Vulnerabilities

TI-2023-00254 CVE-2023-0268 · GHSA-3xph-666w-r62g

Mega Addons For WPBakery Page Builder < 4.3.0 - Contributor+ Stored XSS

MEDIUM 58

The Mega Addons For WPBakery Page Builder WordPress plugin before 4.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could a…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00444 Published 2023-05-08 Fixed in 4.3.0

TI-2022-04114 CVE-2022-4501 · GHSA-f2j2-75p6-x665

Mega Addons For WPBakery Page Builder <= 4.3.0 - Authenticated (Subscriber+) Settings Update

LOW 33

The Mega Addons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the vc_saving_data function in versions up to, and including, 4.3.0.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00747 Published 2022-12-14 No fix listed CWE-862

TI-2022-17037 CVE-2022-36798 · GHSA-hh3j-qq6p-7797

WordPress Mega Addons For WPBakery Page Builder plugin <= 4.2.7 - Cross-Site Request Forgery (CSRF) vulnerability

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Topdigitaltrends Mega Addons For WPBakery Page Builder plugin <= 4.2.7 at WordPress.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00357 Published 2022-09-23 No fix listed CWE-352

Vulnerabilities

Filters

Mega Addons For WPBakery Page Builder < 4.3.0 - Contributor+ Stored XSS

Mega Addons For WPBakery Page Builder <= 4.3.0 - Authenticated (Subscriber+) Settings Update

WordPress Mega Addons For WPBakery Page Builder plugin <= 4.2.7 - Cross-Site Request Forgery (CSRF) vulnerability