Mega Addons For WPBakery Page Builder <= 4.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
medium
The Mega Addons For WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 4.2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers wit...
- CVSS:
- 6.4
- Affected:
- up to 4.2.7
- Fixed in:
- 4.3.0
- Disclosed:
- Apr 17, 2023
CVE-2023-0268 on NVD →
Mega Addons For WPBakery Page Builder <= 4.3.0 - Authenticated (Subscriber+) Settings Update
high
The Mega Addons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the vc_saving_data function in versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugin's settings.
- CVSS:
- 7.1
- Affected:
- up to 4.3.0
- Fix:
- No patched version reported
- Disclosed:
- Dec 14, 2022
CVE-2022-4501 on NVD →
Mega Addons For WPBakery Page Builder <= 4.2.7 - Cross-Site Request Forgery to Settings Update
high
The Mega Addons For WPBakery Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.2.7. This is due to missing or incorrect nonce validation on the vc_saving_data function. This makes it possible for unauthenticated attackers to update plugin settings, via for...
- CVSS:
- 8.8
- Affected:
- up to 4.2.7
- Fix:
- No patched version reported
- Disclosed:
- Sep 2, 2022
CVE-2022-36798 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database