Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2024-7620

Customizer Export/Import <= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import

The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: This vulnerability is only exploitable when used in conjunction with a race condition as the uploaded file is deleted shortly after it is created.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Fastlinemedia The Beaver Builder Team
Products
Customizer Export\/import Cutomizer Export\/import
CVE-2022-3380

Customizer Export/Import < 0.9.5 - Admin+ PHP Objection Injection

The Customizer Export/Import WordPress plugin before 0.9.5 unserializes the content of an imported file, which could lead to PHP object injection issues when an admin imports (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.

CVSS 3.1 · 7.2 High EPSS 1.6% KEV · Not listed
Vendors
Fastlinemedia
Products
Customizer Export\/import
CVE-2023-1347

Customizer Export/Import < 0.9.6 - Admin+ PHP Object Injection

The Customizer Export/Import WordPress plugin before 0.9.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present

CVSS 3.1 · 7.2 High EPSS 16.0% KEV · Not listed
Vendors
Fastlinemedia
Products
Customizer Export\/import