Aweber Web Form Widget Vulnerabilities

The AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 7.3.20 due to insufficient input sanitization and output escaping. This makes it possi...

CVSS:

4.4

Affected:

up to 7.3.20

Fixed in:

7.3.21

Disclosed:

Mar 6, 2025

CVE-2024-13313 on NVD →

The AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth plugin for WordPress is vulnerable to SQL Injection via the 'post_id' parameter in all versions up to, and including, 7.3.14 due to insufficient escaping on the user supplied parameter and lack of sufficient p...

CVSS:

7.2

Affected:

up to 7.3.14

Fixed in:

7.3.15

Disclosed:

Feb 29, 2024

CVE-2024-1793 on NVD →

The AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions hooked by AJAX actions in all versions up to, and including, 7.3.9. Th...

CVSS:

6.3

Affected:

up to 7.3.9

Fixed in:

7.3.10

Disclosed:

Nov 13, 2023

CVE-2023-47757 on NVD →