Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12437 State: PUBLISHED Published: 2025-01-07T06:40:59.643Z Last Updated: 2025-01-07T16:58:51.122Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: lumiblog Products: Marketplace Items Problem Types: CWE-79 Description: The Marketplace Items plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'envato' shortcode in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesse
h contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e055c319-1aeb-4a97-98d1-3b38e61f30f0?source=cve - https://plugins.trac.wordpress.org/browser/marketplace-items/trunk/marketplace-items.php#L94 - https://wordpress.org/plugins/marketplace-items
CVE ID: CVE-2024-12438 State: PUBLISHED Published: 2025-01-07T05:23:56.544Z Last Updated: 2025-01-07T16:15:12.905Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: flickrocket Products: WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket Problem Types: CWE-79 Description: The WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'start_date’ and 'end_date' parameters in all versions up to, and including, 4.74 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages tha
n and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aa3909f6-fd2f-44e7-83b5-51c8cda4b20f?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-digital-content-delivery-with-drm-flickrocket/trunk/woocommerce-flickrocket.php#L613 - https://plugins.trac.wordpress.org/browser/woocommerce-digital-content-delivery-with-drm-flickrocket/trunk/woocommerce-flickrocket.php#L614 - https://plugins.trac.
woocommerce-digital-content-delivery-with-drm-flickrocket/trunk/woocommerce-flickrocket.php#L614 - https://plugins.trac.wordpress.org/browser/woocommerce-digital-content-delivery-with-drm-flickrocket/trunk/woocommerce-flickrocket.php#L629 - https://plugins.trac.wordpress.org/browser/woocommerce-digital-content-delivery-with-drm-flickrocket/trunk/woocommerce-flickrocket.php#L632 - https://plugins.trac.wordpress.org/browser/woocommerce-digital-content-delivery-with-drm-flickrocket/trunk/woocommerce-flickrocket.php#L655 - https://plugins.trac.wordpress.org/browser/woocommerce-digital-content-delivery-with-drm-flickrocket/trunk/woocommerce-flickrocket.php#L658
CVE ID: CVE-2024-12439 State: PUBLISHED Published: 2025-01-07T05:23:54.216Z Last Updated: 2025-01-07T16:16:04.822Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: lumiblog Products: Marketplace Items Problem Types: CWE-79 Description: The Marketplace Items plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'marketplace' shortcode in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user ac
, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/602ae805-a6a6-48bd-bd2a-00fafadfdce4?source=cve - https://plugins.trac.wordpress.org/browser/marketplace-items/trunk/marketplace-items.php - https://wordpress.org/plugins/marketplace-items/
CVE ID: CVE-2024-12440 State: PUBLISHED Published: 2025-01-07T05:23:58.291Z Last Updated: 2025-01-07T16:14:09.022Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: candifly Products: Candifly Problem Types: CWE-79 Description: The Candifly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'candifly' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pa
vel access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bf173ccd-23bc-49ec-92e0-032feae0fa4a?source=cve - https://plugins.trac.wordpress.org/browser/candifly/trunk/candifly.php - https://wordpress.org/plugins/candifly/
CVE ID: CVE-2024-12441 State: PUBLISHED Published: 2024-12-12T04:23:15.128Z Last Updated: 2024-12-12T15:46:46.457Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: shanebp Products: BP Email Assign Templates Problem Types: CWE-79 Description: The BP Email Assign Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
cripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/da81eb8b-4b38-462d-a85b-c0bad39f61a2?source=cve - https://plugins.trac.wordpress.org/browser/bp-email-assign-templates/trunk/pp-email-templates-admin.php#L297
CVE ID: CVE-2024-12442 State: PUBLISHED Published: 2025-05-09T13:55:20.669Z Last Updated: 2025-05-13T14:28:17.017Z Vendors: EnerSys Products: AMPA Problem Types: CWE-77 Description: EnerSys AMPA versions 24.04 through 24.16, inclusive, are vulnerable to command injection leading to privileged remote shell access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2025/MNDT-2025-0002.md - https://www.enersys.com/4996df/globalassets/documents/corporate/cve/enersys_cve-2024-12442-final.pdf
CVE ID: CVE-2024-12443 State: PUBLISHED Published: 2024-12-16T22:24:37.544Z Last Updated: 2024-12-17T17:30:14.022Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: crmperks Products: CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout Problem Types: CWE-79 Description: The CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'crm-perks-tickets' shortcode in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers
t input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a19e11e7-faa1-4e4d-87de-2454c4ad70f8?source=cve - https://plugins.trac.wordpress.org/browser/support-x/trunk/support-x.php#L210 - https://wordpress.org/plugins/support-x - https://plugins.trac.wordpress.org/changeset/3207849/support-x/trunk/support-x.php
CVE ID: CVE-2024-12444 State: PUBLISHED Published: 2025-01-30T13:41:55.693Z Last Updated: 2025-01-30T14:54:20.217Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: deviodigital Products: WP Dispensary Problem Types: CWE-79 Description: The WP Dispensary plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpd_menu' shortcode in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/13753c4d-1b51-4db2-a69e-523857a50e55?source=cve - https://plugins.trac.wordpress.org/browser/wp-dispensary/trunk/admin/wp-dispensary-shortcodes.php#L256 - https://wordpress.org/plugins/wp-dispensary
CVE ID: CVE-2024-12445 State: PUBLISHED Published: 2025-01-07T04:22:22.734Z Last Updated: 2025-01-07T16:17:47.211Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: rightmessage Products: RightMessage WP Problem Types: CWE-79 Description: The RightMessage WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rm_area' shortcode in all versions up to, and including, 0.9.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user access
th contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/efbbb33d-28ed-47f4-a8dd-2fc7564d9df2?source=cve - https://plugins.trac.wordpress.org/browser/rightmessage/trunk/includes/class-rightmessage.php#L45 - https://wordpress.org/plugins/rightmessage
CVE ID: CVE-2024-12446 State: PUBLISHED Published: 2024-12-14T06:45:14.359Z Last Updated: 2024-12-16T17:48:11.975Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gravitymaster97 Products: Post to Pdf Problem Types: CWE-79 Description: The Post to Pdf plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gmptp_single_post' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acc
with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2774e66c-2920-4578-9ab8-20d7dfd6bd6d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3207671%40post-to-pdf&new=3207671%40post-to-pdf&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12447 State: PUBLISHED Published: 2024-12-14T04:23:45.742Z Last Updated: 2024-12-16T20:06:13.913Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: webdeveric Products: Get Post Content Shortcode Problem Types: CWE-639 Description: The Get Post Content Shortcode plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.4 via the 'post-content' shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the content of password-protected, private, draft, and pending posts. Additional Analyst
evel access and above, to read the content of password-protected, private, draft, and pending posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c2b92091-e615-484f-b402-2e793eed214d?source=cve - https://plugins.trac.wordpress.org/browser/get-post-content-shortcode/trunk/get-post-content-shortcode.php#L106
CVE ID: CVE-2024-12448 State: PUBLISHED Published: 2024-12-14T04:23:44.119Z Last Updated: 2024-12-16T17:50:03.795Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: smusman98 Products: Posts and Products Views for WooCommerce Problem Types: CWE-79 Description: The Posts and Products Views for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'papvfwc_views' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web script
s makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a7e27a6c-8b14-459b-aba2-044f311edf9e?source=cve - https://plugins.trac.wordpress.org/browser/posts-and-products-views/trunk/posts-and-products-views-for-woocommerce.php#L169 - https://wordpress.org/plugins/posts-and-products-views
CVE ID: CVE-2024-12449 State: PUBLISHED Published: 2024-12-18T03:22:06.609Z Last Updated: 2024-12-18T16:34:34.698Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: videowhisper Products: Video Share VOD – Turnkey Video Site Builder Script Problem Types: CWE-79 Description: The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_player_html' shortcode in all versions up to, and including, 2.6.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access an
caping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b857e64c-a345-4ed3-b690-5b9d1a0cae15?source=cve - https://plugins.trac.wordpress.org/changeset/3208668/video-share-vod/trunk/video-share-vod.php
CVE ID: CVE-2024-12450 State: PUBLISHED Published: 2025-03-20T10:11:05.133Z Last Updated: 2025-04-04T08:45:39.429Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: infiniflow Products: infiniflow/ragflow Problem Types: CWE-918 Description: In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities. The function does not filter URL parameters, allowing attackers to exploit Full Read SSRF by accessing internal network addresses and viewing their content through the generated PDF files. Additionally, the lack of restrictions on the file protocol enables Arbitrary File Read, allowing attackers to read se
. Additionally, the lack of restrictions on the file protocol enables Arbitrary File Read, allowing attackers to read server files. Furthermore, the use of an outdated Chromium headless version with --no-sandbox mode enabled makes the application susceptible to Remote Code Execution (RCE) via known Chromium v8 vulnerabilities. These issues are resolved in version 0.14.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/da06360c-87c3-4ba9-be67-29f6eff9d44a - https://github.com/infiniflow/ragflow/commit/3faae0b2c2f8a26233ee1442ba04874b3406f6e9
CVE ID: CVE-2024-12451 State: PUBLISHED Published: 2025-01-30T13:42:06.194Z Last Updated: 2025-01-30T14:36:35.538Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: proxymis Products: HTML5 chat Problem Types: CWE-79 Description: The HTML5 chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'HTML5CHAT' shortcode in all versions up to, and including, 1.04 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injecte
r-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/98de0a50-8464-4ea6-bf55-add9aab2d716?source=cve - https://plugins.trac.wordpress.org/browser/html5-chat/trunk/index.php#L159
CVE ID: CVE-2024-12452 State: PUBLISHED Published: 2025-02-21T09:21:06.824Z Last Updated: 2025-02-21T15:01:45.948Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: oliverfriedmann Products: Ziggeo Problem Types: CWE-79 Description: The Ziggeo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ziggeo_event' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inject
or-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/be82095d-2b15-432e-a667-523286fa9629?source=cve - https://plugins.trac.wordpress.org/browser/ziggeo/tags/3.1/core/events.php#L52 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3242184%40ziggeo&new=3242184%40ziggeo&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12453 State: PUBLISHED Published: 2025-01-07T04:22:15.374Z Last Updated: 2025-01-07T16:21:57.488Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: uptodown Products: Uptodown APK Download Widget Problem Types: CWE-79 Description: The Uptodown APK Download Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'utd-widget' shortcode in all versions up to, and including, 0.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execu
thenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/78c2d5fc-240a-4fed-92ae-b9f84de3e119?source=cve - https://plugins.trac.wordpress.org/browser/uptodown-apk-download-widget/trunk/uptodown_wp_widget.php#L47 - https://wordpress.org/plugins/uptodown-apk-download-widget
CVE ID: CVE-2024-12454 State: PUBLISHED Published: 2024-12-18T09:22:39.803Z Last Updated: 2024-12-18T14:42:41.484Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: iovamihai Products: Affiliate Program Suite — SliceWP Affiliates Problem Types: CWE-352 Description: The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.23. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an actio
o inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/73aad911-531b-4118-9d39-27cbae75db01?source=cve - https://plugins.trac.wordpress.org/browser/slicewp/tags/1.1.23/includes/admin/settings/views/view-settings-tab-general.php#L437 - https://plugins.trac.wordpress.org/browser/slicewp/tags/1.1.23/includes/admin/settings/views/view-settings-tab-general.php#L451 - https://wordpress.org/plugins/slicewp/#developers - https://plugins.trac.wordpress.org/changeset/3207576/ - https://p
- https://wordpress.org/plugins/slicewp/#developers - https://plugins.trac.wordpress.org/changeset/3207576/ - https://plugins.trac.wordpress.org/browser/slicewp/trunk/includes/admin/settings/functions-actions-settings.php#L14
CVE ID: CVE-2024-12457 State: PUBLISHED Published: 2025-01-07T04:22:14.769Z Last Updated: 2025-01-07T16:22:10.563Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeatelier Products: Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode Problem Types: CWE-79 Description: The Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vchat' shortcode in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f
, 1.7.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7834c0be-3051-4d97-928e-cf5295c93463?source=cve - https://plugins.trac.wordpress.org/browser/chat-viber/tags/1.7.2/inc/class-custom-buttons-templates.php#L51
CVE ID: CVE-2024-12458 State: PUBLISHED Published: 2024-12-14T04:23:44.837Z Last Updated: 2024-12-16T17:49:49.209Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: devnethr Products: Smart PopUp Blaster Problem Types: CWE-79 Description: The Smart PopUp Blaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user
ers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/afd7fe73-1f24-4e47-a0c4-5a08662c4dbe?source=cve - https://plugins.trac.wordpress.org/browser/smart-popup-blaster/trunk/admin/shortcodes.php#L14 - https://wordpress.org/plugins/smart-popup-blaster