Sp Blog Designer Vulnerabilities

The SP Blog Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'design' attribute of the `wpsbd_post_carousel` shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contri...

CVSS:

6.4

Affected:

up to 1.0.0

Fix:

No patched version reported

Disclosed:

May 11, 2026

CVE-2026-4859 on NVD →

The The SP Blog Designer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attack...

CVSS:

6.5

Affected:

up to 1.0.0

Fix:

No patched version reported

Disclosed:

Mar 31, 2025

CVE-2025-31606 on NVD →

[en] Missing Authorization vulnerability in softpulseinfotech SP Blog Designer allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SP Blog Designer: from n/a through 1.0.0.

Affected:

up to 1.0.0

Fix:

No patched version reported

Disclosed:

Mar 31, 2025

CVE-2025-31606 on NVD →

[en] Path Traversal: '.../...//' vulnerability in Softpulse Infotech SP Blog Designer allows PHP Local File Inclusion.This issue affects SP Blog Designer: from n/a through 1.0.0.

Affected:

up to 1.0.0

Fix:

No patched version reported

Disclosed:

Nov 28, 2024

CVE-2024-52498 on NVD →

The SP Blog Designer plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.0.0. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those file...

CVSS:

8.8

Affected:

up to 1.0.0

Fix:

No patched version reported

Disclosed:

Nov 20, 2024

CVE-2024-52498 on NVD →