CVE-2020-11509

WP Lead Plus X plugin for WordPress is affected by an unauthenticated stored XSS vulnerability up to version 0.98 (also described as through 0.98 with PoC guidance toward 0.99+). The issue arises from the c37_wpl_import_template admin-post action, allowing attackers to upload page templates conta...

CVE-2020-11508

CVE-2020-11508 affects WordPress WP Lead Plus X plugin up to version 0.98. The vulnerability is an XSS flaw in the page builder caused by an unprotected AJAX action wp_ajax_core37_lp_save_page, allowing a logged-in user with minimal permissions to save or replace pages with arbitrary JavaScript. ...