Filtered by vendor Webcodingplace Subscriptions
Total 5 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-11952 1 Webcodingplace 1 Classic Addons Wp Bakery Page Builder Plugin For Wordpress 2024-12-04 7.5 High
The Classic Addons – WPBakery Page Builder plugin for WordPress is vulnerable to Limited Local PHP File Inclusion in all versions up to, and including, 3.0 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, and permissions granted by an Administrator, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The vulnerability is limited to PHP files in a Windows environment.
CVE-2024-52448 1 Webcodingplace 1 Ultimate Classified Listings 2024-11-21 7.5 High
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebCodingPlace Ultimate Classified Listings allows PHP Local File Inclusion.This issue affects Ultimate Classified Listings: from n/a through 1.4.
CVE-2024-0201 1 Webcodingplace 1 Product Expiry For Woocommerce 2024-11-21 5.4 Medium
The Product Expiry for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_settings' function in versions up to, and including, 2.5. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update plugin settings.
CVE-2023-4239 1 Webcodingplace 1 Real Estate Manager 2024-11-21 8.8 High
The Real Estate Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7.1 due to insufficient restriction on the 'rem_save_profile_front' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.
CVE-2024-6529 1 Webcodingplace 1 Ultimate Classified Listings 2024-08-01 7.1 High
The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin