WPBakery Page Builder Clipboard < 4.5.6 - Subscriber+ Stored Cross-Site Scripting (XSS)

An AJAX action registered by the plugin did not have capability checks nor sanitization, allowing low privilege users subscriber+ to call it and set XSS payloads, which will be triggered in all backend pages. Version 4.5.6 fixed the XSS issue with sanitization of the parameters, but did not fix t...

WordPress WPBakery plugin cross-site scripting vulnerability

WordPress is a blogging platform from the WordPress Foundation developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Wpbakery Page Builder is a plugin that is applied to generate an editor on a web page. A cross-site scripting...

CVE-2020-28650

The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls ksesremovefilters to disable the standard WordPress XSS protection mechanism for the Author and Contributor roles...

CVE-2020-28650

The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls ksesremovefilters to disable the standard WordPress XSS protection mechanism for the Author and Contributor roles...

Design/Logic Flaw

The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls ksesremovefilters to disable the standard WordPress XSS protection mechanism for the Author and Contributor roles...

CVE-2020-28650

Summary: CVE-2020-28650 affects the WordPress WPBakery Page Builder (pre-6.4.1). The vulnerability arises because the plugin calls kses_remove_filters to disable WordPress XSS protections for the Author and Contributor roles, enabling cross-site scripting. Impact (as described): XSS that can be t...

CVE-2020-28650

The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls ksesremovefilters to disable the standard WordPress XSS protection mechanism for the Author and Contributor roles...

WPBakery Page Builder < 6.4.1 - Authenticated Stored Cross-Site Scripting (XSS)

Wordfence discovered an Authenticated Stored Cross-Site Scripting XSS security vulnerability within the WPBakery Page Builder WordPress plugin. The vulnerability could allow a low privileged user, such as contributor, to inject malicious JavaScript into posts. "Exploit Post", "content" =...

WordPress WPBakery Page Builder premium plugin <= 6.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by Chloe Chamberland in WordPress WPBakery Page Builder premium plugin versions = 6.4. Solution Update the WordPress WPBakery Page Builder premium plugin to the latest available version at least 6.4.1...

VulnCheck KEV: CVE-2020-28650

The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls ksesremovefilters to disable the standard WordPress XSS protection mechanism for the Author and Contributor roles...

WPBakery Page Builder < 6.4.1 - Authenticated Stored Cross-Site Scripting (XSS)

Wordfence discovered an Authenticated Stored Cross-Site Scripting XSS security vulnerability within the WPBakery Page Builder WordPress plugin. The vulnerability could allow a low privileged user, such as contributor, to inject malicious JavaScript into posts. PoC "Exploit Post", "content" = "\n...