Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: King-Theme Component: Kingcomposer Clear all filters
TI-2021-07326 CVE-2021-25048 · GHSA-j638-92vp-3cfh

KingComposer <= 2.9.6 - Subscriber+ Stored Cross-Site Scripting

Priority LOW 25

The KingComposer WordPress plugin through 2.9.6 does not have authorisation, CSRF and sanitisation/escaping when creating profile, allowing any authenticated users to create arbitrary ones, with Cross-Site Scripting payl…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00637 Published 2022-04-04 No fix listed CWE-79
TI-2022-00106 CVE-2022-0165 · GHSA-hc34-ff73-68v9

Page Builder KingComposer <= 2.9.6 - Open Redirect

Priority LOW 34

The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX action available to both unauthenticated and authenticated user…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0428 Published 2022-03-14 No fix listed CWE-601
TI-2020-12054 CVE-2020-15299 · GHSA-388v-6f9f-263v

A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through…

Priority MEDIUM 57

A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an install_online_preset AJAX request containing base6…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.4696 Published 2020-07-09 No fix listed CWE-79