Vulnerabilidades de Webilia
CVEs publicadas que afetam produtos de Webilia: 6 registro(s), com severidade, exploração e correções.
Listdom 3Vertex Addons for Elementor 2Listdom: AI-powered Business Directory with Classifieds Ads Listings 1
CVE-2026-104722
Média · 4.9
CWE-22 10/10/2026
Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSD_Menus_IX_CSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVE-2026-54819
Crítica · 9.3
CWE-89 17/06/2026
WordPress Listdom plugin <= 5.4.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webilia Inc. Listdom allows Blind SQL Injection.
This issue affects Listdom: from n/a through 5.4.0.
CVE-2026-49063
Alta · 7.3
CWE-266 15/06/2026
WordPress Listdom plugin <= 5.5.0 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Listdom <= 5.5.0 versions.
CVE-2026-4326
Alta · 8.8
CWE-862 08/04/2026
Vertex Addons for Elementor <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation via 'afeb_activate_required_plugins'
The Vertex Addons for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.6.4. This is due to improper authorization enforcement in the activate_required_plugins() function. Specifically, the current_user_can('install_plugins') capability check does not terminate execution when it fails — it only sets an error message variable while allowing the plugin installation and activation code to execute. The error response is only sent after the installation and activation have already completed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins from the WordPress.
CVE-2026-25398
Média · 6.5
CWE-862 25/03/2026
WordPress Vertex Addons for Elementor plugin <= 1.6.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Webilia Inc. Vertex Addons for Elementor addons-for-elementor-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vertex Addons for Elementor: from n/a through <= 1.6.4.
CVE-2025-67560
Média · 5.4
CWE-862 09/12/2025
WordPress Listdom plugin <= 5.0.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Webilia Inc. Listdom listdom allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Listdom: from n/a through <= 5.0.1.