Apptivo Business Site Vulnerabilities

The Apptivo Business Site CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 5.3. This makes it possible for unauthenticated attackers to delete arbitrary content.

CVSS:

5.3

Affected:

up to 5.3

Fixed in:

5.4

Disclosed:

Apr 2, 2025

CVE-2025-31909 on NVD →

The Apptivo Business Site CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3. This is due to missing or incorrect nonce validation on the 'awp_ip_deny' page. This makes it possible for unauthenticated attackers to block IP addresses via a forged request grante...

CVSS:

4.3

Affected:

up to 5.3

Fix:

No patched version reported

Disclosed:

Feb 18, 2025

CVE-2024-13405 on NVD →

The Apptivo Business Site CRM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 3.0.12 due to insufficient input sanitization and output escaping. This makes it possible for administrator-level attackers to inject arbitrary web scripts in pages...

CVSS:

5.5

Affected:

up to 3.0.12

Fixed in:

3.0.14

Disclosed:

Nov 30, 2022

CVE-2022-44582 on NVD →