UDesign Core vulnerabilities

The UDesign Core plugin in versions up to and including 4.15.0 contains a Subscriber-level SQL Injection vulnerability. The flaw allows injection of malicious SQL queries into the database.

The UDesign Core plugin by AndonDesign contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects UDesign Core from n/a through <= 4.14.1.

The UDesign Core plugin by AndonDesign is vulnerable to Missing Authorization in versions from n/a through 4.14.0. This issue allows exploiting incorrectly configured access control security levels.