plugin

Astra Addon Vulnerabilities

2 known security issues reported for the Astra Addon WordPress plugin. Most recent disclosed Dec 5, 2023.

1 critical 1 high

Running Astra Addon on your site? Check whether your installed version is affected.

Scan your site free

Astra Pro <= 4.3.1 - Authenticated(Contributor+) Remote Code Execution via Metabox

high

The Astra Pro Addon plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.3.1 via the ast-advanced-hook-php-code meta field. This makes it possible for authenticated attackers, with contributor access and above, to execute code on the server.

CVSS:
8.8
Affected:
up to 4.3.1
Fixed in:
4.3.2
Disclosed:
Dec 5, 2023

CVE-2023-49830 on NVD →

Astra Pro Addon <= 3.5.1 - Unauthenticated SQL Injection

critical

The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unauthenticated and authenticated user) before using them in SQL statement, leading to an SQL Injection i...

CVSS:
9.8
Affected:
up to 3.5.2
Fixed in:
3.5.2
Disclosed:
Jul 8, 2021

CVE-2021-24507 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database