Seedprod vulnerabilities

16 vulnerabilities

Known vulnerabilities in Seedprod products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 7 products.

Products

7
6.4MediumCVE-2025-14785seedprod · website builder by seedprod — theme builder, landing page builder, coming soon page, maintenance mode +1 moreWebsite Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'seedprodnestedmenuwidget' ShortcodeThe Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `seedprodnestedmenuwidget` shortcode in all versions up to, and including, 6.20.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.26%4.3MediumCVE-2025-24540seedprod · coming soon page, under construction & maintenance mode by seedprod +1 moreWordPress Website Builder by SeedProd plugin <= 6.18.9 - Cross Site Request Forgery (CSRF) vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Cross Site Request Forgery.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.18.9.EPSS0.16%5.9MediumCVE-2025-49322seedprod · 404 page by seedprod +1 moreWordPress 404 Page by SeedProd < 1.0.2 - Cross Site Scripting (XSS) VulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeedProd 404 Page by SeedProd allows Stored XSS. This issue affects 404 Page by SeedProd: from n/a through n/a.EPSS0.26%4.3MediumCVE-2025-3949seedprod · website builder by seedprod — theme builder, landing page builder, coming soon page, maintenance mode +1 moreWebsite Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.18.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information ExposureThe Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'seedprod_lite_get_revisisons' function in all versions up to, and including, 6.18.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the content of arbitrary landing page revisions.EPSS0.63%6.4MediumCVE-2020-15038seedprod · coming_soon_page\,_under_construction_\&_maintenance_mode +1 moreseedprod coming_soon_page\,_under_construction_\&_maintenance_modeThe SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS.EPSS3.76%8.2HighCVE-2024-1072seedprod · website_builder_by_seedprod +2 moreWebsite Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.15.21 - Missing Authorization via seedprod_lite_new_lpageThe Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the seedprod_lite_new_lpage function in all versions up to, and including, 6.15.21. This makes it possible for unauthenticated attackers to change the contents of coming-soon, maintenance pages, login and 404 pages set up with the plugin. Version 6.15.22 addresses this issue but introduces a bug affecting admin pages. We suggest upgrading to 6.15.23.EPSS0.68%5.9MediumCVE-2024-47299seedprod · coming soon page, under construction & maintenance mode by seedprod +1 moreWordPress Website Builder by SeedProd <= 6.17.4 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Stored XSS.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.17.4.EPSS0.27%6.3MediumCVE-2024-4745rafflepress · giveaways_and_contests_by_rafflepress +2 moreWordPress Giveaways and Contests by RafflePress plugin <= 1.12.4 - Broken Access Control vulnerabilityMissing Authorization vulnerability in RafflePress Giveaways and Contests by RafflePress.This issue affects Giveaways and Contests by RafflePress: from n/a through 1.12.4.EPSS0.25%5.9MediumCVE-2024-37556seedprod · wordpress_notification_bar +1 moreWordPress WordPress Notification Bar plugin <= 1.3.10 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SeedProd WordPress Notification Bar allows Stored XSS.This issue affects WordPress Notification Bar: from n/a through 1.3.10.EPSS0.28%4.8MediumCVE-2024-10107seedprod · rafflepress +2 moreGiveaways and Contests by RafflePress < 1.12.17 - Admin+ Stored XSSThe Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).EPSS0.33%4.3MediumCVE-2024-32088seedprod · coming soon page, under construction & maintenance mode by seedprod +1 moreWordPress Website Builder plugin <= 6.15.20 - Cross Site Request Forgery (CSRF) vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through 6.15.20.EPSS0.21%4.8MediumCVE-2024-6887seedprod · rafflepress +2 moreGiveaways and Contests by RafflePress < 1.12.16 - Editor+ Stored XSSThe Giveaways and Contests by RafflePress WordPress plugin before 1.12.16 does not sanitise and escape some of its Giveaways settings, which could allow high privilege users such as editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)EPSS0.37%5.5MediumCVE-2026-39464seedprod · coming soon page, under construction & maintenance mode by seedprod +1 moreWordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin <= 6.19.8 - Server Side Request Forgery (SSRF) vulnerabilityServer-Side Request Forgery (SSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Server Side Request Forgery.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.19.8.EPSS0.26%5.3MediumCVE-2026-27368seedprod · coming soon page, under construction & maintenance mode by seedprod +1 moreWordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin <= 6.19.8 - Broken Access Control vulnerabilityMissing Authorization vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.19.8.EPSS0.34%4.3MediumCVE-2023-4975seedprod · website_builder_by_seedprod +2 moreWebsite Builder by SeedProd <= 6.15.13.1 - Cross-Site Request Forgery to Settings UpdateThe Website Builder by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.13.1. This is due to missing or incorrect nonce validation on functionality in the builder.php file. This makes it possible for unauthenticated attackers to change the stripe connect token via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.EPSS0.32%6.4MediumCVE-2023-5049seedprod · rafflepress +2 moreGiveaways and Contests by RafflePress <= 1.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeThe Giveaways and Contests by RafflePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rafflepress' and 'rafflepress_gutenberg' shortcode in versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping on 'giframe' user supplied attribute. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.48%