Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2023-6635

EditorsKit <= 1.40.3 - Authenticated (Administrator+) Arbitrary File Upload

The EditorsKit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the 'import_styles' function in versions up to, and including, 1.40.3. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Extendify
Products
Editorskit
CVE-2021-24546

EditorsKit < 1.31.6 - Contributor+ Arbitrary PHP Code Execution

The Gutenberg Block Editor Toolkit – EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility settings, allowing users with a role as low contributor to execute Arbitrary PHP code

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed
Vendors
Extendify
Products
Editorskit