Extension WordPress
Vulnérabilités WP Foodbakery
Cette page rassemble les failles publiées pour WP Foodbakery, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de WP Foodbakery
10 fiches
WP Foodbakery <= 4.9 – Authenticated (Subscriber+) Arbitrary File Deletion via via delete_locations_backup_file AJAX Action
The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_locations_backup_file_callback' function in all versions up to, and including, 4.9. This makes it possible for authenticated attackers, with…
*-4.9
Non indiqué
21/07/2026
WP FoodBakery <= 3.3 – Unauthenticated PHP Object Injection
The WP FoodBakery plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.3 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known…
*-3.3
Non indiqué
21/04/2025
FoodBakery | Delivery Restaurant Directory WordPress Theme <= 4.7 – Missing Authorization in Multiple Functions
The FoodBakery | Delivery Restaurant Directory WordPress Theme theme for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the foodbakery_var_backup_file_delete, foodbakery_widget_file_delete, theme_option_save, export_widget_settings, ajax_import_widget_data, foodbakery_var_settings_backup_generate, foodbakery_var_backup_file_restore, and…
*-4.7
4.8
18/03/2025
FoodBakery | Delivery Restaurant Directory WordPress Theme <= 4.7 – Cross-Site Request Forgery in Multiple Functions
The FoodBakery | Delivery Restaurant Directory WordPress Theme theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.7. This is due to missing or incorrect nonce validation on the foodbakery_var_backup_file_delete, foodbakery_widget_file_delete,…
*-4.7
Non indiqué
18/03/2025
WP Foodbakery <= 4.7 – Unauthenticated Privilege Escalation in foodbakery_registration_validation
The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.7. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This…
*-4.7
4.8
10/02/2025
WP Foodbakery <= 4.8 – Authentication Bypass in foodbakery_parse_request
The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.8. This is due to the plugin not properly validating a user's identity prior to setting the…
*-4.8
Non indiqué
10/02/2025
WP Foodbakery <= 4.8 – Reflected Cross-Site Scripting
The WP Foodbakery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on the 'search_type' parameter. This makes it possible for unauthenticated attackers…
*-4.8
Non indiqué
10/02/2025
WP Foodbakery <= 4.7 – Unauthenticated Arbitrary File Upload
The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'upload_publisher_profile_image' function in versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to upload…
*-4.7
4.8
10/02/2025
FoodBakery | Delivery Restaurant Directory WordPress Theme <= 2.1 – Reflected Cross-Site Scripting
The WP Foodbakery WordPress plugin before 2.2, used in the FoodBakery WordPress theme before 2.2 did not properly sanitize the foodbakery_radius parameter before outputting it back in the response, leading to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability.
*-2.1
2.2
14/06/2021
FoodBakery <= 1.9 – Reflected Cross-Site Scripting
The FoodBakery theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.9 due to insufficient input sanitization and output escaping on the 'location' parameter. This makes it possible for unauthenticated attackers to…
*-1.9
2.0
24/07/2020
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.