Starter Templates
Monthly
Missing authorization checks in the Starter Templates (astra-sites) WordPress plugin, affecting versions through 4.7.7, allow a remote attacker holding a low-privilege account on the target site - such as a subscriber where open registration is enabled - to trigger plugin functionality that should be restricted to higher-privileged roles, resulting in low-level integrity and availability impact with no confidentiality loss (CVSS 5.4). The flaw is a CWE-862 incorrectly configured access-control level, requiring no user interaction and no special complexity, but it cannot be reached by a fully unauthenticated visitor (CVSS vector PR:L). At the time of analysis there is no public exploit identified and no indication of confirmed active exploitation, so risk is driven primarily by the population of sites running the plugin with open or loosely controlled user registration.
Stored cross-site scripting in the Brainstorm Force Starter Templates (astra-sites) WordPress plugin, affecting all versions through 4.7.7, allows an authenticated user with only low-level privileges to plant persistent JavaScript that executes in the browser of a higher-privileged user (such as an administrator or editor) who later views the affected page. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), exploitation consumes a valid low-privilege account plus victim interaction, so it is not remote-unauthenticated and the realistic attacker population is limited to sites that permit untrusted registration or loose role assignment. There is no CISA KEV listing and no public exploit code identified at time of analysis; risk is moderate and warrants routine rather than emergency patching.
Contributor-level Insecure Direct Object Reference (IDOR) in the Starter Templates WordPress plugin (≤4.7.5) permits authenticated low-privilege users to manipulate object identifiers in plugin requests, modifying resources outside their authorized scope. Reported by Patchstack with a CVSS 4.3, the flaw is bounded to integrity-only impact - no data disclosure or availability disruption applies. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.
The Starter Templates by FancyWP plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.0.0 via the 'http_request_host_is_external' filter. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates - Elementor, WordPress & Beaver Builder Templates.2.4. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable. No vendor patch available.
On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the edit_posts capability, which includes Contributor-level users, to import blocks onto any page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Missing authorization checks in the Starter Templates (astra-sites) WordPress plugin, affecting versions through 4.7.7, allow a remote attacker holding a low-privilege account on the target site - such as a subscriber where open registration is enabled - to trigger plugin functionality that should be restricted to higher-privileged roles, resulting in low-level integrity and availability impact with no confidentiality loss (CVSS 5.4). The flaw is a CWE-862 incorrectly configured access-control level, requiring no user interaction and no special complexity, but it cannot be reached by a fully unauthenticated visitor (CVSS vector PR:L). At the time of analysis there is no public exploit identified and no indication of confirmed active exploitation, so risk is driven primarily by the population of sites running the plugin with open or loosely controlled user registration.
Stored cross-site scripting in the Brainstorm Force Starter Templates (astra-sites) WordPress plugin, affecting all versions through 4.7.7, allows an authenticated user with only low-level privileges to plant persistent JavaScript that executes in the browser of a higher-privileged user (such as an administrator or editor) who later views the affected page. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), exploitation consumes a valid low-privilege account plus victim interaction, so it is not remote-unauthenticated and the realistic attacker population is limited to sites that permit untrusted registration or loose role assignment. There is no CISA KEV listing and no public exploit code identified at time of analysis; risk is moderate and warrants routine rather than emergency patching.
Contributor-level Insecure Direct Object Reference (IDOR) in the Starter Templates WordPress plugin (≤4.7.5) permits authenticated low-privilege users to manipulate object identifiers in plugin requests, modifying resources outside their authorized scope. Reported by Patchstack with a CVSS 4.3, the flaw is bounded to integrity-only impact - no data disclosure or availability disruption applies. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.
The Starter Templates by FancyWP plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.0.0 via the 'http_request_host_is_external' filter. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates - Elementor, WordPress & Beaver Builder Templates.2.4. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable. No vendor patch available.
On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the edit_posts capability, which includes Contributor-level users, to import blocks onto any page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.