WordPress Plugin Vulnerabilities

KingComposer < 2.9.4 - Multiple Critical Issues

Description

Jerome Bruandet, from nintechnet, discovered multiple issues such as authenticated WordPress options change, content injection, stored Cross-Site Scripting (XSS), arbitrary file deletion and remote code execution.

Affects Plugins

Plugin icon
kingcomposer
Fixed in 2.9.4

References

CVE
CVE-2020-36709
CVE
CVE-2020-36701
CVE
CVE-2020-36700
URL
https://blog.nintechnet.com/wordpress-kingcomposer-page-builder-fixed-multiple-critical-vulnerabilities/

Miscellaneous

Original Researcher
Jerome Bruandet (nintechnet)
Verified
No
WPVDB ID
dc7959f8-479c-48df-b95f-1bab72c7e040

Timeline

Publicly Published
2020-06-15 (about 5 years ago)
Added
2020-06-15 (about 5 years ago)
Last Updated
2023-06-08 (about 2 years ago)

Other

Published
Title
Published
2015-09-20
Title
wordpress vertical image slider plugin < 1.2 - Cross-Site Scripting & CSRF
Published
2019-03-25
Title
Ads for WP <= 1.5 - XSS & Lack of Authorisation
Published
2014-08-01
Title
Comment Rating 2.9.23 - Multiple Vulnerabilities
Published
2019-05-06
Title
W3 Total Cache < 0.9.7.4 - Blind SSRF and RCE via phar
Published
2019-07-10
Title
File Manager < 5.2 - Multiple Vulnerabilities