Vulnerabilities and security researches foraddons-for-visual-composer addons-for-visual-composer

Jun 07, 2024

CVE, Research URL: CVE-2024-30183
Home page URL: Security reports for WPBakery Page Builder Addons by Livemesh
Application: WPBakery Page Builder Addons by Livemesh
Date: Mar 27, 2024
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh Livemesh Addons for WPBakery Page Builder allows Stored XSS.This issue affects Livemesh Addons for WPBakery Page Builder: from n/a through 3.7.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: b0af4c0e7ff387a5f71e14f8b5059a141fd5b7b9
Home page URL: Security reports for WPBakery Page Builder Addons by Livemesh
Application: WPBakery Page Builder Addons by Livemesh
Date: Feb 28, 2022
Research Description: WPBakery Page Builder Addons by Livemesh [addons-for-visual-composer] < 3.3 (closed) WordPress Livemesh Addons for WPBakery Page Builder plugin <= 2.9.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability discovered in WordPress Livemesh Addons for WPBakery Page Builder plugin (versions <= 2.9.1).
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2023-50370
Home page URL: Security reports for WPBakery Page Builder Addons by Livemesh
Application: WPBakery Page Builder Addons by Livemesh
Date: Dec 14, 2023
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh WPBakery Page Builder Addons by Livemesh allows Stored XSS.This issue affects WPBakery Page Builder Addons by Livemesh: from n/a through 3.5.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2024-2079
Home page URL: Security reports for WPBakery Page Builder Addons by Livemesh
Application: WPBakery Page Builder Addons by Livemesh
Date: Mar 14, 2024
Research Description: The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'per_line_mobile' shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

Aug 20, 2024

CVE, Research URL: CVE-2024-43320
Home page URL: Security reports for WPBakery Page Builder Addons by Livemesh
Application: WPBakery Page Builder Addons by Livemesh
Date: Aug 18, 2024
Research Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Livemesh Livemesh Addons for WPBakery Page Builder addons-for-visual-composer allows Stored XSS.This issue affects Livemesh Addons for WPBakery Page Builder: from n/a through 3.9.
Affected versions: Min -, max -.
Status: vulnerable

Nov 15, 2024

CVE, Research URL: CVE-2022-4974
Home page URL: Security reports for WPBakery Page Builder Addons by Livemesh
Application: WPBakery Page Builder Addons by Livemesh
Date: Oct 16, 2024
Research Description: The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.
Affected versions: Min -, max -.
Status: vulnerable