Skip to content
Sign in
4.8 Medium

CVE-2022-3830 The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could…

Description

The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affected products and versions

Product Affected versions Fixed in
WP Page Builder 1.2 earliest → 1.2.8 No fix stated

Other CVEs of WP Page Builder

The 3 CVEs of WP Page Builder →
CVE-2021-24207 By default, the WP Page Builder WordPress plugin before 1.2.4 allows subscriber-level users to edit and make changes… Not rated CVE-2021-24208 The editor of the WP Page Builder WordPress plugin before 1.2.4 allows lower-privileged users to insert unfiltered HTML,… Not rated
Track this CVE