PowerPack Lite for Beaver Builder <= 1.3.0.5 - Reflected Cross-Site Scripting via Navigate Parameter
medium
The PowerPack Lite for Beaver Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the navigate parameter in all versions up to, and including, 1.3.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scr...
- CVSS:
- 6.1
- Affected:
- up to 1.3.0.5
- Fixed in:
- 1.3.1
- Disclosed:
- Dec 16, 2024
CVE-2024-12239 on NVD →
PowerPack Lite for Beaver Builder <= 1.3.0.3 - Authenticated (Editor+) Local File Inclusion
high
The PowerPack Lite for Beaver Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.0.3. This makes it possible for authenticated attackers, with Editor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP...
- CVSS:
- 7.2
- Affected:
- up to 1.3.0.3
- Fixed in:
- 1.3.0.4
- Disclosed:
- Jun 28, 2024
CVE-2024-37410 on NVD →
PowerPack Lite for Beaver Builder <= 1.3.0.4 - Authenticated (Editor+) Stored Cross-Site Scripting
medium
The PowerPack Lite for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access, to inject arbitrary web scripts...
- CVSS:
- 4.4
- Affected:
- up to 1.3.0.4
- Fixed in:
- 1.3.0.5
- Disclosed:
- Jun 28, 2024
CVE-2024-37409 on NVD →
PowerPack Lite for Beaver Builder <= 1.3.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via element link
medium
The PowerPack Lite for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link in multiple elements in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...
- CVSS:
- 6.4
- Affected:
- up to 1.3.0
- Fixed in:
- 1.3.0.1
- Disclosed:
- Mar 18, 2024
CVE-2024-2289 on NVD →
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get
medium
The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute...
- CVSS:
- 6.1
- Affected:
- up to 1.2.9
- Fixed in:
- 1.2.9.1
- Disclosed:
- Jul 18, 2023
CVE-2023-33999 on NVD →
PowerPack Lite for Beaver Builder <= 1.2.9.2 Reflected Cross-Site Scripting
medium
The PowerPack Lite for Beaver Builder WordPress plugin before 1.2.9.3 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- CVSS:
- 6.1
- Affected:
- up to 1.2.9.2
- Fixed in:
- 1.2.9.3
- Disclosed:
- Jan 12, 2022
CVE-2022-0176 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database