RSS   Podatności dla 'Profile builder'   RSS

2022-04-04
 
CVE-2022-0884

CWE-79
 
 
The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high privilege user such as admin to perform Criss-Site Scripting attacks even when unfiltered_html is disallowed

 
2022-02-24
 
CVE-2022-0653

CWE-79
 
 
The Profile Builder �?? User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.

 
2021-08-16
 
CVE-2021-24527

CWE-287
 
 
The User Registration & User Profile ??�??�?? Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example.

 
2021-08-02
 
CVE-2021-24448

CWE-79
 
 
The User Registration & User Profile ??�??�?? Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue

 
2019-08-22
 
CVE-2015-9337

CWE-284
 
 
The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.

 
2019-08-21
 
CVE-2016-10911

CWE-79
 
 
The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.

 
 
CVE-2015-9328

CWE-79
 
 
The profile-builder plugin before 2.2.5 for WordPress has XSS.

 
 
CVE-2014-10380

CWE-79
 
 
The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.

 
2017-10-06
 
CVE-2014-8492

 
 
Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) site_name, (2) message, or (3) site_url parameter.

 

 >>> Vendor: Cozmoslabs 3 Produkty
Profile builder
User profile picture
Translatepress

Copyright 2024, cxsecurity.com

 

Back to Top