Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-1385 State: PUBLISHED Published: 2024-04-06T03:24:43.707Z Last Updated: 2024-08-01T18:40:20.409Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: andypotanin Products: WP-Stateless – Google Cloud Storage Problem Types: CWE-862 Missing Authorization Description: The WP-Stateless – Google Cloud Storage plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the dismiss_notices() function in all versions up to, and including, 3.4.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary option values to the current time, which may completely take
ith subscriber-level access and above, to update arbitrary option values to the current time, which may completely take a site offline. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9a475017-ef45-4614-bdc6-ddd619b8caf3?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3035169%40wp-stateless&new=3035169%40wp-stateless&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1386 State: PUBLISHED Published: 2024-05-02T16:52:17.385Z Last Updated: 2024-08-01T18:40:20.436Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mailerlite Products: MailerLite – Signup forms (official) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions 1.5.0 to 1.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level
output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7f34f4a6-9092-4e67-8a1e-7c60edde0b2a?source=cve - https://plugins.trac.wordpress.org/browser/official-mailerlite-sign-up-forms/tags/1.7.3/src/Views/InvalidForm.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3070584%40official-mailerlite-sign-up-forms%2Ftrunk&old=30458
ordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3070584%40official-mailerlite-sign-up-forms%2Ftrunk&old=3045803%40official-mailerlite-sign-up-forms%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1387 State: PUBLISHED Published: 2024-04-09T18:59:14.618Z Last Updated: 2024-08-21T21:13:53.241Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: thehappymonster Products: Happy Addons for Elementor Problem Types: CWE-862 Missing Authorization Description: The Happy Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to insufficient authorization on the duplicate_thing() function in all versions up to, and including, 3.10.4. This makes it possible for attackers, with contributor-level access and above, to clone arbitrary posts (including private and password protected ones) which may lead to information
ccess and above, to clone arbitrary posts (including private and password protected ones) which may lead to information exposure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aff10d5a-a2d0-461a-b52b-a25b647eaab4?source=cve - https://plugins.trac.wordpress.org/browser/happy-elementor-addons/trunk/classes/clone-handler.php#L58 - https://plugins.trac.wordpress.org/changeset/3064385/happy-elementor-addons/trunk/classes/clone-handler.php?contextall=1&old=3044937&old_path=%2Fhappy-elementor-addons%2Ftrunk%2Fclasses%2Fclone-handler.php
CVE ID: CVE-2024-1388 State: PUBLISHED Published: 2024-02-28T06:46:47.676Z Last Updated: 2024-08-08T18:48:49.262Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpmoose Products: Yuki Problem Types: CWE-862 Missing Authorization Description: The Yuki theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_customizer_options() function in all versions up to, and including, 1.3.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to reset the theme's settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
the theme's settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d964e0ef-f14e-463b-bf4e-3f25788df03c?source=cve - https://themes.trac.wordpress.org/changeset/217428/yuki/1.3.14/inc/extensions/class-reset-extension.php
CVE ID: CVE-2024-1389 State: PUBLISHED Published: 2024-02-20T18:56:46.095Z Last Updated: 2025-04-24T15:02:56.401Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: iovamihai Products: Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Problem Types: CWE-862 Missing Authorization Description: The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pms_stripe_connect_handle_authorization_return function in all versions up to, and including, 2.11.1. This makes it
the pms_stripe_connect_handle_authorization_return function in all versions up to, and including, 2.11.1. This makes it possible for unauthenticated attackers to change the Stripe payment keys. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cd5f5861-5be4-456d-915d-bafb7bff2110?source=cve - https://plugins.trac.wordpress.org/browser/paid-member-subscriptions/trunk/includes/gateways/stripe/admin/functions-admin-connect.php#L11 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3034497%40paid-member-subscriptions%2Ftrunk&old=3031453%40paid-member-subscriptions%2F
p_email=&sfph_mail=&reponame=&new=3034497%40paid-member-subscriptions%2Ftrunk&old=3031453%40paid-member-subscriptions%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1390 State: PUBLISHED Published: 2024-02-20T18:56:19.872Z Last Updated: 2024-08-08T18:52:47.596Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: iovamihai Products: Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Problem Types: CWE-862 Missing Authorization Description: The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the creating_pricing_table_page function in all versions up to, and including, 2.11.1. This makes it possible for authe
the creating_pricing_table_page function in all versions up to, and including, 2.11.1. This makes it possible for authenticated attackers, with subscriber access or higher, to create pricing tables. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/10f00859-3adf-40ff-8f33-827bbb1f62df?source=cve - https://plugins.trac.wordpress.org/browser/paid-member-subscriptions/trunk/includes/admin/class-admin-subscription-plans.php#L477 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3034497%40paid-member-subscriptions%2Ftrunk&old=3031453%40paid-member-subscriptions%2Ftru
mail=&sfph_mail=&reponame=&new=3034497%40paid-member-subscriptions%2Ftrunk&old=3031453%40paid-member-subscriptions%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1391 State: PUBLISHED Published: 2024-03-13T15:27:06.944Z Last Updated: 2024-08-01T18:40:20.574Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: webtechstreet Products: Elementor Addon Elements Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eae_custom_overlay_switcher’ attribute of the Thumbnail Slider widget in all versions up to, and including, 1.12.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contr
e to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/977bab12-969d-4b15-9942-2b17c8541f61?source=cve - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.12.12/modules/bg-slider/module.php#L255 - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.13/modules/bg-slider/mo
55 - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.13/modules/bg-slider/module.php#L255
CVE ID: CVE-2024-1392 State: PUBLISHED Published: 2024-03-13T15:26:41.744Z Last Updated: 2024-08-01T18:40:20.396Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: webtechstreet Products: Elementor Addon Elements Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button1_icon' attribute of the Dual Button widget in all versions up to, and including, 1.12.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level
ient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/33d7dc4d-bb41-456a-bd1a-37d8f2aada30?source=cve - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.12.12/modules/dual-button/widgets/dual-button.php#L885 - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.13/modules/dual-butto
L885 - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.13/modules/dual-button/widgets/dual-button.php#L885
CVE ID: CVE-2024-1393 State: PUBLISHED Published: 2024-03-13T15:27:12.194Z Last Updated: 2024-08-01T18:40:20.532Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: webtechstreet Products: Elementor Addon Elements Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_align' attribute of the Content Switcher widget in all versions up to, and including, 1.12.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-lev
ficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bb0888d6-30e6-4957-b270-1968eace462e?source=cve - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.12.12/modules/content-switcher/skins/skin-3.php#L39 - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.13/modules/content-sw
#L39 - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.13/modules/content-switcher/skins/skin-3.php#L39
CVE ID: CVE-2024-1394 State: PUBLISHED Published: 2024-03-21T12:16:38.790Z Last Updated: 2025-11-13T17:36:06.871Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9, Red Hat Developer Tools, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat OpenS
ainer Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1 for RHEL 8, Red Hat OpenStack Platform 17.1 for RHEL 9, RHODF-4.16-RHEL-9, NBDE Tang Server, OpenShift Developer Tools and Services, OpenShift Pipelines, OpenShift Serverless, Red Hat Ansible Automation Platform 1.2, Red Hat Ansible Automation Platform 2, Red Hat Certification for Red Hat Enterprise Linux 8, Red Hat Certification Program for Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4, Red Hat Openshift Container Storage 4, Red Hat OpenShift Dev Spaces, Red Hat OpenShift G
OpenShift Container Platform 4, Red Hat Openshift Container Storage 4, Red Hat OpenShift Dev Spaces, Red Hat OpenShift GitOps, Red Hat OpenShift on AWS, Red Hat OpenShift Virtualization 4, Red Hat OpenStack Platform 16.1, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0, Red Hat Service Interconnect 1, Red Hat Software Collections, Red Hat Storage 3 Problem Types: CWE-401 Description: A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey​ and ctx​. That func
ory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey​ and ctx​. That function uses named return parameters to free pkey​ and ctx​ if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey​ and ctx​ will be nil inside the deferred function that should free them. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:1462 - https://access.redhat.com/errata/RHSA-2024:1468 - https://access.redhat.com/errata/RHSA-2024:1472 - https://access
462 - https://access.redhat.com/errata/RHSA-2024:1468 - https://access.redhat.com/errata/RHSA-2024:1472 - https://access.redhat.com/errata/RHSA-2024:1501 - https://access.redhat.com/errata/RHSA-2024:1502 - https://access.redhat.com/errata/RHSA-2024:1561 - https://access.redhat.com/errata/RHSA-2024:1563 - https://access.redhat.com/errata/RHSA-2024:1566 - https://access.redhat.com/errata/RHSA-2024:1567 - https://access.redhat.com/errata/RHSA-2024:1574 - https://access.redhat.com/errata/RHSA-2024:1640 - https://access.redhat.com/errata/RHSA-2024:1644 - https://access.redhat.com/errata/RHSA-2024:1646 - https://access.redhat.com/errata/RHSA-2024:1763 - https://access.redhat.com/errata/RHSA-2024:1
m/errata/RHSA-2024:1646 - https://access.redhat.com/errata/RHSA-2024:1763 - https://access.redhat.com/errata/RHSA-2024:1897 - https://access.redhat.com/errata/RHSA-2024:2562 - https://access.redhat.com/errata/RHSA-2024:2568 - https://access.redhat.com/errata/RHSA-2024:2569 - https://access.redhat.com/errata/RHSA-2024:2729 - https://access.redhat.com/errata/RHSA-2024:2730 - https://access.redhat.com/errata/RHSA-2024:2767 - https://access.redhat.com/errata/RHSA-2024:3265 - https://access.redhat.com/errata/RHSA-2024:3352 - https://access.redhat.com/errata/RHSA-2024:4146 - https://access.redhat.com/errata/RHSA-2024:4371 - https://access.redhat.com/errata/RHSA-2024:4378 - https://access.redhat.co
s://access.redhat.com/errata/RHSA-2024:4371 - https://access.redhat.com/errata/RHSA-2024:4378 - https://access.redhat.com/errata/RHSA-2024:4379 - https://access.redhat.com/errata/RHSA-2024:4502 - https://access.redhat.com/errata/RHSA-2024:4581 - https://access.redhat.com/errata/RHSA-2024:4591 - https://access.redhat.com/errata/RHSA-2024:4672 - https://access.redhat.com/errata/RHSA-2024:4699 - https://access.redhat.com/errata/RHSA-2024:4761 - https://access.redhat.com/errata/RHSA-2024:4762 - https://access.redhat.com/errata/RHSA-2024:4960 - https://access.redhat.com/errata/RHSA-2024:5258 - https://access.redhat.com/errata/RHSA-2024:5634 - https://access.redhat.com/errata/RHSA-2024:7262 - http
HSA-2024:5258 - https://access.redhat.com/errata/RHSA-2024:5634 - https://access.redhat.com/errata/RHSA-2024:7262 - https://access.redhat.com/errata/RHSA-2025:7118 - https://access.redhat.com/security/cve/CVE-2024-1394 - https://bugzilla.redhat.com/show_bug.cgi?id=2262921 - https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136 - https://github.com/golang-fips/openssl/security/advisories/GHSA-78hx-gp6g-7mj6 - https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f - https://pkg.go.dev/vuln/GO-2024-2660 - https://vuln.go.dev/ID/GO-2024-2660.json
CVE ID: CVE-2024-1395 State: PUBLISHED Published: 2024-05-03T13:24:26.606Z Last Updated: 2024-08-01T18:40:20.595Z Vendors: Arm Ltd Products: Arm 5th Gen GPU Architecture Kernel Driver Problem Types: CWE-416 Description: Use After Free vulnerability in Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. If the system’s memory is carefully prepared by the user, then this in turn could give them access to already freed memory. This issue affects Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r47p0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://
r41p0 through r47p0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2024-1396 State: PUBLISHED Published: 2024-05-02T16:52:07.802Z Last Updated: 2024-08-01T18:40:20.436Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: averta Products: Shortcodes and extra features for Phlox theme Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_tag’ parameter in all versions up to, and including, 2.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-l
ufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/546aee7b-60a6-44bc-8664-0e917974cb6d?source=cve - https://plugins.trac.wordpress.org/browser/auxin-elements/tags/2.15.5/includes/elementor/widgets/theme-elements/site-title.php#L511 - https://plugins.trac.wordpress.org/browser/auxin-elements/tags/2.15.5/includes/elementor/widgets/theme-elements/site-ti
https://plugins.trac.wordpress.org/browser/auxin-elements/tags/2.15.5/includes/elementor/widgets/theme-elements/site-title.php#L512 - https://plugins.trac.wordpress.org/browser/auxin-elements/tags/2.15.5/includes/elementor/widgets/theme-elements/site-title.php#L513
CVE ID: CVE-2024-1397 State: PUBLISHED Published: 2024-03-12T22:32:26.001Z Last Updated: 2024-08-01T18:40:20.402Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: devitemsllc Products: HT Mega – Absolute Addons For Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on the 'titleTag' user supplied attributes. This makes it possible for authenticated
t sanitization and output escaping on the 'titleTag' user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8ac66027-14b8-4e0a-a483-c014905ef04e?source=cve - https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.4.4/htmega-blocks/src/blocks/cta/index.php#L22 - https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.4.4/htmega-blocks/src/blocks/inf
index.php#L22 - https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.4.4/htmega-blocks/src/blocks/info-box/index.php#L55 - https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.4.4/htmega-blocks/src/blocks/section-title/index.php#L89 - https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.4.4/htmega-blocks/src/blocks/team/index.php#L28 - https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.4.4/htmega-blocks/src/blocks/testimonial/index.php#L124 - https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.4.4/htmega-blocks/src/blocks/accordion-card/index.php#L17 - https://plugins.trac.wordpress.org/changese
elementor/tags/2.4.4/htmega-blocks/src/blocks/accordion-card/index.php#L17 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3048999%40ht-mega-for-elementor&new=3048999%40ht-mega-for-elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1398 State: PUBLISHED Published: 2024-03-02T12:39:58.887Z Last Updated: 2024-08-01T18:40:20.900Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: g5theme Products: Ultimate Bootstrap Elements for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘heading_title_tag’ and ’heading_sub_title_tag’ parameters in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated