Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,399 results · page 39 of 48
Mar 27, 2023Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks: Does not have CSRF checkCVE-2023-0484 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks
- Fixed in
- 1.1.6
- What to do
- Update Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks to 1.1.6 or newer.
Mar 15, 2023Cross-Site Request Forgery (CSRF) vulnerability in Rextheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin <= 8.2.7 versions.CVE-2023-25708 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Rextheme WP VR – 360 Panorama and Virtual Tour Builder For WordPress plugin <= 8.2.7 versions.
- Fixed in
- 8.2.8
- What to do
- Update the plugin to 8.2.8 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 13, 2023Popup Builder by OptinMonster: Does not ensure that the campaign to be loaded via some shortcodes is actually a campaignCVE-2023-0772 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protected ones.
- Product
- Popup Builder by OptinMonster
- Fixed in
- 2.12.2
- What to do
- Update Popup Builder by OptinMonster to 2.12.2 or newer.
Mar 13, 2023Campaign URL Builder: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0538 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Campaign URL Builder WordPress plugin before 1.8.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Campaign URL Builder
- Fixed in
- 1.8.2
- What to do
- Update Campaign URL Builder to 1.8.2 or newer.
Mar 13, 202310Web Map Builder for Google Maps: Does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated usersCVE-2023-0037 · WordPress plugins & themes · reported by WPScanCritical 9.8
The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- 10Web Map Builder for Google Maps
- Fixed in
- 1.0.73
- What to do
- Update 10Web Map Builder for Google Maps to 1.0.73 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Mar 13, 2023Cross-Site Request Forgery (CSRF) vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder plugin <= 2.1.1 versions.CVE-2022-47166 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder plugin <= 2.1.1 versions.
- Fixed in
- 2.2
- What to do
- Update the plugin to 2.2 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 8, 2023Code Injection in GitHub repository builderio/qwik prior to 0.21.0.CVE-2023-1283 · Other software · builderio · reported by security@huntr.devCritical 10
Code Injection in GitHub repository builderio/qwik prior to 0.21.0.
- Product
- builderio/qwik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023Resume Builder: Does not sanitize and escape some parameters related to ResumeCVE-2023-0078 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Resume Builder WordPress plugin through 3.1.1 does not sanitize and escape some parameters related to Resume, which could allow users with a role as low as subscriber to perform Stored XSS attacks against higher privilege users
- Product
- Resume Builder
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update Resume Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 2, 2023Metform Elementor Contact Form Builder: Stored Cross-Site ScriptingCVE-2023-0084 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, which is the submissions page.
- Product
- Metform Elementor Contact Form Builder
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Mar 2, 2023Metform Elementor Contact Form Builder: ReCaptcha BypassCVE-2023-0085 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submission. This makes it possible for unauthenticated attackers to bypass Captcha restrictions and for attackers to utilize bots to submit forms.
- Product
- Metform Elementor Contact Form Builder
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin <= 5.5.6 versions.CVE-2023-24419 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin <= 5.5.6 versions.
- Affected
- up to 5.5.6
- What to do
- Affects up to 5.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Forms by CaptainForm – Form Builder for WordPress plugin <= 2.5.3 versions.CVE-2022-43459 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Forms by CaptainForm – Form Builder for WordPress plugin <= 2.5.3 versions.
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 22, 2023 The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file.CVE-2023-0104 · Other software · Weintek · reported by ics-cert@hq.dhs.govCritical 9.3
The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may allow an attacker to gain control of the user’s computer or gain access to sensitive data.
- Product
- EasyBuilder Pro cMT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023Microweber is a drag and drop website builder and content management system.CVE-2021-32856 · Other software · microweber · reported by GitHubMedium 6.1
Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. A fix was attempted in versions 1.2.9 and 1.2.12, but it is incomplete.
- Product
- microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritylab.github.com
Feb 21, 2023Page Builder: Live Composer: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4669 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page Builder: Live Composer WordPress plugin before 1.5.23 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Page Builder: Live Composer
- Fixed in
- 1.5.23
- What to do
- Update Page Builder: Live Composer to 1.5.23 or newer.
Feb 19, 2023A vulnerability was found in java-xmlbuilder up to 1.1.CVE-2014-125087 · Other software · Java-xmlbuilder Project · reported by VulDBMedium 5.5
A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is e6fddca201790abab4f2c274341c0bb8835c3e73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221480.
- Product
- Java-xmlbuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 20233D Builder Remote Code Execution VulnerabilityCVE-2023-23390 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Builder Remote Code Execution Vulnerability
- Product
- 3D Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 14, 20233D Builder Remote Code Execution VulnerabilityCVE-2023-23377 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Builder Remote Code Execution Vulnerability
- Product
- 3D Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 14, 2023In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API ModuCVE-2023-22943 · Other software · Splunk · reported by prodsec@splunk.comMedium 4.8
In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API Modular Input incorrectly revert to using HTTP to connect after a failure to connect over HTTPS occurs.
- Product
- Splunk Add-on Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.splunk.comadvisory.splunk.com
Feb 14, 2023Cross-Site Request Forgery (CSRF) vulnerability in Photon WP Material Design Icons for Page Builders plugin <= 1.4.2 versions.CVE-2023-24382 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Photon WP Material Design Icons for Page Builders plugin <= 1.4.2 versions.
- Fixed in
- 1.4.3
- What to do
- Update the plugin to 1.4.3 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 13, 2023Profile Builder – User Profile & User Registration Forms: Sensitive information disclosureCVE-2023-0814 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortcode in versions up to, and including 3.9.0. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account. This does require the Usermeta shortcode be enabled to be exploited.
- Product
- Profile Builder – User Profile & User Registration Forms
- Affected
- up to 3.9.0
- What to do
- Affects up to 3.9.0. Update Profile Builder – User Profile & User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlana.codesplugins.trac.wordpress.org
Feb 13, 2023Extensive VC Addons for WPBakery page builder: Does not validate a parameter passed to the php extract functionCVE-2023-0159 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system. This may be escalated to RCE using PHP filter chains.
- Product
- Extensive VC Addons for WPBakery page builder
- Fixed in
- 1.9.1
- What to do
- Update Extensive VC Addons for WPBakery page builder to 1.9.1 or newer.
Feb 10, 2023A vulnerability was found in webbuilders-group silverstripe-kapost-bridge 0.3.3.CVE-2015-10077 · Other software · webbuilders-group · reported by VulDBMedium 6.3
A vulnerability was found in webbuilders-group silverstripe-kapost-bridge 0.3.3. It has been declared as critical. Affected by this vulnerability is the function index/getPreview of the file code/control/KapostService.php. The manipulation leads to sql injection. The attack can be launched remotely. Upgrading to version 0.4.0 is able to address this issue. The patch is named 2e14b0fd0ea35034f90890f364b130fb4645ff35. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220471.
- Product
- silverstripe-kapost-bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2023Drag & Drop Sales Funnel Builder for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0173 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Drag & Drop Sales Funnel Builder for WordPress plugin before 2.6.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Drag & Drop Sales Funnel Builder for
- Fixed in
- 2.6.9
- What to do
- Update Drag & Drop Sales Funnel Builder for to 2.6.9 or newer.
Jan 30, 2023A cross-site scripting (XSS) vulnerability in ApolloTheme AP PageBuilder component through 2.4.4 allows attackers to execute arbitrary web scripts or HTML via aCVE-2022-44897 · Other software · Apollotheme · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in ApolloTheme AP PageBuilder component through 2.4.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the show_number parameter.
- Product
- AP Pagebuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to enumerate credentiaCVE-2023-24436 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
- Product
- Jenkins GitHub Pull Request Builder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to connect to an attacCVE-2023-24435 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
- Product
- Jenkins GitHub Pull Request Builder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-spCVE-2023-24434 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
- Product
- Jenkins GitHub Pull Request Builder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 202310WebMapBuilder: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4758 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 10WebMapBuilder WordPress plugin before 1.0.72 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- 10WebMapBuilder
- Fixed in
- 1.0.72
- What to do
- Update 10WebMapBuilder to 1.0.72 or newer.
Jan 23, 2023Landing Page Builder: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4718 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Landing Page Builder WordPress plugin before 1.4.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Landing Page Builder
- Fixed in
- 1.4.9.9
- What to do
- Update Landing Page Builder to 1.4.9.9 or newer.
Jan 19, 2023Cross-site Scripting (XSS) - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5.CVE-2023-0410 · Other software · builderio · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5.
- Product
- builderio/qwik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023IMPatienT before 1.5.2 allows stored XSS via onmouseover in certain text fields within a PATCH /modify_onto request to the ontology builder.CVE-2023-23637 · Other software · Unistra · reported by MITREHigh 7.6
IMPatienT before 1.5.2 allows stored XSS via onmouseover in certain text fields within a PATCH /modify_onto request to the ontology builder. This may allow attackers to steal Protected Health Information.
- Product
- Impatient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2023A vulnerability was found in Overdrive Eletrônica course-builder up to 1.7.x and classified as problematic.CVE-2015-10049 · Other software · Overdrive Eletrônica · reported by VulDBLow 3.5
A vulnerability was found in Overdrive Eletrônica course-builder up to 1.7.x and classified as problematic. Affected by this issue is some unknown functionality of the file coursebuilder/modules/oeditor/oeditor.html. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.8.0 is able to address this issue. The name of the patch is e39645fd714adb7e549908780235911ae282b21b. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218372.
- Product
- course-builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2023Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver.CVE-2022-38467 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver.
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 12, 2023A vulnerability has been found in manikandan170890 php-form-builder-class and classified as problematic.CVE-2012-10005 · Other software · manikandan170890 · reported by VulDBLow 3.5
A vulnerability has been found in manikandan170890 php-form-builder-class and classified as problematic. Affected by this vulnerability is an unknown functionality of the file PFBC/Element/Textarea.php of the component Textarea Handler. The manipulation of the argument value leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named 74897993818d826595fd5857038e6703456a594a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218155.
- Product
- php-form-builder-class
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.google.comgithub.com
Jan 10, 20233D Builder Remote Code Execution VulnerabilityCVE-2023-21793 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Builder Remote Code Execution Vulnerability
- Product
- 3D Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 20233D Builder Remote Code Execution VulnerabilityCVE-2023-21792 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Builder Remote Code Execution Vulnerability
- Product
- 3D Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 20233D Builder Remote Code Execution VulnerabilityCVE-2023-21791 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Builder Remote Code Execution Vulnerability
- Product
- 3D Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 20233D Builder Remote Code Execution VulnerabilityCVE-2023-21790 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Builder Remote Code Execution Vulnerability
- Product
- 3D Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 20233D Builder Remote Code Execution VulnerabilityCVE-2023-21789 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Builder Remote Code Execution Vulnerability
- Product
- 3D Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 20233D Builder Remote Code Execution VulnerabilityCVE-2023-21788 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Builder Remote Code Execution Vulnerability
- Product
- 3D Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 20233D Builder Remote Code Execution VulnerabilityCVE-2023-21787 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Builder Remote Code Execution Vulnerability
- Product
- 3D Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 20233D Builder Remote Code Execution VulnerabilityCVE-2023-21786 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Builder Remote Code Execution Vulnerability
- Product
- 3D Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 20233D Builder Remote Code Execution VulnerabilityCVE-2023-21785 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Builder Remote Code Execution Vulnerability
- Product
- 3D Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 20233D Builder Remote Code Execution VulnerabilityCVE-2023-21784 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Builder Remote Code Execution Vulnerability
- Product
- 3D Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 20233D Builder Remote Code Execution VulnerabilityCVE-2023-21783 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Builder Remote Code Execution Vulnerability
- Product
- 3D Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 20233D Builder Remote Code Execution VulnerabilityCVE-2023-21782 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Builder Remote Code Execution Vulnerability
- Product
- 3D Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 20233D Builder Remote Code Execution VulnerabilityCVE-2023-21781 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Builder Remote Code Execution Vulnerability
- Product
- 3D Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 20233D Builder Remote Code Execution VulnerabilityCVE-2023-21780 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Builder Remote Code Execution Vulnerability
- Product
- 3D Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 9, 2023ImageLinks Interactive Image Builder for: Does not sanitise and escape some of its settingsCVE-2022-4393 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ImageLinks Interactive Image Builder for WordPress plugin through 1.5.3 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- ImageLinks Interactive Image Builder for
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update ImageLinks Interactive Image Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.