PickPlugins Vulnerabilities and Affected Products
Vulnerabilities associated with product_designer.
Products
Clear product- Post Grid12 vulnerabilities
- Job Board Manager9 vulnerabilities
- Post Grid and Gutenberg Blocks8 vulnerabilities
- Wishlist6 vulnerabilities
- Accordion5 vulnerabilities
- post_grid4 vulnerabilities
- post_grid_combo4 vulnerabilities
- Product Slider for WooCommerce3 vulnerabilities
- Question Answer3 vulnerabilities
- Team Showcase3 vulnerabilities
- Testimonial Slider3 vulnerabilities
- Accordions2 vulnerabilities
- Mail Picker2 vulnerabilities
- PickPlugins Product Designer for WooCommerce2 vulnerabilities
- Product Designer2 vulnerabilities
- product_designer2 vulnerabilities
- User Verification by PickPlugins2 vulnerabilities
- ComboBlocks1 vulnerability
- page_builder_comboblocks1 vulnerability
- PickPlugins Pricing Table1 vulnerability
- PickPlugins Product Slider for WooCommerce1 vulnerability
- PickPlugins Question Answer1 vulnerability
- Post Grid and Gutenberg Blocks – ComboBlocks1 vulnerability
- Post Grid Combo – 36+ Gutenberg Blocks1 vulnerability
- product_slider_for_woocommerce1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-38726HIGH | WordPress Product Designer plugin <= 1.0.33 - Arbitrary Content Deletion vulnerabilityMissing Authorization vulnerability in PickPlugins Product Designer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Product Designer: from n/a through 1.0.33. CWE-862Nov 1, 2024 | CVSS7.5v3.1 | EPSS0.476% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-3608MEDIUM | Product Designer <= 1.0.33 - Missing Authorization to Unauthenticated Arbitrary Attachment DeletionThe Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the product_designer_ajax_delete_attach_id() function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to delete arbitrary attachments. CVE-2024-38726 appears to be a duplicate of this issue. CWE-862Jul 9, 2024 | CVSS5.3v3.1 | EPSS0.562% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |