Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
blic and may be used. The identifier of this vulnerability is VDB-263808. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263808 - https://vuldb.com/?ctiid.263808 - https://vuldb.com/?submit.331994 - https://github.com/yylmm/CVE/blob/main/Legal%20Case%20Management%20System/xss_admin_judge.md
CVE ID: CVE-2024-4731 State: PUBLISHED Published: 2024-05-10T19:31:04.745Z Last Updated: 2024-08-01T20:47:41.675Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Legal Case Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in Campcodes Legal Case Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/role. The manipulation of the argument slug leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263809 was assigned to this vulnerability. Additional Analyst Notes: - CI
the public and may be used. The identifier VDB-263809 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263809 - https://vuldb.com/?ctiid.263809 - https://vuldb.com/?submit.331995 - https://github.com/yylmm/CVE/blob/main/Legal%20Case%20Management%20System/xss_admin_role.md
CVE ID: CVE-2024-4732 State: PUBLISHED Published: 2024-05-10T19:31:06.370Z Last Updated: 2024-08-01T20:47:41.696Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Legal Case Management System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in Campcodes Legal Case Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/service. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263810 is the identifier assigned to this vulnerability. Additional Analys
disclosed to the public and may be used. VDB-263810 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263810 - https://vuldb.com/?ctiid.263810 - https://vuldb.com/?submit.331996 - https://github.com/yylmm/CVE/blob/main/Legal%20Case%20Management%20System/xss_admin_service.md
CVE ID: CVE-2024-4733 State: PUBLISHED Published: 2024-05-16T19:33:31.865Z Last Updated: 2024-08-01T20:47:41.758Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: plainware Products: ShiftController Employee Shift Scheduling Problem Types: CWE-502 Deserialization of Untrusted Data Description: The ShiftController Employee Shift Scheduling plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the `hc3_session`-cookie in versions up to, and including, 4.9.57. This makes it possible for an authenticated attacker with contributor access-level or above to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a PO
with contributor access-level or above to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9c8ab916-240d-43c3-92d4-7efd75862a5e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3087047%40shiftcontroller%2Ftrunk&old=3080165%40shiftcontroller%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-4734 State: PUBLISHED Published: 2024-05-15T01:56:53.240Z Last Updated: 2024-08-01T20:47:41.695Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: carazo Products: Import and export users and customers Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.26.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and ab
ion and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0dca168f-a383-42fc-91ba-d78a5d7e6724?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3085346%40import-users-from-csv-with-meta%2Ftrunk&old=3078277%40import-users-from-csv-with-m
l=&sfph_mail=&reponame=&new=3085346%40import-users-from-csv-with-meta%2Ftrunk&old=3078277%40import-users-from-csv-with-meta%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-4735 State: PUBLISHED Published: 2024-05-10T20:00:05.093Z Last Updated: 2024-08-01T20:47:41.752Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Legal Case Management System Problem Types: CWE-79 Description: A vulnerability has been found in Campcodes Legal Case Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/tasks. The manipulation of the argument task_subject leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263821 was assigned to this vulnerability. Additional A
been disclosed to the public and may be used. The identifier VDB-263821 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263821 - https://vuldb.com/?ctiid.263821 - https://vuldb.com/?submit.332408 - https://github.com/yylmm/CVE/blob/main/Legal%20Case%20Management%20System/xss_admin_tasks.md
CVE ID: CVE-2024-4736 State: PUBLISHED Published: 2024-05-10T20:31:04.544Z Last Updated: 2024-08-01T20:47:41.672Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Legal Case Management System Problem Types: CWE-79 Description: A vulnerability was found in Campcodes Legal Case Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/tax. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263822 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA A
public and may be used. VDB-263822 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263822 - https://vuldb.com/?ctiid.263822 - https://vuldb.com/?submit.332409 - https://github.com/yylmm/CVE/blob/main/Legal%20Case%20Management%20System/xss_admin_tax.md
CVE ID: CVE-2024-4737 State: PUBLISHED Published: 2024-05-10T20:31:06.093Z Last Updated: 2024-08-01T20:47:41.702Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Legal Case Management System Problem Types: CWE-79 Description: A vulnerability was found in Campcodes Legal Case Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/vendor. The manipulation of the argument company_name/mobile leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263823. Additional Analyst
sclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263823. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263823 - https://vuldb.com/?ctiid.263823 - https://vuldb.com/?submit.332411 - https://github.com/yylmm/CVE/blob/main/Legal%20Case%20Management%20System/xss_admin_vendor.md
CVE ID: CVE-2024-4738 State: PUBLISHED Published: 2024-05-10T21:00:05.568Z Last Updated: 2024-08-01T20:47:41.683Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Legal Case Management System Problem Types: CWE-79 Description: A vulnerability was found in Campcodes Legal Case Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code. The manipulation of the argument new_client leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263824. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program
d. The identifier of this vulnerability is VDB-263824. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263824 - https://vuldb.com/?ctiid.263824 - https://vuldb.com/?submit.332412 - https://github.com/yylmm/CVE/blob/main/Legal%20Case%20Management%20System/xss_admin_appointment.md
CVE ID: CVE-2024-4739 State: PUBLISHED Published: 2024-10-18T08:11:04.908Z Last Updated: 2024-10-18T14:40:34.104Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Moxa Products: MXsecurity Series Problem Types: CWE-749 Description: The lack of access restriction to a resource from unauthorized users makes MXsecurity software versions v1.1.0 and prior vulnerable. By acquiring a valid authenticator, an attacker can pose as an authorized user and successfully access the resource. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-231878-mxsecurity-series-multiple-vulnerabilities
CVE ID: CVE-2024-4740 State: PUBLISHED Published: 2024-10-18T08:21:15.659Z Last Updated: 2024-10-18T14:38:21.017Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Moxa Products: MXsecurity Series Problem Types: CWE-798 Description: MXsecurity software versions v1.1.0 and prior are vulnerable because of the use of hard-coded credentials. This vulnerability could allow an attacker to tamper with sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-231878-mxsecurity-series-multiple-vulnerabilities
CVE ID: CVE-2024-4741 State: PUBLISHED Published: 2024-11-13T10:20:50.711Z Last Updated: 2025-11-04T17:26:59.261Z Vendors: OpenSSL Products: OpenSSL Problem Types: CWE-416 Description: Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, only applications that directly call the SSL_free_buffers function are affected by this issue. Applications that do not call this function are not vulnerable. Our investigations indicate that this function is r
sue. Applications that do not call this function are not vulnerable. Our investigations indicate that this function is rarely used by applications. The SSL_free_buffers function is used to free the internal OpenSSL buffer used when processing an incoming record from the network. The call is only expected to succeed if the buffer is not currently in use. However, two scenarios have been identified where the buffer is freed even when still in use. The first scenario occurs where a record header has been received from the network and processed by OpenSSL, but the full record body has not yet arrived. In this case calling SSL_free_buffers will succeed even though a record has only been partially
ody has not yet arrived. In this case calling SSL_free_buffers will succeed even though a record has only been partially processed and the buffer is still in use. The second scenario occurs where a full record containing application data has been received and processed by OpenSSL but the application has only read part of this data. Again a call to SSL_free_buffers will succeed even though the buffer is still in use. While these scenarios could occur accidentally during normal operation a malicious attacker could attempt to engineer a stituation where this occurs. We are not aware of this issue being actively exploited. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
aware of this issue being actively exploited. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.openssl.org/news/secadv/20240528.txt - https://github.com/openssl/openssl/commit/e5093133c35ca82874ad83697af76f4b0f7e3bd8 - https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac - https://github.com/openssl/openssl/commit/704f725b96aa373ee45ecfb23f6abfe8be8d9177 - https://github.com/openssl/openssl/commit/b3f0eb0a295f58f16ba43ba99dad70d4ee5c437d - https://github.openssl.org/openssl/extended-releases/commit/f7a045f3143fc6da2ee66bf52d8df04829590d
ba99dad70d4ee5c437d - https://github.openssl.org/openssl/extended-releases/commit/f7a045f3143fc6da2ee66bf52d8df04829590dd4
CVE ID: CVE-2024-4742 State: PUBLISHED Published: 2024-06-20T02:08:20.417Z Last Updated: 2024-08-01T20:47:41.856Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: youzify Products: Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the order_by shortcode attribute in all versions up to, and including, 1.2.5 due to insufficient escaping on the u
n via the order_by shortcode attribute in all versions up to, and including, 1.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/08bd24ca-eec6-4b62-af49-192496e65a5b?source=cve - https://plugins.trac.wordpress.org/browser/youzify/trunk/includes/public
bd24ca-eec6-4b62-af49-192496e65a5b?source=cve - https://plugins.trac.wordpress.org/browser/youzify/trunk/includes/public/core/functions/youzify-account-verification-functions.php#L294
CVE ID: CVE-2024-4743 State: PUBLISHED Published: 2024-06-05T08:33:16.332Z Last Updated: 2024-08-01T20:47:41.702Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: chrisbadgett Products: LifterLMS – WordPress LMS for eLearning Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to SQL Injection via the orderBy attribute of the lifterlms_favorites shortcode in all versions up to, and including, 7.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin
ing, 7.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7e3a1e3c-eba0-4ef4-bcb8-929799bb56a8?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3095706%40lifterlms%2Ftrunk&old=3094820%40lifterlms%2Ftrunk&sfp
dpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3095706%40lifterlms%2Ftrunk&old=3094820%40lifterlms%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-4744 State: PUBLISHED Published: 2024-06-10T08:10:13.740Z Last Updated: 2024-08-01T20:47:41.769Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Avirtum Products: iPages Flipbook Problem Types: CWE-862 Description: Missing Authorization vulnerability in Avirtum iPages Flipbook.This issue affects iPages Flipbook: from n/a through 1.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ipages-flipbook/wordpress-ipages-flipbook-plugin-1-5-1-broken-access-control-vulnerability-2?_s_id=cve
CVE ID: CVE-2024-4745 State: PUBLISHED Published: 2024-06-10T08:09:15.067Z Last Updated: 2024-08-01T20:47:41.665Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: RafflePress Products: Giveaways and Contests by RafflePress Problem Types: CWE-862 Description: Missing Authorization vulnerability in RafflePress Giveaways and Contests by RafflePress.This issue affects Giveaways and Contests by RafflePress: from n/a through 1.12.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/rafflepress/wordpress-giveaways-and-contests-by-rafflepress-plugin-1-12-4-broken-access-control-vuln
abase/vulnerability/rafflepress/wordpress-giveaways-and-contests-by-rafflepress-plugin-1-12-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-4746 State: PUBLISHED Published: 2024-06-10T08:02:44.092Z Last Updated: 2024-08-01T20:47:41.703Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Netgsm Products: Netgsm Problem Types: CWE-862 Description: Missing Authorization vulnerability in Netgsm.This issue affects Netgsm: from n/a through 2.9.16. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/netgsm/wordpress-netgsm-plugin-2-9-16-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-4747 State: PUBLISHED Published: 2024-05-13T09:59:16.498Z Last Updated: 2024-08-01T20:47:41.783Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Propovoice Products: Propovoice CRM Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Propovoice Propovoice CRM allows Stored XSS.This issue affects Propovoice CRM: from n/a through 1.7.6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/propovoice/wordpress-propovoice-crm-plugin-1-7-6-2-cross-site-scripting-xss-vulnerability?_s
.com/database/vulnerability/propovoice/wordpress-propovoice-crm-plugin-1-7-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-4748 State: PUBLISHED Published: 2024-06-24T13:52:12.451Z Last Updated: 2024-10-10T15:36:20.059Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: CRUDDIY Products: CRUDDIY Problem Types: CWE-78 Description: The CRUDDIY project is vulnerable to shell command injection via sending a crafted POST request to the application server. The exploitation risk is limited since CRUDDIY is meant to be launched locally. Nevertheless, a user with the project running on their computer might visit a website which would send such a malicious request to the locally launched server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refere
quest to the locally launched server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.pl/en/posts/2024/06/CVE-2024-4748 - https://cert.pl/posts/2024/06/CVE-2024-4748 - https://github.com/jan-vandenberg/cruddiy/issues/67
CVE ID: CVE-2024-4749 State: PUBLISHED Published: 2024-06-04T06:00:02.802Z Last Updated: 2024-08-01T20:47:41.749Z Vendors: Unknown Products: wp-eMember Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The wp-eMember WordPress plugin before 10.3.9 does not sanitize and escape the "fieldId" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/6cc05a33-6592-4d35-8e66-9b6a9884df7e/
CVE ID: CVE-2024-4750 State: PUBLISHED Published: 2024-06-04T06:00:02.993Z Last Updated: 2025-03-27T21:11:34.672Z Vendors: Unknown Products: buddyboss-platform Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The buddyboss-platform WordPress plugin before 2.6.0 contains an IDOR vulnerability that allows a user to like a private post by manipulating the ID included in the request Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/ffbe4034-842b-43b0-97d1-208811376dea/
CVE ID: CVE-2024-4751 State: PUBLISHED Published: 2024-06-14T06:00:05.079Z Last Updated: 2024-08-09T19:03:15.559Z Vendors: Unknown Products: WP Prayer II Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Prayer II WordPress plugin through 2.4.7 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/94f4cc45-4c55-43d4-8ad2-a20c118b589f/
CVE ID: CVE-2024-4752 State: PUBLISHED Published: 2024-07-13T06:00:06.657Z Last Updated: 2024-08-01T20:47:41.832Z Vendors: Unknown Products: EventON Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The EventON WordPress plugin before 2.2.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/70d1f5d5-1a96-494b-9203-96a7780026da/
CVE ID: CVE-2024-4753 State: PUBLISHED Published: 2024-07-12T06:00:05.863Z Last Updated: 2024-11-17T16:37:01.862Z Vendors: Unknown Products: WP Secure Maintenance Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Secure Maintenance WordPress plugin before 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/81725b17-532a-43e6-8ce5-fe50a2ed0819/