Description (CNA)
An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.6 did not have capability checks nor sanitization, allowing low privilege users (subscriber+) to call it and set XSS payloads, which will be triggered in all backend pages.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| bitorbit / WPBakery Page Builder (Visual Composer) Clipboard | affected 4.5.0 before 4.5.0*; affected 4.5.6 before 4.5.6 |
CWE
CWE-79
References
- https://wpscan.com/vulnerability/3bc0733a-b949-40c9-a5fb-f56814fc4af3
- https://codecanyon.net/item/visual-composer-clipboard/8897711
ADP enrichment
No English description supplied.