Vulnerabilities > Seedprod
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-09-12 | CVE-2024-6887 | Cross-site Scripting vulnerability in Seedprod Rafflepress The Giveaways and Contests by RafflePress WordPress plugin before 1.12.16 does not sanitise and escape some of its Giveaways settings, which could allow high privilege users such as editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | 4.8 |
| 2024-07-21 | CVE-2024-37556 | Cross-site Scripting vulnerability in Seedprod Wordpress Notification BAR Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SeedProd WordPress Notification Bar allows Stored XSS.This issue affects WordPress Notification Bar: from n/a through 1.3.10. | 4.8 |
| 2024-06-10 | CVE-2024-4745 | Unspecified vulnerability in Seedprod Rafflepress Missing Authorization vulnerability in RafflePress Giveaways and Contests by RafflePress.This issue affects Giveaways and Contests by RafflePress: from n/a through 1.12.4. | 6.3 |
| 2024-02-05 | CVE-2024-1072 | Missing Authorization vulnerability in Seedprod Website Builder BY Seedprod The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the seedprod_lite_new_lpage function in all versions up to, and including, 6.15.21. | 7.5 |
| 2023-10-30 | CVE-2023-5049 | Cross-site Scripting vulnerability in Seedprod Rafflepress The Giveaways and Contests by RafflePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rafflepress' and 'rafflepress_gutenberg' shortcode in versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping on 'giframe' user supplied attribute. | 5.4 |
| 2023-10-20 | CVE-2023-4975 | Cross-Site Request Forgery (CSRF) vulnerability in Seedprod Website Builder BY Seedprod The Website Builder by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.13.1. | 4.3 |
| 2020-06-24 | CVE-2020-15038 | Cross-site Scripting vulnerability in Seedprod Coming Soon Page, Under Construction & Maintenance Mode The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS. | 5.4 |