Button Generation Vulnerabilities

The Button Generator – easily Button Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged r...

CVSS:

4.3

Affected:

up to 3.1.1

Fixed in:

3.1.2

Disclosed:

Jan 24, 2025

CVE-2025-24713 on NVD →

The Button Generator – easily Button Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.9. This is due to missing or incorrect nonce validation on the button-generation function. This makes it possible for unauthenticated attackers to delete buttons via a...

CVSS:

4.3

Affected:

up to 2.3.9

Fixed in:

3.0

Disclosed:

Apr 11, 2024

CVE-2024-3471 on NVD →

The Button Generator – easily Button Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the function btg_count() function in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers to reset the button counter.

CVSS:

5.3

Affected:

up to 2.3.8

Fixed in:

2.3.9

Disclosed:

Nov 28, 2023

CVE-2023-49154 on NVD →

The Button Generator – easily Button Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.8. This is due to missing nonce validation on the btg_count() function. This makes it possible for unauthenticated attackers to reset the button counter via a forged reques...

CVSS:

4.3

Affected:

up to 2.3.8

Fixed in:

2.3.9

Disclosed:

Nov 28, 2023

CVE-2023-49155 on NVD →

The Button Generator – easily Button Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.5. This is due to missing or incorrect nonce validation in the tools-data-base.php file. This makes it possible for unauthenticated attackers to delete buttons via a forge...

CVSS:

5.3

Affected:

up to 2.3.5

Fixed in:

2.3.6

Disclosed:

May 25, 2023

CVE-2023-25443 on NVD →

Several plugins by Wow-Company are vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully tri...

CVSS:

6.1

Affected:

up to 2.3.4

Fixed in:

2.3.5

Disclosed:

May 22, 2023

CVE-2023-2362 on NVD →

The Button Generator – easily Button Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator-level access, and ab...

CVSS:

4.4

Affected:

up to 2.3.3

Fixed in:

2.3.4

Disclosed:

Mar 2, 2023

CVE-2023-27452 on NVD →

The Button Generator WordPress plugin before 2.3.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.

CVSS:

8.8

Affected:

up to 2.3.2

Fixed in:

2.3.3

Disclosed:

Dec 5, 2021

CVE-2021-25052 on NVD →