Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/287abdef-24de-4e1b-a673-59cd37411bf6?source=cve - https://plugins.trac.wordpress.org/browser/themify-store-locator/tags/1.1.9/includes/init.php#L142 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3206624%40themify-store-locator&new=3206624%40themify-store-locator&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12415 State: PUBLISHED Published: 2025-01-31T11:11:09.899Z Last Updated: 2025-02-18T18:42:10.161Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: quantumcloud Products: AI Infographic Maker Problem Types: CWE-94 Description: The The AI Infographic Maker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.9.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
authenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0aa21fad-4dd0-4ccd-a325-de3532a6ffaf?source=cve - https://plugins.trac.wordpress.org/browser/infographic-and-list-builder-ilist/trunk/embed/qcld-embed-link.php#L46 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3210519%40infographic-and-list-builder-ilist&new=3210519%40infographic-and-list-builder-ilist&sfp_email=&sfph_mail=#file1030 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3227956%40infographic-and-list-builder-ilist&new=3227956%40infogr
ress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3227956%40infographic-and-list-builder-ilist&new=3227956%40infographic-and-list-builder-ilist&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12416 State: PUBLISHED Published: 2025-01-07T03:21:56.673Z Last Updated: 2025-01-07T16:28:18.823Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: delabon Products: Live Sales Notification for Woocommerce – Woomotiv Problem Types: CWE-89 Description: The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to SQL Injection via the 'woomotiv_seen_products_.*' cookie in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries
aration on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/82016921-4efb-47b4-9a75-45cae4ad80f9?source=cve - https://plugins.trac.wordpress.org/browser/woomotiv/trunk/lib/functions.php#L521 - https://plugins.trac.wordpress.org/browser/woomotiv/trunk/lib/functions.php#L614 - https://plugins.trac.wordpress.org/browser/woomotiv/trunk/lib/functions.php#693
CVE ID: CVE-2024-12417 State: PUBLISHED Published: 2024-12-13T08:24:51.341Z Last Updated: 2024-12-16T16:41:33.641Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: quantumcloud Products: Simple Link Directory Problem Types: CWE-94 Description: The The Simple Link Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.4.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References
unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b7112840-f190-4867-9408-c96408f28b7a?source=cve - https://plugins.trac.wordpress.org/browser/simple-link-directory/trunk/embed/qcopd-embed-link.php#L17 - https://plugins.trac.wordpress.org/changeset/3206971/simple-link-directory/trunk/embed/qcopd-embed-link.php
CVE ID: CVE-2024-12419 State: PUBLISHED Published: 2025-01-07T03:21:55.752Z Last Updated: 2025-01-07T16:28:40.862Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: tobias_conrad Products: Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler Problem Types: CWE-94 Description: The The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to ex
es not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This functionality is also vulnerable to Reflected Cross-Site Scripting. Version 1.7.0 patched the Reflected XSS issue, however, the arbitrary shortcode execution issue remains. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5d78ea71-5886-488e-a660-0dc25129a8b6?source=cve - https://plugins.trac.wordpress.org/browser/cf7-styler/tags/1.6.9/admin/class-cf7-customizer-admin.php#L405 - https://plugins.trac.wordpress.org/browser/cf7-styler/tags/1.6.9/admin/class-cf7-customizer-
customizer-admin.php#L405 - https://plugins.trac.wordpress.org/browser/cf7-styler/tags/1.6.9/admin/class-cf7-customizer-admin.php#L300 - https://plugins.trac.wordpress.org/browser/cf7-styler/tags/1.6.9/admin/class-cf7-customizer-admin.php#L295
CVE ID: CVE-2024-12420 State: PUBLISHED Published: 2024-12-13T08:24:49.126Z Last Updated: 2024-12-16T16:41:57.690Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: amauric Products: WPMobile.App — Android and iOS Mobile Application Problem Types: CWE-94 Description: The The WPMobile.App — Android and iOS Mobile Application plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.52. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional
e running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3ad03e3f-fb3e-4a80-9eea-d24459ed62b8?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3207040%40wpappninja&new=3207040%40wpappninja&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12421 State: PUBLISHED Published: 2024-12-13T08:24:49.496Z Last Updated: 2024-12-16T16:41:47.531Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: elliotvs Products: Coupon Affiliates – Affiliate Plugin for WooCommerce Problem Types: CWE-94 Description: The The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.16.7.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
alue before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This functionality is also vulnerable to Reflected Cross-Site Scripting. The Cross-Site Scripting was patched in version 5.16.7.1, while the arbitrary shortcode execution was patched in 5.16.7.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/66b669ce-142a-48b8-9adf-620657c2db74?source=cve - https://plugins.trac.wordpress.org/browser/woo-coupon-usage/tags/5.16.7/inc/functions/functions-user-coupons.php#L491 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3207070%40
ions-user-coupons.php#L491 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3207070%40woo-coupon-usage&new=3207070%40woo-coupon-usage&sfp_email=&sfph_mail=#file7
CVE ID: CVE-2024-12422 State: PUBLISHED Published: 2024-12-14T05:34:16.566Z Last Updated: 2024-12-16T17:48:27.982Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: xylus Products: Import Eventbrite Events Problem Types: CWE-79 Description: The Import Eventbrite Events plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. A
ipts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f799db97-ca61-439d-94ec-a44270d1cd07?source=cve - https://plugins.trac.wordpress.org/browser/import-eventbrite-events/tags/1.7.3/templates/admin/import-eventbrite-events-history.php#L16 - https://plugins.trac.wordpress.org/browser/import-eventbrite-events/tags/1.7.3/templates/admin/import-eventbrite-events-history.php#L17 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3207381%40import-eventbrite-events&new=3207381%40im
ins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3207381%40import-eventbrite-events&new=3207381%40import-eventbrite-events&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12423 State: PUBLISHED Published: 2025-01-15T09:25:54.881Z Last Updated: 2025-01-15T14:37:09.380Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: scottpaterson Products: Contact Form 7 Redirect & Thank You Page Problem Types: CWE-79 Description: The Contact Form 7 Redirect & Thank You Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post' parameter in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing
ed attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9d67965c-f8f3-4868-a261-81cfc80dbcb3?source=cve - https://plugins.trac.wordpress.org/browser/cf7-redirect-thank-you-page/tags/1.0.7/includes/admin/tabs_page.php#L87 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3220810%40cf7-redirect-thank-you-page&new=3220810%40cf7-redirect-thank-you-page&sfp_email=&sfph_mail=#file19
CVE ID: CVE-2024-12424 State: REJECTED Published: N/A Last Updated: 2025-02-25T14:41:13.851Z Description: No description available.
CVE ID: CVE-2024-12425 State: PUBLISHED Published: 2025-01-07T11:15:08.251Z Last Updated: 2025-11-03T20:36:38.438Z Vendors: The Document Foundation Products: LibreOffice Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traversal. An attacker can write to arbitrary locations, albeit suffixed with ".ttf", by supplying a file in a format that supports embedded font files. This issue affects LibreOffice: from 24.8 before < 24.8.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.libreoffice.org/about-us/sec
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.libreoffice.org/about-us/security/advisories/cve-2024-12425
CVE ID: CVE-2024-12426 State: PUBLISHED Published: 2025-01-07T12:22:32.991Z Last Updated: 2025-11-03T20:36:39.840Z Vendors: The Document Foundation Products: LibreOffice Problem Types: CWE-200 Description: Exposure of Environmental Variables and arbitrary INI file values to an Unauthorized Actor vulnerability in The Document Foundation LibreOffice. URLs could be constructed which expanded environmental variables or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. This issue affects LibreOffice: from 24.8 before < 24.8.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referen
reOffice: from 24.8 before < 24.8.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.libreoffice.org/about-us/security/advisories/cve-2024-12426
CVE ID: CVE-2024-12427 State: PUBLISHED Published: 2025-01-16T09:39:15.810Z Last Updated: 2025-01-16T14:24:04.617Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: mondula2016 Products: Multi Step Form Problem Types: CWE-862 Description: The Multi Step Form plugin for WordPress is vulnerable to unauthorized limited file upload due to a missing capability check on the fw_upload_file AJAX action in all versions up to, and including, 1.7.23. This makes it possible for unauthenticated attackers to upload limited file types such as images. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f0a
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f0a31fee-ccc2-4c3b-b198-6cb750188113?source=cve - https://plugins.trac.wordpress.org/browser/multi-step-form/tags/1.7.22/includes/lib/msf-shortcode.class.php#L100 - https://plugins.trac.wordpress.org/browser/multi-step-form/tags/1.7.22/includes/lib/msf-shortcode.class.php#L30 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3219723%40multi-step-form&new=3219723%40multi-step-form&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12428 State: PUBLISHED Published: 2024-12-25T04:22:04.152Z Last Updated: 2024-12-26T19:57:03.830Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: peterschulznl Products: WP Data Access – App, Table, Form and Chart Builder plugin Problem Types: CWE-89 Description: The WP Data Access – App, Table, Form and Chart Builder plugin plugin for WordPress is vulnerable to SQL Injection via the 'order[user_login][dir]' parameter in all versions up to, and including, 5.5.22 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append
lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a1708d6e-14f5-418f-81eb-f9269159b5b1?source=cve - https://plugins.trac.wordpress.org/changeset/3210150/wp-data-access/tags/5.5.23/WPDataAccess/Data_Tables/WPDA_Data_Tables.php?old=3206494&old_path=wp-data-access%2Ftags%2F5.5.22%2FWPDataAccess%2FData_Tables%2FWPDA_Data_Tables.php
CVE ID: CVE-2024-12429 State: PUBLISHED Published: 2025-01-07T16:53:41.269Z Last Updated: 2025-11-03T21:52:21.557Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: ABB Products: AC500 V3 Problem Types: CWE-22 Description: An attacker who successfully exploited these vulnerabilities could grant read access to files. A vulnerability exists in the AC500 V3 version mentioned. A successfully authenticated attacker can use this vulnerability to read system wide files and configuration All AC500 V3 products (PM5xxx) with firmware version earlier than 3.8.0 are affected by this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container:
an 3.8.0 are affected by this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=3ADR011377&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2024-12430 State: PUBLISHED Published: 2025-01-07T16:28:41.952Z Last Updated: 2025-11-03T21:52:23.053Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: AC500 V3 Problem Types: CWE-280 Description: An attacker who successfully exploited these vulnerabilities could cause enable command execution. A vulnerability exists in the AC500 V3 version mentioned. After successfully exploiting CVE-2024-12429 (directory traversal), a successfully authenticated attacker can inject arbitrary commands into a specifically crafted file, which then will be executed by root user. All AC500 V3 products (PM5xxx) with firmware version earlier than 3.8.0 are aff
hich then will be executed by root user. All AC500 V3 products (PM5xxx) with firmware version earlier than 3.8.0 are affected by this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=3ADR011377&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2024-12431 State: PUBLISHED Published: 2025-01-08T20:30:42.896Z Last Updated: 2025-02-12T17:12:59.442Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-862 Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 15.5 before 17.5.5, 17.6 before 17.6.3, and 17.7 before 17.7.1, in which unauthorized users could manipulate the status of issues in public projects. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/508742 - https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/#unauthorized-
itlab/-/issues/508742 - https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/#unauthorized-user-can-manipulate-status-of-issues-in-public-projects - https://hackerone.com/reports/2877710
CVE ID: CVE-2024-12432 State: PUBLISHED Published: 2024-12-18T03:22:00.850Z Last Updated: 2024-12-18T16:35:53.912Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wpclever Products: WPC Shop as a Customer for WooCommerce Problem Types: CWE-330 Description: The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to account takeover and privilege escalation in all versions up to, and including, 1.2.8. This is due to the 'generate_key' function not producing a sufficiently random value. This makes it possible for authenticated attackers, with Subscriber-level access and above, to log in as site administrators, granted they have triggered the
ted attackers, with Subscriber-level access and above, to log in as site administrators, granted they have triggered the ajax_login() function which generates a unique key that can be used to log in. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/048625e8-10b7-418d-a13b-329f1d7e0171?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3208130%40wpc-shop-as-customer&new=3208130%40wpc-shop-as-customer&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12433 State: PUBLISHED Published: 2025-03-20T10:10:08.725Z Last Updated: 2025-03-20T18:30:55.679Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: infiniflow Products: infiniflow/ragflow Problem Types: CWE-502 Description: A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey 'authkey=b'infiniflow-token4kevinhu'' which can be easily fetched by attackers to join the group communication without restrictions. Additionally, the server processes incoming data using pickle deserialization via `pickle.loads()` on `connection.recv()`, making it vulnerable to remo
ses incoming data using pickle deserialization via `pickle.loads()` on `connection.recv()`, making it vulnerable to remote code execution. This issue is fixed in version 0.14.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/8a1465af-09e4-42af-9e54-0b70e7c87499 - https://github.com/infiniflow/ragflow/commit/49494d4e3c8f06a5e52cf1f7cce9fa03cadcfbf6
CVE ID: CVE-2024-12434 State: PUBLISHED Published: 2025-02-26T03:27:22.029Z Last Updated: 2025-02-26T15:34:27.912Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SureCart Products: SureMembers Problem Types: CWE-200 Description: The SureMembers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.6 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive data including restricted content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f33e0019-e52e-464b-843d-a034e5205b2e?source=cve - https:
es: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f33e0019-e52e-464b-843d-a034e5205b2e?source=cve - https://suremembers.com/whats-new/
CVE ID: CVE-2024-12435 State: PUBLISHED Published: 2025-01-07T04:22:23.499Z Last Updated: 2025-01-07T16:17:25.311Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: a3rev Products: Compare Products for WooCommerce Problem Types: CWE-79 Description: The Compare Products for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘s_feature’ parameter in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as
ect arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f74c419a-56de-4190-925d-876d32f712e1?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-compare-products/trunk/admin/classes/class-wc-compare-fields.php#L392 - https://plugins.trac.wordpress.org/browser/woocommerce-compare-products/trunk/admin/classes/class-wc-compare-fields.php#L397
CVE ID: CVE-2024-12436 State: PUBLISHED Published: 2025-01-27T06:00:06.330Z Last Updated: 2025-01-27T20:06:08.471Z Vendors: Unknown Products: WP Customer Area Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3345a403-f62c-40c1-b7ae-bc947591e02a/