Buttonizer vulnerabilities
4 vulnerabilities
Known vulnerabilities in Buttonizer products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.
Products
4- Button Contact VR1 vulnerabilities
- Buttonizer1 vulnerabilities
- Buttonizer – Floating Menus, Sticky Buttons, & Popup Builder1 vulnerabilities
- Call \/ Chat \/ Contact Button1 vulnerabilities
CVE-2021-24992buttonizerbuttonizer+2
EPSS score0.62%
The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before outputting them in attributes and page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.CVE-2022-49745starpluginseasy_age_verify+1239EPSS score0.44%
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.CVE-2024-2220buttonizercall_\/_chat_\/_contact_button+2EPSS score0.33%
The Button contact VR WordPress plugin through 4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)CVE-2024-50414buttonizerbutton contact vr+1EPSS score0.31%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Buttonizer Button contact VR button-contact-vr allows Stored XSS.This issue affects Button contact VR: from n/a through <= 4.7.9.1.