CVE-2024-1362

The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. This is due to missing or incorrect nonce validation on the cp_shortcode_refresh() function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352
• CWE-352

• https://plugins.trac.wordpress.org/changeset/3039597/colibri-page-builder/trunk/src/PageBuilder.phpPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a5e7a994-c489-4aea-a9bb-898bc92cae4e?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/changeset/3039597/colibri-page-builder/trunk/src/PageBuilder.phpPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a5e7a994-c489-4aea-a9bb-898bc92cae4e?source=cveThird Party Advisory

Published

Feb 23, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-13614Kaspersky has fixed a security issue in Kaspersky Anti-Virus…5.3
• CVE-2024-13615The Social Share Buttons, Social Sharing Icons, Click to Twe…3.5
• CVE-2024-13616The VikBooking Hotel Booking Engine & PMS WordPress plugin b…4.8
• CVE-2024-13617The aoa-downloadable WordPress plugin through 0.1.0 doesn't …8.6
• CVE-2024-13618The aoa-downloadable WordPress plugin through 0.1.0 lacks au…7.2
• CVE-2024-13619The LifterLMS WordPress plugin before 8.0.1 does not saniti…6.1
• CVE-2024-13621The GDPR Framework By Data443 WordPress plugin before 2.2.0 …4.8
• CVE-2024-13622The File Uploads Addon for WooCommerce plugin for WordPress …7.5
• CVE-2024-13623The Order Export for WooCommerce plugin for WordPress is vul…5.9
• CVE-2024-13624The WPMovieLibrary WordPress plugin through 2.1.4.8 does not…7.1
• CVE-2024-13625The Tube Video Ads Lite WordPress plugin through 1.5.7 does …7.1
• CVE-2024-13626The VR-Frases (collect & share quotes) WordPress plugin thro…7.1