techeshta vulnerabilities and threats

The Layouts for WPBakery WordPress plugin up to version 1.1.3 contains a missing authorization vulnerability. This flaw allows unauthenticated attackers to invoke the template_sync callback without capability checks or nonce verification. Attackers can cause the server to make outbound HTTP requests to the plugin vendor's external API and write the JSON responses directly into the site's wp_options table via set_transient(). This vulnerability can lead to integrity and availability impacts on the affected WordPress site.

The Timeline Blocks for Gutenberg WordPress plugin versions up to 1.1.10 contains a stored cross-site scripting (XSS) vulnerability via the 'titleTag' attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping of user-supplied attributes. The CVSS 3.1 base score is 6.4, indicating a medium severity level. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Techeshta Card Elements for WPBakery card-elements-for-wpbakery allows DOM-Based XSS.This issue affects Card Elements for WPBakery: from n/a through <= 1.0.8.

The Card Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Profile Card widget in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Techeshta Card Elements for Elementor allows Stored XSS.This issue affects Card Elements for Elementor: from n/a through 1.2.2.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Techeshta Post Layouts for Gutenberg allows Stored XSS.This issue affects Post Layouts for Gutenberg: from n/a through 1.2.7.

Unrestricted Upload of File with Dangerous Type vulnerability in Techeshta Layouts for Elementor.This issue affects Layouts for Elementor: from n/a before 1.8.