| Package | Affected versions | Patched versions |
|---|---|---|
| kingcomposer | ≤ 2.9.6 |
The KingComposer WordPress plugin through 2.9.6 does not have authorisation, CSRF and sanitisation/escaping when creating profile, allowing any authenticated users to create arbitrary ones, with Cross-Site Scripting payloads in them
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free