CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-5289 – Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Google Maps Widget
https://notcve.org/view.php?id=CVE-2024-5289
The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget parameters in all versions up to, and including, 3.2.42 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El complemento Gutenberg Blocks with AI de Kadence WP – Page Builder Features para WordPress es vulnerable a Cross Site Scripting Almacenado a través de los parámetros del widget de Google Maps en todas las versiones hasta la 3.2.42 incluida debido a una sanitización de entrada y un escape de salida insuficientes. Esto hace posible que atacantes autenticados, con acceso de nivel de Colaborador y superior, inyecten scripts web arbitrarios en páginas que se ejecutarán cada vez que un usuario acceda a una página inyectada. • https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.2.38/includes/blocks/class-kadence-blocks-googlemaps-block.php#L226 https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.2.42/includes/blocks/class-kadence-blocks-googlemaps-block.php#L237 https://www.wordfence.com/threat-intel/vulnerabilities/id/f9c0ad1e-380e-4b67-b07e-70bf44e4e614?source=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2024-1330 – Kadence Blocks Pro < 2.3.8 - Contributor+ Arbitrary Option Access
https://notcve.org/view.php?id=CVE-2024-1330
The kadence-blocks-pro WordPress plugin before 2.3.8 does not prevent users with at least the contributor role using some of its shortcode's functionalities to leak arbitrary options from the database. El complemento de WordPress kadence-blocks-pro anterior a 2.3.8 no impide que los usuarios con al menos el rol de colaborador utilicen algunas de las funcionalidades de su código corto para filtrar opciones arbitrarias de la base de datos. The Kadence Blocks Pro plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.3.7 via the kb-dynamic shortcode. This makes it possible for unauthenticated attackers to extract potentially sensitive data from plugin options. • https://wpscan.com/vulnerability/1988815b-7a53-4657-9b1c-1f83c9f9ccfd • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47186 – WordPress Kadence WooCommerce Email Designer Plugin <= 1.5.11 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-47186
Cross-Site Request Forgery (CSRF) vulnerability in Kadence WP Kadence WooCommerce Email Designer plugin <= 1.5.11 versions. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en el complemento Kadence WP Kadence WooCommerce Email Designer en versiones <= 1.5.11. The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.11. This is due to missing or incorrect nonce validation on the ajax_reset() and ajax_send_email() functions. This makes it possible for unauthenticated attackers to send test emails and reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/kadence-woocommerce-email-designer/wordpress-kadence-woocommerce-email-designer-plugin-1-5-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3679 – Starter Templates by Kadence WP < 1.2.17 - Admin+ PHP Object Injection
https://notcve.org/view.php?id=CVE-2022-3679
The Starter Templates by Kadence WP WordPress plugin before 1.2.17 unserialises the content of an imported file, which could lead to PHP object injection issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog. El complemento Starter Templates by Kadence WP de WordPress anterior a 1.2.17 deserializa el contenido de un archivo importado, lo que podría provocar problemas de inyección de objetos PHP cuando un administrador importa (intencionalmente o no) un archivo malicioso y una cadena de gadgets adecuada está presente en el blog. The Starter Templates by Kadence WP plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2.16 via the 'import_customizer_options' function. This allows authenticated users with administratior-level capabilities to inject a PHP Object. No POP chain is present in the vulnerable plugin. • https://wpscan.com/vulnerability/ec4b9bf7-71d6-4528-9dd1-cc7779624760 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3335 – Kadence WooCommerce Email Designer < 1.5.7 - Admin+ PHP Objection Injection
https://notcve.org/view.php?id=CVE-2022-3335
The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog. El plugin Kadence WooCommerce Email Designer de WordPress versiones anteriores a 1.5.7, no serializa el contenido de un archivo importado, lo que podría conllevar a problemas de inyecciones de objetos PHP cuando un administrador importa (intencionadamente o no) un archivo malicioso y una cadena de gadgets apropiada está presente en el blog The Kadence WooCommerce Email Designer for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.5.6 via deserialization of untrusted input via the 'raw' parameter in the import_woomail function. This allows administrator-level attackers or higher to inject a PHP Object. No POP chain appears to be present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. • https://wpscan.com/vulnerability/39514705-c887-4a02-a77b-36e1dcca8f5d • CWE-502: Deserialization of Untrusted Data •