Website Builder by SeedProd

SeedProd before 6.18.4 lets a user with the edit_others_posts capability save arbitrary landing-page HTML without checking unfiltered_html. Because the saved markup is post-processed to turn a placeholder token into a real script tag, an Editor who is not allowed to post unfiltered HTML can store JavaScript that then runs for every visitor of the public landing page.

This vulnerability affects the following application versions:

• Website Builder by SeedProd 6.0.5
• Website Builder by SeedProd 6.0.6
• Website Builder by SeedProd 6.0.7
• Website Builder by SeedProd 6.0.8
• Website Builder by SeedProd 6.0.8.1
• Website Builder by SeedProd 6.0.8.2
• Website Builder by SeedProd 6.0.8.3
• Website Builder by SeedProd 6.0.8.4
• Website Builder by SeedProd 6.0.8.5
• Website Builder by SeedProd 6.0.9.0
• Website Builder by SeedProd 6.0.10.1
• Website Builder by SeedProd 6.0.11.1
• Website Builder by SeedProd 6.2.0
• Website Builder by SeedProd 6.2.1
• Website Builder by SeedProd 6.2.2
• Website Builder by SeedProd 6.2.3
• Website Builder by SeedProd 6.2.4
• Website Builder by SeedProd 6.2.5
• Website Builder by SeedProd 6.6.0
• Website Builder by SeedProd 6.9.0.8
• Website Builder by SeedProd 6.10.0
• Website Builder by SeedProd 6.12.0
• Website Builder by SeedProd 6.12.2
• Website Builder by SeedProd 6.13.0
• Website Builder by SeedProd 6.13.1
• Website Builder by SeedProd 6.15.3
• Website Builder by SeedProd 6.15.4
• Website Builder by SeedProd 6.15.6
• Website Builder by SeedProd 6.15.7
• Website Builder by SeedProd 6.15.13.1
• Website Builder by SeedProd 6.15.15.3
• Website Builder by SeedProd 6.15.18
• Website Builder by SeedProd 6.15.19
• Website Builder by SeedProd 6.15.20
• Website Builder by SeedProd 6.15.21
• Website Builder by SeedProd 6.15.22
• Website Builder by SeedProd 6.15.23
• Website Builder by SeedProd 6.17.4

A Contributor-level user could inject arbitrary JavaScript via the menu divider (“menudivider”) attribute of the nested navigation menu widget. The injected script executes when a visitor loads any SeedProd-powered page that includes the affected nav-menu block. The fix in `app/nestednavmenu.php` adds `sanitize_text_field()` on the incoming `menudivider` attribute value and wraps the output with `esc_html()` before writing it into the rendered `

The plugin’s Stripe Connect callback writes the seedprod_stripe_connect_token option from a GET parameter without a nonce or capability check. An attacker can trick an admin into visiting a crafted URL and overwrite the connected Stripe token

This vulnerability affects the following application versions:

• Website Builder by SeedProd 6.15.6
• Website Builder by SeedProd 6.15.7
• Website Builder by SeedProd 6.15.13.1

The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the seedprod_lite_new_lpage function in all versions up to, and including, 6.15.21. This makes it possible for unauthenticated attackers to change the contents of coming-soon, maintenance pages, login and 404 pages set up with the plugin

This vulnerability affects the following application versions:

• Website Builder by SeedProd 6.0.5
• Website Builder by SeedProd 6.0.6
• Website Builder by SeedProd 6.0.7
• Website Builder by SeedProd 6.0.8
• Website Builder by SeedProd 6.0.8.1
• Website Builder by SeedProd 6.0.8.2
• Website Builder by SeedProd 6.0.8.3
• Website Builder by SeedProd 6.0.8.4
• Website Builder by SeedProd 6.0.8.5
• Website Builder by SeedProd 6.0.9.0
• Website Builder by SeedProd 6.0.10.1
• Website Builder by SeedProd 6.0.11.1
• Website Builder by SeedProd 6.2.0
• Website Builder by SeedProd 6.2.1
• Website Builder by SeedProd 6.2.2
• Website Builder by SeedProd 6.2.3
• Website Builder by SeedProd 6.2.4
• Website Builder by SeedProd 6.2.5
• Website Builder by SeedProd 6.6.0
• Website Builder by SeedProd 6.9.0.8
• Website Builder by SeedProd 6.10.0
• Website Builder by SeedProd 6.12.0
• Website Builder by SeedProd 6.12.2
• Website Builder by SeedProd 6.13.0
• Website Builder by SeedProd 6.13.1
• Website Builder by SeedProd 6.15.3
• Website Builder by SeedProd 6.15.4
• Website Builder by SeedProd 6.15.6
• Website Builder by SeedProd 6.15.7
• Website Builder by SeedProd 6.15.13.1
• Website Builder by SeedProd 6.15.15.3
• Website Builder by SeedProd 6.15.18
• Website Builder by SeedProd 6.15.19
• Website Builder by SeedProd 6.15.20
• Website Builder by SeedProd 6.15.21
• Website Builder by SeedProd 6.15.22

Cross-Site Request Forgery due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknown action granted they can trick a site administrator into performing an action such as clicking on a link. The impact of this vulnerability is unknown.

This vulnerability affects the following application versions:

• Website Builder by SeedProd 6.0.8
• Website Builder by SeedProd 6.0.8.1
• Website Builder by SeedProd 6.0.8.2
• Website Builder by SeedProd 6.0.8.3
• Website Builder by SeedProd 6.0.8.4
• Website Builder by SeedProd 6.0.8.5
• Website Builder by SeedProd 6.0.9.0
• Website Builder by SeedProd 6.0.10.1
• Website Builder by SeedProd 6.0.11.1
• Website Builder by SeedProd 6.2.0
• Website Builder by SeedProd 6.2.1
• Website Builder by SeedProd 6.2.2
• Website Builder by SeedProd 6.2.3
• Website Builder by SeedProd 6.2.4
• Website Builder by SeedProd 6.2.5
• Website Builder by SeedProd 6.6.0
• Website Builder by SeedProd 6.9.0.8
• Website Builder by SeedProd 6.10.0
• Website Builder by SeedProd 6.12.0
• Website Builder by SeedProd 6.12.2
• Website Builder by SeedProd 6.13.0
• Website Builder by SeedProd 6.13.1
• Website Builder by SeedProd 6.15.3
• Website Builder by SeedProd 6.15.4
• Website Builder by SeedProd 6.15.6
• Website Builder by SeedProd 6.15.7
• Website Builder by SeedProd 6.15.13.1
• Website Builder by SeedProd 6.15.15.3
• Website Builder by SeedProd 6.15.18
• Website Builder by SeedProd 6.15.19
• Website Builder by SeedProd 6.15.20
• Website Builder by SeedProd 6.15.21
• Website Builder by SeedProd 6.15.22
• Website Builder by SeedProd 6.15.23
• Website Builder by SeedProd 6.17.4
• Website Builder by SeedProd 6.18.4
• Website Builder by SeedProd 6.18.5
• Website Builder by SeedProd 6.18.9

Due to a missing capability check, authenticated users with Subscriber-level permissions or higher can access and read private landing page revisions. This could lead to the exposure of sensitive draft content or upcoming site changes.

This vulnerability affects the following application versions:

• Website Builder by SeedProd 6.0.5
• Website Builder by SeedProd 6.0.6
• Website Builder by SeedProd 6.0.7
• Website Builder by SeedProd 6.0.8
• Website Builder by SeedProd 6.0.8.1
• Website Builder by SeedProd 6.0.8.2
• Website Builder by SeedProd 6.0.8.3
• Website Builder by SeedProd 6.0.8.4
• Website Builder by SeedProd 6.0.8.5
• Website Builder by SeedProd 6.0.9.0
• Website Builder by SeedProd 6.0.10.1
• Website Builder by SeedProd 6.0.11.1
• Website Builder by SeedProd 6.2.0
• Website Builder by SeedProd 6.2.1
• Website Builder by SeedProd 6.2.2
• Website Builder by SeedProd 6.2.3
• Website Builder by SeedProd 6.2.4
• Website Builder by SeedProd 6.2.5
• Website Builder by SeedProd 6.6.0
• Website Builder by SeedProd 6.9.0.8
• Website Builder by SeedProd 6.10.0
• Website Builder by SeedProd 6.12.0
• Website Builder by SeedProd 6.12.2
• Website Builder by SeedProd 6.13.0
• Website Builder by SeedProd 6.13.1
• Website Builder by SeedProd 6.15.3
• Website Builder by SeedProd 6.15.4
• Website Builder by SeedProd 6.15.6
• Website Builder by SeedProd 6.15.7
• Website Builder by SeedProd 6.15.13.1
• Website Builder by SeedProd 6.15.15.3
• Website Builder by SeedProd 6.15.18
• Website Builder by SeedProd 6.15.19
• Website Builder by SeedProd 6.15.20
• Website Builder by SeedProd 6.15.21
• Website Builder by SeedProd 6.15.22
• Website Builder by SeedProd 6.15.23
• Website Builder by SeedProd 6.17.4
• Website Builder by SeedProd 6.18.4
• Website Builder by SeedProd 6.18.5
• Website Builder by SeedProd 6.18.9
• Website Builder by SeedProd 6.18.10
• Website Builder by SeedProd 6.18.11
• Website Builder by SeedProd 6.18.12
• Website Builder by SeedProd 6.18.14
• Website Builder by SeedProd 6.18.15

The Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.20. This is due to missing or incorrect nonce validation on the seedprod_lite_redirect_to_site() function. This makes it possible for unauthenticated attackers to dismiss notices via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

This vulnerability affects the following application versions:

• Website Builder by SeedProd 6.13.0
• Website Builder by SeedProd 6.13.1
• Website Builder by SeedProd 6.15.3
• Website Builder by SeedProd 6.15.4
• Website Builder by SeedProd 6.15.6
• Website Builder by SeedProd 6.15.7
• Website Builder by SeedProd 6.15.13.1
• Website Builder by SeedProd 6.15.15.3
• Website Builder by SeedProd 6.15.19
• Website Builder by SeedProd 6.15.20