Seedprod Website Builder By Seedprod vulnerabilities
2 vulnerabilities
Known vulnerabilities in Seedprod Website Builder By Seedprod, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2024-1072seedprod · website_builder_by_seedprod +2 moreWebsite Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.15.21 - Missing Authorization via seedprod_lite_new_lpageThe Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the seedprod_lite_new_lpage function in all versions up to, and including, 6.15.21. This makes it possible for unauthenticated attackers to change the contents of coming-soon, maintenance pages, login and 404 pages set up with the plugin. Version 6.15.22 addresses this issue but introduces a bug affecting admin pages. We suggest upgrading to 6.15.23.EPSS0.68%MediumCVE-2023-4975seedprod · website_builder_by_seedprod +2 moreWebsite Builder by SeedProd <= 6.15.13.1 - Cross-Site Request Forgery to Settings UpdateThe Website Builder by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.13.1. This is due to missing or incorrect nonce validation on functionality in the builder.php file. This makes it possible for unauthenticated attackers to change the stripe connect token via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.EPSS0.32%