IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
4.3Media

CVE-2025-14074PDF for Contact Form 7 + Drag and Drop Template Builder <= 6.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Duplication

addonsorg PDF for Contact Form 7 + Drag and Drop Template Builder Publicada: (hace 11 meses)

Descripción

The PDF for Contact Form 7 + Drag and Drop Template Builder plugin for WordPress is vulnerable to unauthorized post duplication due to a missing capability check on the 'rednumber_duplicate' function in all versions up to, and including, 6.3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to duplicate arbitrary posts, including password protected or private ones.

Debilidad (CWE): CWE-862

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
addonsorg PDF for Contact Form 7 + Drag and Drop Template Builder ≤ 6.3.3

Referencias y parches

CVE recientes del mismo producto — WordPress plugins & themes

5.4Media
CVE-2026-118587

PowerPress Podcasting plugin by Blubrry <= 11.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' and 'height' Shortcode Attributes

blubrry PowerPress Podcasting plugin by Blubrry

The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 11.18.0 due to insufficient input sanitization and output escaping. This makes it pos…

9.8Crítica
CVE-2026-119077

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.9 - Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter

elextensions ELEX WordPress HelpDesk & Customer Ticketing System

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form s…

6.4Media
CVE-2026-126029

WPZOOM Addons for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regions[i][link][url]' and 'pins[i][link][url]' Parameters

wpzoom WPZOOM Addons for Elementor – Starter Templates & Widgets

The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][regions][i][link][url] / [pins][i][link][url]' parameter in all versi…