Blog Designer For Post And Widget Vulnerabilities

All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and injec...

CVSS:

9.8

Affected:

2.7.7 – 2.7.7

Fixed in:

2.7.7.1

Disclosed:

Apr 9, 2026

CVE-2026-6443 on NVD →

Multiple WPOnlineSupport plugins for WordPress are vulnerable to unauthorized modification of data due to a missing capability check on the wpos_anylc_admin_init_process() function hooked via admin_init in various versions. This makes it possible for unauthenticated attackers to dismiss a license notice.

CVSS:

5.3

Affected:

up to 2.5.1

Fixed in:

2.5.2

Disclosed:

Aug 16, 2023

CVE-2023-40200 on NVD →

[en] The Blog Designer WordPress plugin before 2.4.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.

Affected:

up to 2.4.1

Fixed in:

2.4.1

Disclosed:

Jan 30, 2023

CVE-2022-4793 on NVD →

The Blog Designer - Post and Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 2.3 due to insufficient input sanitization and output escaping on user supplied attributes like 'design'. This makes it possible for authenticated attackers...

CVSS:

6.4

Affected:

up to 2.3

Fixed in:

2.4

Disclosed:

Jan 4, 2023

CVE-2022-4793 on NVD →

The Blog Designer - Post and Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 2.3 due to insufficient input sanitization and output escaping on user supplied attributes like 'design'. This makes it possible for authenticated attackers...

Affected:

up to 2.4

Fixed in:

2.4

Disclosed:

Jan 4, 2023

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 2.5.2

Fixed in:

2.5.2

CVE-2023-40200 on NVD →