Filtered by vendor Wpbean Subscriptions
Filtered by product Wpb Advanced Faq Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-11038 1 Wpbean 2 Wpb Advanced Faq, Wpb Popup For Contact Form 7 2025-07-09 7.3 High
The The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup plugin for WordPress is vulnerable to arbitrary shortcode execution via wpb_pcf_fire_contact_form AJAX action in all versions up to, and including, 1.7.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVE-2023-0370 1 Wpbean 1 Wpb Advanced Faq 2025-02-26 5.4 Medium
The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.