Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: beaverbuilder Component: Customizer Export/import Clear all filters
TI-2024-07063 CVE-2024-7620 · GHSA-3x6p-q4pv-82hr

Customizer Export/Import <= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import

Priority LOW 33

The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all versions up to, and including, 0.9.7.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.00737 Published 2024-09-07 No fix listed CWE-434
TI-2023-01273 CVE-2023-1347 · GHSA-w7hh-rr9c-v4j6

Customizer Export/Import < 0.9.6 - Admin+ PHP Object Injection

Priority HIGH 65

The Customizer Export/Import WordPress plugin before 0.9.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.16046 Published 2023-05-08 Fixed in 0.9.6 CWE-502
TI-2022-03124 CVE-2022-3380 · GHSA-5gr8-8qhc-45jj

Customizer Export/Import < 0.9.5 - Admin+ PHP Objection Injection

Priority HIGH 67

The Customizer Export/Import WordPress plugin before 0.9.5 unserializes the content of an imported file, which could lead to PHP object injection issues when an admin imports (intentionally or not) a malicious file and a…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01637 Published 2022-10-31 Fixed in 0.9.5 CWE-502