112 matches found
CVE-2024-54369
CVE-2024-54369 Zita Site Builder = 1.0.2 - Missing Authorization to Arbitrary Plugin Installation Description The Zita Site Builder plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on one of its functions in versions up to, and including...
CVE-2026-16966
The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published draft, pending, private, and trashed Site Builder parts that WordPress would otherwise not ser...
CVE-2026-16966
The Solace Extra WordPress plugin (versions before 1.7.0 ) is vulnerable to unauthenticated content disclosure. The flaw exists because one of its AJAX actions fails to perform proper authorization or post-status checks . This allows unauthenticated visitors to access and read content from non-pu...
CVE-2026-16966 Solace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content
The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published draft, pending, private, and trashed Site Builder parts that WordPress would otherwise not ser...
EUVD-2026-69867
The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published draft, pending, private, and trashed Site Builder parts that WordPress would otherwise not ser...
WordPress Solace Extra plugin < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure vulnerability
Unauthenticated Draft/Private Site Builder Content Disclosure vulnerability discovered by JunHee CHO in WordPress Plugin Solace Extra versions 1.7.0...
CVE-2026-16966: Exposure of Sensitive Information to an Unauthorized Actor
The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published draft, pending, private, and trashed Site Builder parts that WordPress would otherwise not ser...
CVE-2026-16948
The Solace Extra WordPress plugin versions prior to 1.6.1 are vulnerable to improper access control. The root cause is a failure to perform capability checks in several AJAX actions , coupled with the exposure of the protecting nonce on admin pages accessible to low-privileged users. This allows ...
PT-2026-41371
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the checkout endpoint accepts a user-controlled cart id and uses it to enter the payment flow without verifying cart ownership. A logged-in attacker can therefore reuse anothe...
EUVD-2026-11319
Emlog is an open source website building system. In 2.6.6 and earlier, the deleteasync action asynchronous delete lacks a call to LoginAuth::checkToken, enabling CSRF attacks...
CVE-2025-13727: Improper Neutralization of Input During Web Page Generation
The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 2.7.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...
CVE-2025-8605: Improper Neutralization of Input During Web Page Generation
The Gutenify – Visual Site Builder Blocks & Site Templates. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block attributes in all versions up to, and including, 1.5.9 due to insufficient input sanitization and output escaping on user supplied attributes. This...
WordPress Gutenify - Visual Site Builder Blocks & Site Templates plugin <= 1.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Count Up block vulnerability
WordPress Gutenify - Visual Site Builder Blocks & Site Templates plugin = 1.5.9 - Authenticated Contributor+ Stored Cross-Site Scripting via Count Up block vulnerability discovered by zer0gh0st in WordPress Plugin Gutenify versions = 1.5.9...
EUVD-2008-2746
Malware in sbrugna...
CVE-2025-7812: Cross-Site Request Forgery (CSRF)
The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.6. This is due to missing or incorrect nonce validation on the adminExport function. This makes it possible for unauthenticated...
AI Website Builder Lovable Abused for Phishing and Malware Scams
Scammers have been spotted abusing AI site builder Lovable to mimic trusted brands, steal credentials, drain crypto wallets,…...
confluence-static-site-builder (>=1.0.0-m04, <=1.0.0-m08) potentially affected by unknown CVE via commnader (0.0.1-security)
commnader NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on commnader and may be impacted: - confluence-static-site-builder =1.0.0-m04, =1.0.0-m08 Source cves: unknown CVE Source advisory: OSV:MAL-2025-17424...
ProcessMaker 代码问题漏洞
ProcessMaker is a Php-written site builder for business process management BPM and workflow management from ProcessMaker Inc. in the United States. A security vulnerability exists in ProcessMaker versions prior to 3.5.4 that stems from improper handling of plugin uploads, which could lead to remo...
CVE-2024-54369
Missing Authorization vulnerability in ThemeHunk Zita Site Builder ai-site-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Zita Site Builder: from n/a through = 1.0.2...
