Skip to content

Vendor

AWeber vulnerabilities

3 published CVES affecting AWeber, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
2
Medium
1
Low
0
Unscored
0
CISA KEV
0
Atom feed of AWeber alerts

Products

Latest AWeber CVEs

Newest publication first

  1. CVE-2024-13313 AWeber <= 7.3.20 - Admin+ Stored XSS

    Published
    MediumCVSS 4.8 EPSS 0.33%

    The AWeber WordPress plugin through 7.3.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup...

  2. CVE-2024-1793 AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth By AWeber <= 7.3.14 - Authenticated (Admin+) SQL Injection

    Published
    HighCVSS 7.2 EPSS 0.89%

    The AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth plugin for WordPress is vulnerable to SQL Injection via the 'post_id' parameter in all versions up to, and including, 7.3.14 due to insufficient escaping on the user sup...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.