Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11339 State: PUBLISHED Published: 2024-12-06T08:24:58.973Z Last Updated: 2024-12-06T17:31:16.799Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: devnethr Products: Smart PopUp Blaster Problem Types: CWE-79 Description: The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user
ers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e10f391a-6663-4222-8266-ab911c588b76?source=cve - https://plugins.trac.wordpress.org/browser/smart-popup-blaster/trunk/admin/shortcodes.php
CVE ID: CVE-2024-11341 State: PUBLISHED Published: 2024-12-05T09:23:05.803Z Last Updated: 2024-12-05T11:13:24.803Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ecolosites Products: Simple Redirection Problem Types: CWE-352 Description: The Simple Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the settings_page() function. This makes it possible for unauthenticated attackers to update the plugin's settings and redirect all site visitors via a forged request granted they can trick a site administrator into performing an action suc
edirect all site visitors via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0fa84344-8672-43e1-a430-094021f7366f?source=cve - https://plugins.trac.wordpress.org/changeset/3201717/
CVE ID: CVE-2024-11342 State: PUBLISHED Published: 2024-11-26T03:25:38.226Z Last Updated: 2024-11-26T14:09:26.330Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: sanskritforum Products: Skt NURCaptcha Problem Types: CWE-352 Description: The Skt NURCaptcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. This is due to missing or incorrect nonce validation in the skt-nurc-admin.php file. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking o
eb scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/96e47918-7848-407a-8f77-dbbfeb17029d?source=cve - https://plugins.trac.wordpress.org/browser/skt-nurcaptcha/trunk/skt-nurc-admin.php - https://plugins.trac.wordpress.org/browser/skt-nurcaptcha/trunk/skt-nurc-admin.php?rev=3195583 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3195583%40skt-nurcaptcha&new=3195583%40skt-nurcaptcha&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11343 State: PUBLISHED Published: 2025-02-12T15:46:49.360Z Last Updated: 2025-02-12T19:09:39.955Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: Progress Software Products: Telerik Document Processing Libraries Problem Types: CWE-22 Description: In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), unzipping an archive can lead to arbitrary file system access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.telerik.com/devtools/document-processing/knowledge-base/kb-security-path-traversal-cve-2024-11343
CVE ID: CVE-2024-11344 State: PUBLISHED Published: 2025-02-13T18:51:23.777Z Last Updated: 2025-02-13T19:19:11.784Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Lexmark Products: CX, XC, CS, MS, MX, XM, et. al. Problem Types: CWE-843 Description: A type confusion vulnerability has been identified in the Postscript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html
CVE ID: CVE-2024-11345 State: PUBLISHED Published: 2025-02-13T18:46:33.859Z Last Updated: 2025-02-13T19:19:43.200Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Lexmark International Products: CX, XC, CS, MS, MX, XM, et. al. Problem Types: CWE-787 Description: A heap-based memory vulnerability has been identified in the Postscript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html
CVE ID: CVE-2024-11346 State: PUBLISHED Published: 2025-02-13T18:54:41.167Z Last Updated: 2025-02-13T19:17:04.920Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Lexmark International Products: CX, XC, CS, MS, MX, XM, et. al. Problem Types: CWE-843 Description: : Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Lexmark International CX, XC, CS, et. Al. (Postscript interpreter modules) allows Resource Injection.This issue affects CX, XC, CS, et. Al.: from 001.001:0 through 081.231, from *.*.P001 through *.*.P233, from *.*.P001 through *.*.P759, from *.*.P001 through *.*.P836. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
from *.*.P001 through *.*.P759, from *.*.P001 through *.*.P836. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html
CVE ID: CVE-2024-11347 State: PUBLISHED Published: 2025-02-13T18:55:22.943Z Last Updated: 2025-02-13T19:09:37.473Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Lexmark International Products: CX, XC, CS, et. al. Problem Types: CWE-190 Description: Integer Overflow or Wraparound vulnerability in Lexmark International CX, XC, CS, et. Al. (Postscript interpreter modules) allows Forced Integer Overflow.The vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html
CVE ID: CVE-2024-11348 State: PUBLISHED Published: 2025-01-27T13:16:02.584Z Last Updated: 2025-01-27T19:36:28.619Z Vendors: Eura7 Products: CMSmanager Problem Types: CWE-79 Description: Eura7 CMSmanager in version 4.6 and below is vulnerable to Reflected XSS attacks through manipulation of return GET request parameter sent to a specific endpoint. The vulnerability has been fixed by a patche patch 17012022 addressing all affected versions in use. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/01/CVE-2024-11348
CVE ID: CVE-2024-11349 State: PUBLISHED Published: 2024-12-21T04:22:17.791Z Last Updated: 2024-12-28T00:51:22.860Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: scriptsbundle Products: AdForest Problem Types: CWE-288 Description: The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.6. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the sb_login_user_with_otp_fun() function. This makes it possible for unauthenticated attackers to log in as arbitrary users, including administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
kers to log in as arbitrary users, including administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f374b3d1-820b-473f-8d2b-c3267e6d23d9?source=cve - https://themeforest.net/item/adforest-classified-wordpress-theme/19481695
CVE ID: CVE-2024-11350 State: PUBLISHED Published: 2025-01-08T08:18:16.723Z Last Updated: 2025-01-08T14:07:34.745Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: scriptsbundle Products: AdForest Problem Types: CWE-640 Description: The AdForest theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.1.6. This is due to the plugin not properly validating a user's identity prior to updating their password through the adforest_reset_password() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain acc
unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4ebb766a-44e9-460c-be84-356b7403e593?source=cve - https://themeforest.net/item/adforest-classified-wordpress-theme/19481695
CVE ID: CVE-2024-11351 State: PUBLISHED Published: 2024-12-11T12:24:18.746Z Last Updated: 2024-12-11T14:37:08.633Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: tickera Products: Restrict – membership, site, content and user access restrictions for WordPress Problem Types: CWE-200 Description: The Restrict – membership, site, content and user access restrictions for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.8 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level r
possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/de982653-26b4-4a7b-a391-373362bcb834?source=cve - https://plugins.trac.wordpress.org/changeset/3201494/restricted-content
CVE ID: CVE-2024-11352 State: PUBLISHED Published: 2024-12-06T08:24:55.951Z Last Updated: 2024-12-06T17:31:23.344Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cs123 Products: TwentyTwenty Problem Types: CWE-79 Description: The TwentyTwenty plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'twentytwenty' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an in
ibutor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9f805982-1141-4e28-b28c-93483646cf99?source=cve - https://plugins.trac.wordpress.org/browser/twentytwenty/tags/1.0.1/public/class-twentytwenty.php#L77 - https://plugins.trac.wordpress.org/browser/twentytwenty/tags/1.0.1/public/class-twentytwenty.php#L271
CVE ID: CVE-2024-11353 State: PUBLISHED Published: 2024-12-07T01:45:51.585Z Last Updated: 2024-12-09T18:03:14.979Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: clicksend Products: SMS for Lead Capture Forms Problem Types: CWE-862 Description: The SMS for Lead Capture Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_message() function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary messages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfe
above, to delete arbitrary messages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a0c68bb6-77a2-4232-923a-37f2c0327743?source=cve - https://plugins.trac.wordpress.org/browser/clicksend-lead-capture-form/trunk/clicksend-SMS-form-settings.php#L54 - https://plugins.trac.wordpress.org/browser/clicksend-lead-capture-form/trunk/clicksend-SMS-form-settings.php#L63
CVE ID: CVE-2024-11354 State: PUBLISHED Published: 2024-11-21T02:06:28.576Z Last Updated: 2024-11-21T11:40:11.564Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: codelizarplugs Products: Ultimate YouTube Video & Shorts Player With Vimeo Problem Types: CWE-862 Description: The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the del_ytsingvid() function in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete single playlists. Additional Analyst Notes: - CISA ADP
ted attackers, with Subscriber-level access and above, to delete single playlists. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/30c99510-fd57-4268-8e35-6f7e6f912b7e?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-youtube-video-player/trunk/admin/admin.php#L17 - https://plugins.trac.wordpress.org/browser/ultimate-youtube-video-player/trunk/admin/inc/handler/delsingvid.php#L8
CVE ID: CVE-2024-11355 State: PUBLISHED Published: 2024-11-22T05:33:40.599Z Last Updated: 2024-11-22T11:34:08.980Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: codelizarplugs Products: Ultimate YouTube Video & Shorts Player With Vimeo Problem Types: CWE-862 Description: The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_setting() function in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view settings for playlists. Additional Analyst Notes: - CISA ADP Vuln
ckers, with Subscriber-level access and above, to view settings for playlists. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4119178c-9227-4623-a962-e0f103612c75?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-youtube-video-player/trunk/admin/admin.php#L18 - https://plugins.trac.wordpress.org/browser/ultimate-youtube-video-player/trunk/admin/inc/handler/getsetting.php#L1
CVE ID: CVE-2024-11356 State: PUBLISHED Published: 2025-01-06T06:00:05.058Z Last Updated: 2025-01-06T13:39:03.534Z Vendors: Unknown Products: tourmaster Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d70df54e-e99e-4539-9fd9-002c0642137e/
CVE ID: CVE-2024-11357 State: PUBLISHED Published: 2025-01-02T06:00:10.840Z Last Updated: 2025-01-06T20:28:18.246Z Vendors: Unknown Products: goodlayers-core Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The goodlayers-core WordPress plugin before 2.0.10 does not sanitise and escape some of its settings, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7e8c6816-9b7a-43e8-9508-789c8051dd9b/
CVE ID: CVE-2024-11358 State: PUBLISHED Published: 2024-12-16T16:20:27.908Z Last Updated: 2024-12-16T18:09:54.764Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost Android Mobile Apps versions <=2.21.0 fail to properly configure file providers which allows an attacker with local access to access files via file provider. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-11359 State: PUBLISHED Published: 2024-12-12T05:24:20.146Z Last Updated: 2024-12-12T14:54:47.337Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: photonicgnostic Products: Library Bookshelves Problem Types: CWE-79 Description: The Library Bookshelves plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Anal
that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/253dcecb-b88d-423c-8e74-1d59581e2893?source=cve - https://plugins.trac.wordpress.org/browser/library-bookshelves/tags/5.8/class-bookshelves-settings.php#L171 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3204540%40library-bookshelves&new=3204540%40library-bookshelves&sfp_email=&sfph_mail=#file1
CVE ID: CVE-2024-11360 State: PUBLISHED Published: 2024-11-21T02:06:37.958Z Last Updated: 2024-11-21T11:40:10.261Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: husobj Products: Page Parts Problem Types: CWE-79 Description: The Page Parts plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.4.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP
an successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/72f3416a-4d5e-4b95-8f83-7b9440f9e9df?source=cve - https://plugins.trac.wordpress.org/browser/page-parts/tags/1.4.3/admin/documentation/index.php#L44 - https://plugins.trac.wordpress.org/browser/page-parts/tags/1.4.3/admin/documentation/getting-started.php#L36 - https://plugins.trac.wordpress.org/browser/page-parts/tags/1.4.3/admin/documentation/getting-started.php#L43 - https://plugins.trac.wordpress.org/browser/page-parts/tags/1.4.3/admin/documentation/getting-started.php#L51 - https://pl
ttps://plugins.trac.wordpress.org/browser/page-parts/tags/1.4.3/admin/documentation/getting-started.php#L51 - https://plugins.trac.wordpress.org/browser/page-parts/tags/1.4.3/admin/documentation/getting-started.php#L57 - https://plugins.trac.wordpress.org/browser/page-parts/tags/1.4.3/admin/documentation/getting-started.php#L65 - https://plugins.trac.wordpress.org/browser/page-parts/tags/1.4.3/admin/documentation/getting-started.php#L70
CVE ID: CVE-2024-11361 State: PUBLISHED Published: 2024-11-23T04:32:22.674Z Last Updated: 2024-11-23T13:18:22.754Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: algoritmika Products: PDF Invoices & Packing Slips Generator for WooCommerce Problem Types: CWE-79 Description: The PDF Invoices & Packing Slips Generator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user i
unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f01ecce1-cff1-41a6-ae90-3ace8b2e3a36?source=cve - https://plugins.trac.wordpress.org/browser/pdf-invoicing-for-woocommerce/tags/2.2.1/includes/class-alg-wc-pdf-invoicing-admin.php#L244 - https://plugins.trac.wordpress.org/browser/pdf-invoicing-for-woocommerce/tags/2.2.1/includes/class-alg-wc-pdf-invoicing-admin.php#L213 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old
s-alg-wc-pdf-invoicing-admin.php#L213 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3194265%40pdf-invoicing-for-woocommerce&new=3194265%40pdf-invoicing-for-woocommerce&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11362 State: PUBLISHED Published: 2024-11-23T03:25:49.887Z Last Updated: 2024-11-23T13:18:20.792Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: peachpay Products: Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net Problem Types: CWE-79 Description: The Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.112.0. This makes it possible for unauthenticated attackers to inject arbitrary we
all versions up to, and including, 1.112.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8bcd44c3-75e6-453f-a9e7-3a547eba55e1?source=cve - https://plugins.trac.wordpress.org/browser/peachpay-for-woocommerce/tags/1.107.0/core/modules/field-editor/admin/settings-field-editor.php#L242 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3193722%40peachpay-for-woocommerce&new=3193722%40peachpa
rac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3193722%40peachpay-for-woocommerce&new=3193722%40peachpay-for-woocommerce&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11363 State: PUBLISHED Published: 2025-01-07T04:22:15.755Z Last Updated: 2025-01-07T16:21:45.617Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: outtheboxthemes Products: Same but Different – Related Posts by Taxonomy Problem Types: CWE-79 Description: The Same but Different – Related Posts by Taxonomy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick