Read the docs

websitebaker

Records16All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9

Exploited now

websitebaker records in CISA KEV

No websitebaker vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Websitebaker 16 records HIGH

Records

16 records in Websitebaker · all components

TI-2021-22404 CVE-2021-47788 · GHSA-p4hv-mffv-fqrv

WebsiteBaker 2.13.0 - Remote Code Execution (RCE) (Authenticated)

Priority HIGH 73

WebsiteBaker 2.13.0 contains an authenticated remote code execution vulnerability that allows users with language editing permissions to execute arbitrary code.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00963 Published 2026-01-15 No fix listed CWE-434
TI-2023-30185 CVE-2023-53902 · GHSA-q5hv-gf2m-3r8v

WebsiteBaker 2.13.3 Directory Traversal via Media Delete Endpoint

Priority HIGH 70

WebsiteBaker 2.13.3 contains a directory traversal vulnerability that allows authenticated attackers to delete arbitrary files by manipulating directory path parameters.

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.01009 Published 2025-12-16 No fix listed CWE-22
TI-2023-30236 CVE-2023-53953 · GHSA-g4gm-4wgj-pr24

WebsiteBaker 2.13.3 Stored Cross-Site Scripting via Page Creation

Priority MEDIUM 56

WebsiteBaker 2.13.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts when creating web pages.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00245 Published 2025-12-19 No fix listed CWE-79
TI-2023-30186 CVE-2023-53903 · GHSA-9qcf-r8v3-qr8c

WebsiteBaker 2.13.3 Stored Cross-Site Scripting via SVG File Upload

Priority MEDIUM 56

WebsiteBaker 2.13.3 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00245 Published 2025-12-16 No fix listed CWE-79
TI-2017-05063 CVE-2017-7410 · GHSA-w6gc-97hw-x56g

Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in…

Priority MEDIUM 49

Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username, (2) display_name para…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03946 Published 2017-04-03 No fix listed CWE-89
TI-2011-02586 CVE-2011-2934 · GHSA-g7gh-g93w-c35q

Cross-site request forgery in WebsiteBaker

Priority LOW 39

A Cross Site Request Forgery (CSRF) vulnerability exists in the administrator functions in WebsiteBaker 2.8.1 and earlier due to inadequate confirmation for sensitive transactions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00503 Published 2020-01-14 No fix listed CWE-352
TI-2011-02585 CVE-2011-2933 · GHSA-wjm5-2p7j-f53r

Unrestricted file upload in WebsiteBaker

Priority LOW 34

An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploaded files with .htaccess, .php4, .php5, and .phtl extensions.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01112 Published 2020-01-14 No fix listed CWE-434
TI-2017-12130 CVE-2017-16514 · GHSA-9748-jqgr-v672

Multiple persistent stored Cross-Site-Scripting (XSS) vulnerabilities in the files…

Priority LOW 28

Multiple persistent stored Cross-Site-Scripting (XSS) vulnerabilities in the files /wb/admin/admintools/tool.php (Droplet Description) and /install/index.php (Site Title) in WebsiteBaker 2.10.0 allow attackers to insert…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00632 Published 2018-01-10 No fix listed CWE-79
Open these records in search →