Stax Buddy Builder Vulnerabilities

[en] The BuddyPress Builder for Elementor – BuddyBuilder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.4 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with...

Affected:

up to 1.8.0

Fixed in:

1.8.0

Disclosed:

Nov 13, 2024

CVE-2024-10778 on NVD →

The BuddyPress Builder for Elementor – BuddyBuilder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.4 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Cont...

CVSS:

4.3

Affected:

up to 1.7.4

Fixed in:

1.8.0

Disclosed:

Nov 12, 2024

CVE-2024-10778 on NVD →

The BuddyBuilder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.3. This is due to missing or incorrect nonce validation when saving settings through the handle_settings_request() function. This makes it possible for unauthenticated attackers to change plugin setti...

CVSS:

4.3

Affected:

up to 1.7.4

Fixed in:

1.7.4

Disclosed:

Jul 10, 2023

The BuddyBuilder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.3. This is due to missing or incorrect nonce validation when saving settings through the handle_settings_request() function. This makes it possible for unauthenticated attackers to change plugin setti...

Affected:

up to 1.7.4

Fixed in:

1.7.4

Disclosed:

Jul 10, 2023

Update the WordPress BuddyPress Builder for Elementor – BuddyBuilder plugin to the latest available version (at least 1.7.4). WordFence discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress BuddyPress Builder for Elementor – BuddyBuilder Plugin. This could allow a malicious actor to...

Affected:

up to 1.7.4

Fixed in:

1.7.4

Disclosed:

Jul 10, 2023

The Appsero analytics tool used in several plugins is vulnerable to authorization bypass due to a missing capability check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with subscriber-level permissio...

CVSS:

4.3

Affected:

up to 1.7.1

Fixed in:

1.7.2

Disclosed:

Dec 16, 2022

The Appsero analytics tool used in several plugins is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to invoke this function inten...

CVSS:

4.3

Affected:

up to 1.7.1

Fixed in:

1.7.2

Disclosed:

Dec 14, 2022

CVE-2022-47150 on NVD →

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 1.7.2

Fixed in:

1.7.2

CVE-2022-47150 on NVD →