Infornweb vulnerabilities
11 vulnerabilities
Known vulnerabilities in Infornweb products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 9 products.
Products
9- Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News3 vulnerabilities
- Logo Showcase With Slick Slider3 vulnerabilities
- News \& Blog Designer Pack3 vulnerabilities
- Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid2 vulnerabilities
- Post List Designer – Category Post, Recent Post, Post List2 vulnerabilities
- Post Slider And Post Carousel1 vulnerabilities
- Posts List Designer1 vulnerabilities
- Posts List Designer By Category1 vulnerabilities
- Posts List Designer By Category – List Category Posts Or Recent Posts1 vulnerabilities
CVE-2021-24913infornweblogo_showcase_with_slick_slider+2
EPSS score0.47%
The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswss_save_attachment_data AJAX action, allowing attackers to make a logged in high privilege user, change title, description, alt text, and URL of arbitrary uploaded media.CVE-2021-24729infornweblogo_showcase_with_slick_slider+2EPSS score0.62%
The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase.CVE-2021-24730infornweblogo_showcase_with_slick_slider+2EPSS score0.34%
The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX action, allowing any authenticated users, such as Subscriber, to change title, description, alt text, and URL of arbitrary uploaded media.CVE-2025-31082infornwebnews_\&_blog_designer_pack+1EPSS score0.84%
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in InfornWeb News & Blog Designer Pack blog-designer-pack allows PHP Local File Inclusion.This issue affects News & Blog Designer Pack: from n/a through <= 4.0.CVE-2025-4567infornwebpost_slider_and_post_carousel+2EPSS score0.25%
The Post Slider and Post Carousel with Post Vertical Scrolling Widget WordPress plugin before 3.2.10 does not validate and escape some of its Widget options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.CVE-2022-4792infornwebnews_\&_blog_designer_pack+2EPSS score0.44%
The News & Blog Designer Pack WordPress plugin before 3.3 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.CVE-2022-49745starpluginseasy_age_verify+1239EPSS score0.44%
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.CVE-2022-4749infornwebposts_list_designer+2EPSS score0.47%
The Posts List Designer by Category WordPress plugin before 3.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.CVE-2024-13362100pluginsopen_user_map+262EPSS score0.28%
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.CVE-2024-23502infornwebposts_list_designer_by_category+2EPSS score0.31%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in InfornWeb Posts List Designer by Category – List Category Posts Or Recent Posts allows Stored XSS.This issue affects Posts List Designer by Category – List Category Posts Or Recent Posts: from n/a through 3.3.2.CVE-2023-5815infornwebblog designer pack – blog, post grid, post slider, post carousel, category post, news+2EPSS score4.26%
The News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) plugin for WordPress is vulnerable to Remote Code Execution via Local File Inclusion in all versions up to, and including, 3.4.1 via the bdp_get_more_post function hooked via a nopriv AJAX. This is due to function utilizing an unsafe extract() method to extract values from the POST variable and passing that input to the include() function. This makes it possible for unauthenticated attackers to include arbitrary PHP files and achieve remote code execution. On vulnerable Docker configurations it may be possible for an attacker to create a PHP file and then subsequently include it to achieve RCE.