Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

16 records

Vendor: websitebaker Clear all filters
TI-2021-22404 CVE-2021-47788 · GHSA-p4hv-mffv-fqrv

WebsiteBaker 2.13.0 - Remote Code Execution (RCE) (Authenticated)

Priority HIGH 73

WebsiteBaker 2.13.0 contains an authenticated remote code execution vulnerability that allows users with language editing permissions to execute arbitrary code.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00963 Published 2026-01-15 No fix listed CWE-434
TI-2023-30236 CVE-2023-53953 · GHSA-g4gm-4wgj-pr24

WebsiteBaker 2.13.3 Stored Cross-Site Scripting via Page Creation

Priority MEDIUM 56

WebsiteBaker 2.13.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts when creating web pages.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00245 Published 2025-12-19 No fix listed CWE-79
TI-2023-30186 CVE-2023-53903 · GHSA-9qcf-r8v3-qr8c

WebsiteBaker 2.13.3 Stored Cross-Site Scripting via SVG File Upload

Priority MEDIUM 56

WebsiteBaker 2.13.3 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with embedded JavaScript.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00245 Published 2025-12-16 No fix listed CWE-79
TI-2023-30185 CVE-2023-53902 · GHSA-q5hv-gf2m-3r8v

WebsiteBaker 2.13.3 Directory Traversal via Media Delete Endpoint

Priority HIGH 70

WebsiteBaker 2.13.3 contains a directory traversal vulnerability that allows authenticated attackers to delete arbitrary files by manipulating directory path parameters.

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.01009 Published 2025-12-16 No fix listed CWE-22
TI-2011-02585 CVE-2011-2933 · GHSA-wjm5-2p7j-f53r

Unrestricted file upload in WebsiteBaker

Priority LOW 34

An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploaded files with .htaccess, .php4, .php5, and .phtl extensions.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01112 Published 2020-01-14 No fix listed CWE-434
TI-2011-02586 CVE-2011-2934 · GHSA-g7gh-g93w-c35q

Cross-site request forgery in WebsiteBaker

Priority LOW 39

A Cross Site Request Forgery (CSRF) vulnerability exists in the administrator functions in WebsiteBaker 2.8.1 and earlier due to inadequate confirmation for sensitive transactions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00503 Published 2020-01-14 No fix listed CWE-352
TI-2017-12130 CVE-2017-16514 · GHSA-9748-jqgr-v672

Multiple persistent stored Cross-Site-Scripting (XSS) vulnerabilities in the files…

Priority LOW 28

Multiple persistent stored Cross-Site-Scripting (XSS) vulnerabilities in the files /wb/admin/admintools/tool.php (Droplet Description) and /install/index.php (Site Title) in WebsiteBaker 2.10.0 allow attackers to insert…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00632 Published 2018-01-10 No fix listed CWE-79
TI-2017-05063 CVE-2017-7410 · GHSA-w6gc-97hw-x56g

Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in…

Priority MEDIUM 49

Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username, (2) display_name para…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03946 Published 2017-04-03 No fix listed CWE-89