Low 6.1 Developer Claim ownership PSID f4849bd1e963 Credits...

WordPress Plugin Pricing Table Builder SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Pricing Table Builder 1.1....

WordPress Contact Form Builder by vcita Plugin <= 4.10.2 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form Builder by vcita Type Plugin Vulnerable versions = 4.10.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2300 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 3b4b71b799e4 Credits Jonas...

WordPress Page Builder with Image Map by AZEXO Plugin <= 1.27.133 is vulnerable to Broken Access Control

Software Page Builder with Image Map by AZEXO Type Plugin Vulnerable versions = 1.27.133 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-3053 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID bcb4f38dcc4d Credits...

WordPress Contact Form Builder by vcita Plugin <= 4.10.2 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form Builder by vcita Type Plugin Vulnerable versions = 4.10.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2301 Patch priority Low CVSS severity Low 6.1 Developer Claim ownership PSID 8de38a056831 Credits Jonas...

WordPress Page Builder with Image Map by AZEXO Plugin <= 1.27.133 is vulnerable to Cross Site Request Forgery (CSRF)

Software Page Builder with Image Map by AZEXO Type Plugin Vulnerable versions = 1.27.133 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-3052 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID 3ed12ddc506d Credit...

PT-2023-16602 · WordPress · Pricing Table Builder

Name of the Vulnerable Software and Affected Versions: Pricing Table Builder WordPress plugin versions 1.1.6 and earlier Description: The issue is related to a SQL injection problem. It occurs because a parameter is not properly sanitised and escaped before being used in a SQL statement. This can...

CVE-2023-2301

The Contact Form Builder by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.9.1. This is due to missing nonce validation on the lsparsevcitacallback function. This makes it possible for unauthenticated attackers to modify the plugin's...

CVE-2023-2301

CVE-2023-2301 affects the WordPress plugin Contact Form Builder by vcita (versions up to 4.9.1). The issue is a Cross-Site Request Forgery caused by missing nonce validation on the ls_parse_vcita_callback function, allowing unauthenticated attackers to modify plugin settings and inject malicious ...

CVE-2023-2300 Contact Form Builder by vcita <= 4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Contact Form Builder by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 4.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the editposts...

CVE-2023-2300

CVE-2023-2300 refers to a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Contact Form Builder by vcita (≤ 4.9.1). The issue arises from insufficient input sanitization and output escaping of the email parameter, allowing an authenticated attacker with edit_posts capabilit...

CVE-2023-2300 Contact Form Builder by vcita <= 4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Contact Form Builder by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 4.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the editposts...

CVE-2023-3053

The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'azhaddpost' function in versions up to, and including, 1.27.133. This makes it possible for authenticated attackers to create a post with any post type and...

CVE-2023-3052

The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing or incorrect nonce validation on the 'azhaddpost', 'azhduplicatepost', 'azhupdatepost' and 'azhremovepost' functions. This makes it possibl...

CVE-2023-3051

The Page Builder by AZEXO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'azhpost' shortcode in versions up to, and including, 1.27.133 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web...

CVE-2023-3053

The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'azhaddpost' function in versions up to, and including, 1.27.133. This makes it possible for authenticated attackers to create a post with any post type and...

CVE-2023-3055

The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing or incorrect nonce validation on the 'azhsave' function. This makes it possible for unauthenticated attackers to update the post content an...