CveMateVulnerability intelligence

Webfactoryltd vulnerabilities

27 vulnerabilities

Known vulnerabilities in Webfactoryltd products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 14 products.

Products

14

Minimal Coming Soon \& Maintenance Mode5 vulnerabilities
Wp Database Reset3 vulnerabilities
Wp Reset3 vulnerabilities
301 Redirects2 vulnerabilities
External Links In New Window \/ New Tab2 vulnerabilities
Under Construction2 vulnerabilities
Wp Login Lockdown2 vulnerabilities
Wp Reset Pro2 vulnerabilities
Advanced Google Recaptcha1 vulnerabilities
Guest Author1 vulnerabilities
Maintenance1 vulnerabilities
Maps Widget For Google Maps1 vulnerabilities
Simple Author Box1 vulnerabilities
Wp Force Ssl1 vulnerabilities

CVE-2021-36909webfactory ltd.wp reset pro+24y ago18-11-2021 14:41

Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe the entire database regardless of their authorization. It leads to a complete website reset and takeover.CVE-2021-36908webfactory ltd.wp reset pro+24y ago18-11-2021 14:37

Cross-Site Request Forgery (CSRF) vulnerability in WebFactory Ltd. WP Reset PRO plugin <= 5.98 versions.CVE-2021-24533unknownmaintenance+25y ago23-08-2021 11:10

The Maintenance WordPress plugin before 4.03 does not sanitise or escape some of its settings, allowing high privilege users such as admin to se Cross-Site Scripting payload in them (even when the unfiltered_html capability is disallowed), which will be triggered in the frontend CVE-2021-24142unknown301 redirects - easy redirect manager+25y ago18-03-2021 14:57

Unvaludated input in the 301 Redirects - Easy Redirect Manager WordPress plugin, versions before 2.51, did not sanitise its "Redirect From" column when importing a CSV file, allowing high privilege users to perform SQL injections.CVE-2021-24424unknownwp reset – most advanced wordpress reset tool+25y ago12-07-2021 19:20

The WP Reset – Most Advanced WordPress Reset Tool WordPress plugin before 1.90 did not sanitise or escape its extra_data parameter when creating a snapshot via the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue CVE-2025-1262webfactoryadvanced google recaptcha+21y ago25-02-2025 12:41

The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification.CVE-2020-7048webfactoryltdwp_database_reset+16y ago16-01-2020 20:35

The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the database to the initial WordPress set-up state (deleting all site content stored in that table), as demonstrated by a wp-admin/admin-post.php?db-reset-tables[]=comments URI.CVE-2020-7047webfactoryltdwp_database_reset+16y ago16-01-2020 20:37

The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability (with a simple wp-admin/admin.php?db-reset-tables[]=users request) to escalate their privileges to administrator while dropping all other users from the table.CVE-2020-6166webfactoryltdminimal_coming_soon_\&_maintenance_mode+16y ago09-01-2020 19:54

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with basic access to export settings and change maintenance-mode themes.CVE-2020-6167webfactoryltdminimal_coming_soon_\&_maintenance_mode+16y ago09-01-2020 18:09

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject XSS, modify several important settings, or include remote files as a logo.CVE-2020-6168webfactoryltdminimal_coming_soon_\&_maintenance_mode+16y ago09-01-2020 19:58

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable and disable maintenance-mode settings (impacting the availability and confidentiality of a vulnerable site, along with the integrity of the setting).CVE-2022-1583unknownexternal links in new window / new tab+24y ago30-05-2022 08:36

The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null" when links to external sites are clicked, which may enable tabnabbing attacks to occur.CVE-2022-1582unknownexternal links in new window / new tab+24y ago30-05-2022 08:36

The External Links in New Window / New Tab WordPress plugin before 1.43 does not properly escape URLs it concatenates to onclick event handlers, which makes Stored Cross-Site Scripting attacks possible.CVE-2024-1501webfactorydatabase reset+22y ago21-02-2024 03:36

The Database Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.22. This is due to missing or incorrect nonce validation on the install_wpr() function. This makes it possible for unauthenticated attackers to install the WP Reset Plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.CVE-2024-1340webfactorylogin lockdown & protection+22y ago20-02-2024 18:56

The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the generate_export_file function in all versions up to, and including, 2.08. This makes it possible for authenticated attackers, with subscriber access and higher, to export this plugin's settings that include whitelisted IP addresses as well as a global unlock key. With the global unlock key an attacker can add their IP address to the whitelist.CVE-2024-1075webfactoryminimal coming soon – coming soon page+22y ago05-02-2024 21:21

The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to maintenance mode bypass and information disclosure in all versions up to, and including, 2.37. This is due to the plugin improperly validating the request path. This makes it possible for unauthenticated attackers to bypass maintenance mode and view pages that should be hidden.CVE-2024-4661webfactorywp reset+22y ago08-06-2024 05:44

The WP Reset plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_ajax function in all versions up to, and including, 2.02. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the value fo the 'License Key' field for the 'Activate Pro License' setting.CVE-2024-5087webfactoryminimal coming soon – coming soon page+22y ago08-06-2024 05:44

The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the validate_ajax, deactivate_ajax, and save_ajax functions in all versions up to, and including, 2.38. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit the license key, which could disable features of the plugin.CVE-2024-5770webfactorywp force ssl & https ssl redirect+22y ago08-06-2024 04:32

The WP Force SSL & HTTPS SSL Redirect plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_setting' function in versions up to, and including, 1.66. This makes it possible for authenticated attackers, subscriber-level permissions and above, to update the plugin settings.CVE-2019-19915webfactoryltd301_redirects+16y ago19-12-2019 21:07

The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject redirect rules, and exploit XSS, with the /admin-ajax.php?action=eps_redirect_save and /admin-ajax.php?action=eps_redirect_delete actions. This could result in a loss of site availability, malicious redirects, and user infections. This could also be exploited via CSRF.