CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-48763 – WordPress JetFormBuilder plugin <= 3.1.4 - Content Injection vulnerability
https://notcve.org/view.php?id=CVE-2023-48763
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS vulnerability in Crocoblock JetFormBuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.1.4. Neutralización inadecuada de etiquetas HTML relacionadas con secuencias de comandos en una página web (la vulnerabilidad XSS básica en Crocoblock JetFormBuilder permite la inyección de código. Este problema afecta a JetFormBuilder: desde n/a hasta 3.1.4. The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to content injection in all versions up to, and including, 3.1.4. This makes it possible for unauthenticated attackers to inject content onto the site. • https://patchstack.com/database/vulnerability/jetformbuilder/wordpress-jetformbuilder-plugin-3-1-4-content-injection-vulnerability?_s_id=cve • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37866 – WordPress JetFormBuilder plugin <= 3.0.8 - Authenticated Privilege Escalation vulnerability
https://notcve.org/view.php?id=CVE-2023-37866
Improper Privilege Management vulnerability in Crocoblock JetFormBuilder allows Privilege Escalation.This issue affects JetFormBuilder: from n/a through 3.0.8. La vulnerabilidad de gestión de privilegios incorrecta en Crocoblock JetFormBuilder permite la escalada de privilegios. Este problema afecta a JetFormBuilder: desde n/a hasta 3.0.8. The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.0.8. This is due to insufficient restrictions on the form builder. • https://patchstack.com/database/vulnerability/jetformbuilder/wordpress-jetformbuilder-plugin-3-0-8-authenticated-privilege-escalation-vulnerability?_s_id=cve • CWE-266: Incorrect Privilege Assignment CWE-269: Improper Privilege Management •