Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
butes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ad01d01a-d1d9-4c4e-9818-52298c2df89c?source=cve - https://plugins.trac.wordpress.org/browser/automatically-hierarchic-categories-in-menu/trunk/includes/class-auto-hierarchic-category-menu.php#L312 - https://wordpress.org/plugins/automatically-hierarchic-categories-in-menu - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3229318%40automatic
ategories-in-menu - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3229318%40automatically-hierarchic-categories-in-menu&new=3229318%40automatically-hierarchic-categories-in-menu&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13467 State: PUBLISHED Published: 2025-01-25T07:24:17.422Z Last Updated: 2025-01-27T14:53:24.299Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: hk1993 Products: WP Contact Form7 Email Spam Blocker Problem Types: CWE-79 Description: The WP Contact Form7 Email Spam Blocker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such a
nject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b70a1344-2b55-40c9-a314-80d581e0b019?source=cve - https://wordpress.org/plugins/wp-contact-form7-email-spam-blocker/
CVE ID: CVE-2024-13468 State: PUBLISHED Published: 2025-02-19T07:32:14.346Z Last Updated: 2025-02-19T14:34:14.405Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: solwininfotech Products: Trash Duplicate and 301 Redirect Problem Types: CWE-862 Description: The Trash Duplicate and 301 Redirect plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'duplicates-action-top' action in all versions up to, and including, 1.9. This makes it possible for unauthenticated attackers to delete arbitrary posts/pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulne
sts/pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ebb6afd7-6bc4-4c8a-a645-04f64d5adff4?source=cve - https://wordpress.org/plugins/trash-duplicate-and-301-redirect/
CVE ID: CVE-2024-13469 State: PUBLISHED Published: 2025-02-28T08:23:15.555Z Last Updated: 2025-02-28T13:40:54.777Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pickplugins Products: Pricing Table by PickPlugins Problem Types: CWE-79 Description: The Pricing Table by PickPlugins plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button Link in all versions up to, and including, 1.12.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pag
el access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5239c414-cd1d-4257-9f8e-e7a92c2119f9?source=cve - https://wordpress.org/plugins/pricingtable/
CVE ID: CVE-2024-13470 State: PUBLISHED Published: 2025-01-30T07:23:05.434Z Last Updated: 2025-01-30T15:08:24.318Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kstover Products: Ninja Forms – The Contact Form Builder That Grows With You Problem Types: CWE-79 Description: The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.8.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject
plied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6f2b46a9-d228-43b4-84af-d56218076087?source=cve - https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.8.23/includes/Display/Shortcodes.php#L8 - https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.8.23/ninja-forms.php#L953 - https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.8.23/includes/Display/Render.php#L708 - https://plugins.tr
https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.8.23/includes/Display/Render.php#L708 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3229932%40ninja-forms%2Ftrunk&old=3226451%40ninja-forms%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13471 State: PUBLISHED Published: 2025-03-05T11:22:08.595Z Last Updated: 2025-03-05T14:24:59.752Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: designthemes Products: DesignThemes Core Features Problem Types: CWE-22 Description: The DesignThemes Core Features plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dt_process_imported_file function in all versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to read arbitrary files on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/t
nderlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1729d0de-1f5f-4349-b592-5841d01ed33a?source=cve - https://themeforest.net/item/lms-learning-management-system-education-lms-wordpress-theme/7867581
CVE ID: CVE-2024-13472 State: PUBLISHED Published: 2025-01-31T09:21:23.024Z Last Updated: 2025-01-31T15:25:58.715Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: wcproducttable Products: WooCommerce Product Table Lite Problem Types: CWE-94 Description: The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.9.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The same 'sc_attrs' parameter is vulnerable
s it possible for unauthenticated attackers to execute arbitrary shortcodes. The same 'sc_attrs' parameter is vulnerable to Reflected Cross-Site Scripting as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4f1a1171-3d7b-46a4-982e-fe318e3017b7?source=cve - https://wordpress.org/plugins/wc-product-table-lite/#developers - https://plugins.trac.wordpress.org/browser/wc-product-table-lite/trunk/main.php#L1843 - https://plugins.trac.wordpress.org/changeset/3231930/
CVE ID: CVE-2024-13473 State: PUBLISHED Published: 2025-02-12T09:22:48.715Z Last Updated: 2025-02-18T17:37:21.033Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: enituretechnology Products: LTL Freight Quotes – Worldwide Express Edition Problem Types: CWE-89 Description: The LTL Freight Quotes – Worldwide Express Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameter in all versions up to, and including, 5.0.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional
icient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4e72828e-a6f6-43fc-8a10-d9908004c0fc?source=cve - https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-worldwide-express-edition/trunk/warehouse-dropship/wild/includes/wwe-ltl-wild-delivery-save.php#L264 - https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-worldwide-express-edition/trunk/warehouse-dropship/wild/includes/wwe-
gins.trac.wordpress.org/browser/ltl-freight-quotes-worldwide-express-edition/trunk/warehouse-dropship/wild/includes/wwe-ltl-wild-delivery-save.php#L387 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3215844%40ltl-freight-quotes-worldwide-express-edition&new=3215844%40ltl-freight-quotes-worldwide-express-edition&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13474 State: PUBLISHED Published: 2025-02-22T04:21:15.623Z Last Updated: 2025-02-22T15:25:10.065Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: enituretechnology Products: LTL Freight Quotes – Purolator Edition Problem Types: CWE-89 Description: The LTL Freight Quotes – Purolator Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions up to, and including, 2.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into
on on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2db0b8c9-7908-484d-9a02-1c50f88efdd0?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3244300%40ltl-freight-quotes-purolator-freight-edition&new=3244300%40ltl-freight-quotes-purolator-freight-edition&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13475 State: PUBLISHED Published: 2025-02-12T09:22:51.835Z Last Updated: 2025-02-12T15:56:59.988Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: enituretechnology Products: Small Package Quotes – UPS Edition Problem Types: CWE-89 Description: The Small Package Quotes – UPS Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up to, and including, 4.5.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that
his makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c62680b5-e9e0-497f-b957-9b223a623917?source=cve - https://plugins.trac.wordpress.org/changeset/3237693/
CVE ID: CVE-2024-13476 State: PUBLISHED Published: 2025-02-20T09:21:39.025Z Last Updated: 2025-02-20T15:22:06.868Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: enituretechnology Products: LTL Freight Quotes – GlobalTranz Edition Problem Types: CWE-89 Description: The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to SQL Injection via the 'engtz_wd_save_dropship' AJAX endpoint in all versions up to, and including, 2.3.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into
on on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb7c846-c82b-40c8-a5ae-88b30c761ba9?source=cve - https://plugins.trac.wordpress.org/changeset/3242457/
CVE ID: CVE-2024-13477 State: PUBLISHED Published: 2025-02-12T11:11:16.643Z Last Updated: 2025-02-12T16:07:05.103Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: enituretechnology Products: LTL Freight Quotes – Unishippers Edition Problem Types: CWE-89 Description: The LTL Freight Quotes – Unishippers Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up to, and including, 2.5.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing qu
QL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7df452c9-4e73-40d7-88a3-d38ae1309d8f?source=cve - https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-unishippers-edition/trunk/shipping-rules/shipping-rules-save.php#L84 - https://plugins.trac.wordpress.org/changeset/3237773/
CVE ID: CVE-2024-13478 State: PUBLISHED Published: 2025-02-19T11:10:39.025Z Last Updated: 2025-02-19T15:13:31.177Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: enituretechnology Products: LTL Freight Quotes – TForce Edition Problem Types: CWE-89 Description: The LTL Freight Quotes – TForce Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into alrea
the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2403dd59-7b9e-490e-86d8-5a10f9eee616?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3242156%40ltl-freight-quotes-ups-edition&new=3242156%40ltl-freight-quotes-ups-edition&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13479 State: PUBLISHED Published: 2025-02-19T11:10:39.887Z Last Updated: 2025-02-19T14:36:38.611Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: enituretechnology Products: LTL Freight Quotes – SEFL Edition Problem Types: CWE-89 Description: The LTL Freight Quotes – SEFL Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions up to, and including, 3.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already e
existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8322fe81-2c2f-4aa6-b08f-fa5c16e62218?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3242634%40ltl-freight-quotes-sefl-edition&new=3242634%40ltl-freight-quotes-sefl-edition&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13480 State: PUBLISHED Published: 2025-02-12T11:11:17.587Z Last Updated: 2025-02-12T16:06:48.113Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: enituretechnology Products: LTL Freight Quotes – For Customers of FedEx Freight Problem Types: CWE-89 Description: The LTL Freight Quotes – For Customers of FedEx Freight plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions up to, and including, 3.4.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append a
ck of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a9b6f7a3-83eb-4352-9db6-ab4b03241702?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3238359%40ltl-freight-quotes-fedex-freight-edition&new=3238359%40ltl-freight-quotes-fedex-freight-edition&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13481 State: PUBLISHED Published: 2025-02-19T11:10:40.673Z Last Updated: 2025-02-19T14:28:25.961Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: enituretechnology Products: LTL Freight Quotes – R+L Carriers Edition Problem Types: CWE-89 Description: The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions up to, and including, 3.3.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL querie
paration on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b0f3cdce-e239-4c2f-83e3-e8d0b528d39e?source=cve - https://plugins.trac.wordpress.org/changeset/3241903/
CVE ID: CVE-2024-13482 State: PUBLISHED Published: 2025-05-15T20:07:01.559Z Last Updated: 2025-05-20T19:27:03.747Z Vendors: Unknown Products: Icegram Engage Problem Types: CWE-287 Improper Authentication, CWE-79 Cross-Site Scripting (XSS) Description: The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/83ae33d0-4fc1-4186-9d70-b854a16df3a7/
CVE ID: CVE-2024-13483 State: PUBLISHED Published: 2025-02-19T11:10:41.394Z Last Updated: 2025-02-19T14:26:47.391Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: enituretechnology Products: LTL Freight Quotes – SAIA Edition Problem Types: CWE-89 Description: The LTL Freight Quotes – SAIA Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions up to, and including, 2.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already
existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d5e0d192-17ee-42bd-9368-c8449d8e0d08?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3242171%40ltl-freight-quotes-saia-edition&new=3242171%40ltl-freight-quotes-saia-edition&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13484 State: PUBLISHED Published: 2025-01-28T17:54:28.701Z Last Updated: 2025-11-20T18:22:34.293Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat OpenShift GitOps 1.14, Red Hat OpenShift GitOps 1.15, Red Hat OpenShift GitOps 1.16 Problem Types: CWE-668 Description: A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied. Add
adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:7753 - https://access.redhat.com/errata/RHSA-2025:8274 - https://access.redhat.com/errata/RHSA-2025:9506 - https://access.redhat.com/security/cve/CVE-2024-13484 - https://bugzilla.redhat.com/show_bug.cgi?id=2269376
CVE ID: CVE-2024-13485 State: PUBLISHED Published: 2025-02-19T11:10:40.295Z Last Updated: 2025-02-19T14:35:05.599Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: enituretechnology Products: LTL Freight Quotes – ABF Freight Edition Problem Types: CWE-89 Description: The LTL Freight Quotes – ABF Freight Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions up to, and including, 3.3.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries
ration on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9fbb4f9a-4c68-4ddb-8e49-9629114b11ec?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3242640%40ltl-freight-quotes-abf-freight-edition&new=3242640%40ltl-freight-quotes-abf-freight-edition&sfp_email=&sfph_mail=