Filtered by vendor Seedprod Subscriptions
Total 7 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-6887 2 Rafflepress, Seedprod 2 Giveaways And Contests By Rafflepress, Rafflepress 2024-09-26 4.8 Medium
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.16 does not sanitise and escape some of its Giveaways settings, which could allow high privilege users such as editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2024-37556 1 Seedprod 1 Wordpress Notification Bar 2024-09-05 5.9 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SeedProd WordPress Notification Bar allows Stored XSS.This issue affects WordPress Notification Bar: from n/a through 1.3.10.
CVE-2020-15038 1 Seedprod 1 Coming Soon Page\, Under Construction \& Maintenance Mode 2024-08-04 5.4 Medium
The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS.
CVE-2023-5049 1 Seedprod 1 Rafflepress 2024-08-02 6.4 Medium
The Giveaways and Contests by RafflePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rafflepress' and 'rafflepress_gutenberg' shortcode in versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping on 'giframe' user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2023-4975 1 Seedprod 1 Website Builder By Seedprod 2024-08-02 4.3 Medium
The Website Builder by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.13.1. This is due to missing or incorrect nonce validation on functionality in the builder.php file. This makes it possible for unauthenticated attackers to change the stripe connect token via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2024-4745 1 Seedprod 1 Rafflepress 2024-08-01 4.3 Medium
Missing Authorization vulnerability in RafflePress Giveaways and Contests by RafflePress.This issue affects Giveaways and Contests by RafflePress: from n/a through 1.12.4.
CVE-2024-1072 1 Seedprod 1 Website Builder By Seedprod 2024-08-01 8.2 High
The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the seedprod_lite_new_lpage function in all versions up to, and including, 6.15.21. This makes it possible for unauthenticated attackers to change the contents of coming-soon, maintenance pages, login and 404 pages set up with the plugin. Version 6.15.22 addresses this issue but introduces a bug affecting admin pages. We suggest upgrading to 6.15.23.