Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a388232b-a399-46a5-83e6-20c1b5df351d
CVE ID: CVE-2022-4668 State: PUBLISHED Published: 2023-01-23T14:31:26.836Z Last Updated: 2025-04-02T15:39:07.636Z Vendors: Unknown Products: Easy Appointments Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Easy Appointments WordPress plugin before 3.11.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3e43156a-b784-4066-be69-23b139
rogram Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3e43156a-b784-4066-be69-23b139aafbad
CVE ID: CVE-2022-4669 State: PUBLISHED Published: 2023-02-21T08:50:39.682Z Last Updated: 2025-03-12T16:16:52.245Z Vendors: Unknown Products: Page Builder: Live Composer Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Page Builder: Live Composer WordPress plugin before 1.5.23 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/79f011e4-3422-4307-8736-f27048796aae
CVE ID: CVE-2022-4670 State: PUBLISHED Published: 2023-02-06T19:59:43.771Z Last Updated: 2025-03-25T19:35:03.570Z Vendors: Unknown Products: PDF.js Viewer Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The PDF.js Viewer WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2a67c290-2a27-44fe-95ae-2d427e9d7548
CVE ID: CVE-2022-4671 State: PUBLISHED Published: 2023-01-30T20:31:58.853Z Last Updated: 2025-03-27T15:28:29.746Z Vendors: Unknown Products: PixCodes Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The PixCodes WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/14c83830-3207-4f92-b8f5-afd7cc93af88
CVE ID: CVE-2022-4672 State: PUBLISHED Published: 2023-01-23T14:31:25.107Z Last Updated: 2025-04-02T15:41:15.933Z Vendors: Unknown Products: WordPress Simple Shopping Cart Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WordPress Simple Shopping Cart WordPress plugin before 4.6.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/65002
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6500271f-9d1c-40ed-be58-a6cea8d1110d
CVE ID: CVE-2022-4673 State: PUBLISHED Published: 2023-01-23T14:31:30.667Z Last Updated: 2025-04-02T15:18:26.439Z Vendors: Unknown Products: Rate my Post Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Rate my Post WordPress plugin before 3.3.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1c4f379d-252a-487b-81c9-bf711ab71dff
CVE ID: CVE-2022-4674 State: PUBLISHED Published: 2023-02-06T19:59:23.911Z Last Updated: 2025-03-26T13:45:17.514Z Vendors: Unknown Products: Ibtana Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ibtana WordPress plugin before 1.1.8.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/eda64678-81ae-4be3-941e-a1e26e54029b
CVE ID: CVE-2022-4675 State: PUBLISHED Published: 2023-01-23T14:31:36.363Z Last Updated: 2025-04-02T15:45:03.491Z Vendors: Unknown Products: Mongoose Page Plugin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Mongoose Page Plugin WordPress plugin before 1.9.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/21f4cc5d-c4b4-495f-acf3-9fdf53591052
CVE ID: CVE-2022-4676 State: PUBLISHED Published: 2023-05-30T07:49:16.257Z Last Updated: 2025-01-09T19:23:32.429Z Vendors: Unknown Products: OSM Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The OSM WordPress plugin through 6.01 does not validate and escape some of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1df3c17c-990d-4074-b1d5-b26da880d88e
CVE ID: CVE-2022-4677 State: PUBLISHED Published: 2023-02-06T19:59:40.495Z Last Updated: 2025-03-25T20:12:16.710Z Vendors: Unknown Products: Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Leaflet Maps Marker WordPress plugin before 3.12.7 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9c293098-de54-4a04-b13d-2a702200f02e
CVE ID: CVE-2022-4678 State: PUBLISHED Published: 2023-02-13T14:32:07.210Z Last Updated: 2025-03-21T16:24:26.652Z Vendors: Unknown Products: TemplatesNext ToolKit Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The TemplatesNext ToolKit WordPress plugin before 3.2.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6a36d665-a0ca-4346-8e55-cf9ba45966cc
CVE ID: CVE-2022-4679 State: PUBLISHED Published: 2023-02-27T15:24:37.420Z Last Updated: 2025-03-18T15:07:27.116Z Vendors: Unknown Products: Wufoo Shortcode Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Wufoo Shortcode WordPress plugin before 1.52 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c817c4af-cff2-4720-944d-c59e27544d41
CVE ID: CVE-2022-4680 State: PUBLISHED Published: 2023-01-30T20:31:43.188Z Last Updated: 2025-03-27T19:45:27.879Z Vendors: Unknown Products: Revive Old Posts Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Revive Old Posts WordPress plugin before 9.0.11 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f4197386-975d-4e53-8fc9-9425732da9af
CVE ID: CVE-2022-4681 State: PUBLISHED Published: 2023-02-06T19:59:20.610Z Last Updated: 2025-03-25T18:13:32.700Z Vendors: Unknown Products: Hide My WP Problem Types: CWE-89 SQL Injection Description: The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5a4096e8-abe4-41c4-b741-c44e740e8689
CVE ID: CVE-2022-4682 State: PUBLISHED Published: 2023-02-13T14:32:27.747Z Last Updated: 2025-03-21T15:24:59.886Z Vendors: Unknown Products: Lightbox Gallery Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Lightbox Gallery WordPress plugin before 0.9.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5fc92954-20cf-4563-806e-e7a8e5ccfc72
CVE ID: CVE-2022-4683 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-09T18:51:50.945Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: usememos Products: usememos/memos Problem Types: CWE-614 Description: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/84973f6b-739a-4d7e-8757-fc58cbbaf6ef - https://github.com/usememos/memos/commit/7efa749c6628c75b19a912ca170529f5c293bb2e
CVE ID: CVE-2022-4684 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-09T20:33:22.316Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: usememos Products: usememos/memos Problem Types: CWE-284 Description: Improper Access Control in GitHub repository usememos/memos prior to 0.9.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9 - https://huntr.dev/bounties/b66f2bdd-8b41-456c-bf65-92302c2e03b5
CVE ID: CVE-2022-4685 State: REJECTED Published: N/A Last Updated: 2022-12-28T00:00:00 Description: No description available.
CVE ID: CVE-2022-4686 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-09T20:33:55.317Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: usememos Products: usememos/memos Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9 - https://huntr.dev/bounties/caa0b22c-501f-44eb-af65-65c315cd1637
CVE ID: CVE-2022-4687 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-09T20:34:36.435Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: usememos Products: usememos/memos Problem Types: CWE-648 Description: Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9 - https://huntr.dev/bounties/b908377f-a61b-432c-8e6a-c7498da69788
CVE ID: CVE-2022-4688 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-09T20:35:24.121Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: usememos Products: usememos/memos Problem Types: CWE-285 Description: Improper Authorization in GitHub repository usememos/memos prior to 0.9.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9 - https://huntr.dev/bounties/23856e7e-94ff-4dee-97d0-0cd47e9b8ff6
CVE ID: CVE-2022-4689 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-10T18:09:13.166Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: usememos Products: usememos/memos Problem Types: CWE-284 Description: Improper Access Control in GitHub repository usememos/memos prior to 0.9.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9 - https://huntr.dev/bounties/a78c4326-6e7b-47fe-aa82-461e5c12a4e3
CVE ID: CVE-2022-4690 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-10T18:07:09.930Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: usememos Products: usememos/memos Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/7e1be91d-3b13-4300-8af2-9bd9665ec335 - https://github.com/usememos/memos/commit/c07b4a57caa89905e54b800f4d8fb720bbf5bf82
CVE ID: CVE-2022-4691 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-10T18:04:54.556Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H) Vendors: usememos Products: usememos/memos Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/usememos/memos/commit/c07b4a57caa89905e54b800f4d8fb720bbf5bf82 - https://huntr.dev/bounties/459b55c1-22f5-4556-9cda-9b86aa91582f
CVE ID: CVE-2022-4692 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-09T20:36:04.452Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: usememos Products: usememos/memos Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/usememos/memos/commit/c07b4a57caa89905e54b800f4d8fb720bbf5bf82 - https://huntr.dev/bounties/9d1ed6ea-f7a0-4561-9325-a2babef99c74
CVE ID: CVE-2022-4693 State: PUBLISHED Published: 2023-01-23T14:31:53.721Z Last Updated: 2025-04-02T15:30:53.916Z Vendors: Unknown Products: User Verification Problem Types: CWE-287 Improper Authentication Description: The User Verification WordPress plugin before 1.0.94 was affected by an Auth Bypass security vulnerability. To bypass authentication, we only need to know the user’s username. Depending on whose username we know, which can be easily queried because it is usually public data, we may even be given an administrative role on the website. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1eee10a8-135f-4b76-828
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1eee10a8-135f-4b76-8289-c381ff1f51ea - https://lana.codes/lanavdb/eeabe1d3-6f64-400a-8fb2-0865efdf6957
CVE ID: CVE-2022-4694 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-09T20:36:49.932Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: usememos Products: usememos/memos Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/a4d865c2-1a2b-4e3a-aaae-915b0dfc3f22 - https://github.com/usememos/memos/commit/65cc19c12efa392f792f6bb154b4838547e0af5e
CVE ID: CVE-2022-4695 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-09T20:38:51.348Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: usememos Products: usememos/memos Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/usememos/memos/commit/65cc19c12efa392f792f6bb154b4838547e0af5e - https://huntr.dev/bounties/2559d548-b847-40fb-94d6-18c1ad58b789
CVE ID: CVE-2022-4696 State: PUBLISHED Published: 2023-01-11T12:33:41.024Z Last Updated: 2024-08-03T01:48:40.470Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Linux Kernel Problem Types: CWE-763 Description: There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decr
ing io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kernel.dance/#75454b4bbfc7e6a4dd8338556f36ea9107ddf61a - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=75454b4bbfc7e6a4dd8338556f36ea9107ddf61a
CVE ID: CVE-2022-4697 State: PUBLISHED Published: 2022-12-23T15:11:46.114Z Last Updated: 2025-01-10T16:10:42.942Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: collizo4sky Products: Paid Membership, Ecommerce, Registration Form, Login Form, User Profile, Paywall & Restrict Content – ProfilePress Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_user_cover_default_image_url’ parameter in versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes i
rameter in versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3d54f585-0116-4517-84f1-271e89a05539 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2838522%40wp-user-av
4f1-271e89a05539 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2838522%40wp-user-avatar%2Ftrunk&old=2837217%40wp-user-avatar%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2022-4698 State: PUBLISHED Published: 2022-12-23T15:09:51.218Z Last Updated: 2025-01-14T21:31:58.888Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: collizo4sky Products: Paid Membership, Ecommerce, Registration Form, Login Form, User Profile, Paywall & Restrict Content – ProfilePress Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several form fields in versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated
nd including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/43c9dcec-f769-4c55-93d0-c2aa45a4fa16 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2838522%40wp-user-avatar%2Ftrunk&old=2837217%40w
lugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2838522%40wp-user-avatar%2Ftrunk&old=2837217%40wp-user-avatar%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2022-4699 State: PUBLISHED Published: 2023-01-30T20:31:47.064Z Last Updated: 2025-03-27T19:24:11.989Z Vendors: Unknown Products: MediaElement.js Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The MediaElement.js WordPress plugin through 4.2.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high-privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e57f38d9-889a-4f82-b20d-3676ccf9c6
am Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e57f38d9-889a-4f82-b20d-3676ccf9c6f9
CVE ID: CVE-2022-4700 State: PUBLISHED Published: 2023-01-10T16:55:05.323Z Last Updated: 2025-01-13T17:14:21.531Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: wproyal Products: Royal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets) Problem Types: CWE-284 Improper Access Control Description: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subs
eme' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to activate the 'royal-elementor-kit' theme. If no such theme is installed doing so can also impact site availability as the site attempts to load a nonexistent theme. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cdd464ad-24bc-4922-8bfa-ac42fbe60b52 - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/templates-kit.php?rev=2833046 - https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-
emplates-kit.php?rev=2833046 - https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/