Page Generator Vulnerabilities

The Page Generator plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to 1.7.2 (exclusive) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admi...

CVSS:

6.6

Affected:

up to 1.7.2

Fixed in:

1.7.2

Disclosed:

Dec 28, 2023

CVE-2023-52131 on NVD →

The Page Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5. This is due to missing or incorrect nonce validation on the ajax function. This makes it possible for unauthenticated attackers to duplicate or deleted keywords granted they can trick a site admi...

CVSS:

8.8

Affected:

up to 1.6.5

Fixed in:

1.6.6

Disclosed:

Jun 27, 2022

The Page Generator plugin is vulnerable to Cross-Site Scripting in versions up to, and including, 1.6.4. This allows authenticated users with high privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS:

5.5

Affected:

up to 1.6.4

Fixed in:

1.6.6

Disclosed:

Jun 27, 2022

CVE-2022-2100 on NVD →