infornweb Vulnerabilities and Affected Products
Vulnerabilities associated with news_\&_blog_designer_pack.
Products
Clear product- Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News3 vulnerabilities
- Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid2 vulnerabilities
- news_\&_blog_designer_pack2 vulnerabilities
- Post List Designer – Category Post, Recent Post, Post List2 vulnerabilities
- News & Blog Designer Pack1 vulnerability
- news_\&_blog_designer_pack_wordpress_blog_plugin1 vulnerability
- Posts List Designer by Category – List Category Posts Or Recent Posts1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-31082HIGH | WordPress News & Blog Designer Pack plugin <= 4.0 - Local File Inclusion vulnerabilityImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in InfornWeb News & Blog Designer Pack blog-designer-pack allows PHP Local File Inclusion.This issue affects News & Blog Designer Pack: from n/a through <= 4.0. CWE-98Apr 1, 2025 | CVSS8.1v3.1 | EPSS0.795% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-5815HIGH | News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Remote Code Execution via Local File InclusionThe News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) plugin for WordPress is vulnerable to Remote Code Execution via Local File Inclusion in all versions up to, and including, 3.4.1 via the bdp_get_more_post function hooked via a nopriv AJAX. This is due to function utilizing an unsafe extract() method to extract values from the POST variable and passing that input to the include() function. This makes… | CVSS8.1v3.1 | EPSS4.26% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |