Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-24764 State: PUBLISHED Published: 2022-02-01T12:21:24 Last Updated: 2024-08-03T19:42:16.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Perfect Survey WordPress plugin before 1.5.2 does not sanitise and escape multiple parameters (id and filters[session_id] of single_statistics page, type and message of importexport page) before outputting them back in pages/attributes in the admin dashboard, leading to Reflected Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c2f8e9b9-c044-4c45-8d17-e628e9cb5d59
CVE ID: CVE-2021-24765 State: PUBLISHED Published: 2022-02-01T12:21:25 Last Updated: 2024-08-03T19:42:17.002Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when the Anonymize IP setting of a survey is turned off, leading to a Stored Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4440e7ca-1a55-444d-8f6c-04153302d750
CVE ID: CVE-2021-24766 State: PUBLISHED Published: 2021-11-08T17:35:17 Last Updated: 2024-08-03T19:42:16.949Z Vendors: Unknown Products: 404 to 301 – Redirect, Log and Notify 404 Errors Problem Types: CWE-352 Description: The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin before 3.0.9 does not have CSRF check in place when cleaning the logs, which could allow attacker to make a logged in admin delete all of them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/cc13db1e-5f7f-49b2-81da-f913cfe70543
CVE ID: CVE-2021-24767 State: PUBLISHED Published: 2021-11-08T17:35:18 Last Updated: 2024-08-03T19:42:17.031Z Vendors: Unknown Products: Redirect 404 Error Page to Homepage or Custom Page with Logs Problem Types: CWE-352 Description: The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0b35ad4a-3d94-49b1-a98d-07acf8dd4962
CVE ID: CVE-2021-24768 State: PUBLISHED Published: 2021-11-29T08:25:36 Last Updated: 2024-08-03T19:42:17.221Z Vendors: Unknown Products: WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More Problem Types: CWE-79 Description: The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to Cross-Site Scripting issues. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3673e13f-7ce6-4d72-b179-ae4bab55514c
CVE ID: CVE-2021-24769 State: PUBLISHED Published: 2021-10-25T13:20:53 Last Updated: 2024-08-03T19:42:17.292Z Vendors: Unknown Products: Permalink Manager Lite Problem Types: CWE-89 Description: The Permalink Manager Lite WordPress plugin before 2.2.13.1 does not validate and escape the orderby parameter before using it in a SQL statement in the Permalink Manager page, leading to a SQL Injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a2f211af-5373-425f-9964-ebbf5efde87b
CVE ID: CVE-2021-24770 State: PUBLISHED Published: 2021-11-01T08:46:18 Last Updated: 2024-08-03T19:42:17.023Z Vendors: Unknown Products: Stylish Price List Problem Types: CWE-863 Description: The Stylish Price List WordPress plugin before 6.9.1 does not perform capability checks in its spl_upload_ser_img AJAX action (available to authenticated users), which could allow any authenticated users, such as subscriber, to upload arbitrary images. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4365c813-4bd7-4c7c-a15b-ef9a42d32b26
CVE ID: CVE-2021-24771 State: PUBLISHED Published: 2021-12-13T10:40:48 Last Updated: 2024-08-03T19:42:17.001Z Vendors: Unknown Products: Inspirational Quote Rotator Problem Types: CWE-79 Description: The Inspirational Quote Rotator WordPress plugin through 1.0.0 does not sanitize and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the "Quotes list" even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a6d57fda-79a7-4bf8-b18e-8cf0a4efd1b3
CVE ID: CVE-2021-24772 State: PUBLISHED Published: 2021-11-17T10:15:35 Last Updated: 2024-08-03T19:42:17.013Z Vendors: Unknown Products: Stream Problem Types: CWE-89 Description: The Stream WordPress plugin before 3.8.2 does not sanitise and validate the order GET parameter from the Stream Records admin dashboard before using it in a SQL statement, leading to an SQL injection issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b9d4f2ad-2f12-4822-817d-982a016af85d - https://plugins.trac.wordpress.org/changeset/2615811/stream
CVE ID: CVE-2021-24773 State: PUBLISHED Published: 2021-11-01T08:46:20 Last Updated: 2024-08-03T19:42:16.966Z Vendors: Unknown Products: WordPress Download Manager Problem Types: CWE-79 Description: The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputting them, allowing high privilege users to perform XSS attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/aab2ddbb-7675-40fc-90ee-f5bfa8a5b995
CVE ID: CVE-2021-24774 State: PUBLISHED Published: 2021-10-25T13:20:54 Last Updated: 2024-08-03T19:42:17.040Z Vendors: Unknown Products: Check & Log Email Problem Types: CWE-89 Description: The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statement when viewing logs, leading to SQL injections issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f80ef09a-d3e2-4d62-8532-f0ebe59ae110
CVE ID: CVE-2021-24775 State: PUBLISHED Published: 2022-02-01T12:21:26 Last Updated: 2024-08-03T19:42:17.346Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Document Embedder WordPress plugin before 1.7.5 contains a REST endpoint, which could allow unauthenticated users to enumerate the title of arbitrary private and draft posts. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c6f24afe-d273-4f87-83ca-a791a385b06b
CVE ID: CVE-2021-24776 State: PUBLISHED Published: 2021-11-17T10:15:37 Last Updated: 2024-08-03T19:42:17.424Z Vendors: Unknown Products: WP Performance Score Booster – Optimize Speed, Enable Cache & Page Preload Problem Types: CWE-352 Description: The WP Performance Score Booster WordPress plugin before 2.1 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a59ebab8-5df7-4093-b853-da9472f53508
CVE ID: CVE-2021-24777 State: PUBLISHED Published: 2022-03-07T08:15:57 Last Updated: 2024-08-03T19:42:17.352Z Vendors: Unknown Products: Hotscot Contact Form Problem Types: CWE-89 Description: The view submission functionality in the Hotscot Contact Form WordPress plugin before 1.3 makes a get request with the sub_id parameter which not sanitised, escaped or validated before inserting to a SQL statement, leading to an SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2dfde2ef-1b33-4dc9-aa3e-02d319effb3a
CVE ID: CVE-2021-24778 State: PUBLISHED Published: 2022-03-07T08:15:58 Last Updated: 2024-08-03T19:42:17.197Z Vendors: Unknown Products: Tradetracker-Store Problem Types: CWE-89 Description: The test parameter of the xmlfeed in the Tradetracker-Store WordPress plugin before 4.6.60 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e37f9aa6-e409-4155-b8e4-566c5bce58d6
CVE ID: CVE-2021-24779 State: PUBLISHED Published: 2021-10-25T13:20:56 Last Updated: 2024-08-03T19:42:17.194Z Vendors: Unknown Products: WP Debugging Problem Types: CWE-862 Description: The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and CSRF checks, as a result, the settings can be updated by unauthenticated users. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8d0e65ee-fdd1-4fd6-9a27-01664c703d90
CVE ID: CVE-2021-24780 State: PUBLISHED Published: 2021-12-13T10:40:50 Last Updated: 2024-08-03T19:42:17.177Z Vendors: Unknown Products: Single Post Exporter Problem Types: CWE-352 Description: The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any role such as subscriber. Subscriber users would then be able to export an arbitrary post/page (such as private and password protected) via a direct URL Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8764e550-4127-471e-
RL Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8764e550-4127-471e-84e6-494d6106a3b0
CVE ID: CVE-2021-24781 State: PUBLISHED Published: 2021-11-01T08:46:21 Last Updated: 2024-08-03T19:42:17.214Z Vendors: Unknown Products: Image Source Control Problem Types: CWE-284 Description: The Image Source Control WordPress plugin before 2.3.1 allows users with a role as low as Contributor to change arbitrary post meta fields of arbitrary posts (even those they should not be able to edit) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3550ba54-7786-4ad9-aeb1-1c0750f189d0 - https://plugins.trac.wordpress.org/changeset/2606615/
CVE ID: CVE-2021-24782 State: PUBLISHED Published: 2021-12-13T10:40:51 Last Updated: 2024-08-03T19:42:17.321Z Vendors: Unknown Products: Flex Local Fonts Problem Types: CWE-79 Description: The Flex Local Fonts WordPress plugin through 1.0.0 does not escape the Class Name field when adding a font, which could allow hight privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5cd846df-1d8b-488d-a691-b76850e8687a
CVE ID: CVE-2021-24783 State: PUBLISHED Published: 2021-11-08T17:35:19 Last Updated: 2024-08-03T19:42:17.350Z Vendors: Unknown Products: Post Expirator: Automatically Unpublish WordPress Posts Problem Types: CWE-863 Description: The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/de51b970-ab13-41a6-a479-a92cd0e70b71
CVE ID: CVE-2021-24784 State: PUBLISHED Published: 2021-12-13T10:40:52 Last Updated: 2024-08-03T19:42:17.198Z Vendors: Unknown Products: WP Admin Logo Changer Problem Types: CWE-352 Description: The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2e9132b5-f8cd-4acc-839c-188d79277270
CVE ID: CVE-2021-24785 State: PUBLISHED Published: 2021-10-25T13:20:57 Last Updated: 2024-08-03T19:42:17.191Z Vendors: Unknown Products: Great Quotes Problem Types: CWE-79 Description: The Great Quotes WordPress plugin through 1.0.0 does not sanitise and escape the Quote and Author fields of its Quotes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3957056c-df25-41f7-ab0d-1d09222f2fa5
CVE ID: CVE-2021-24786 State: PUBLISHED Published: 2022-01-03T12:49:03.000Z Last Updated: 2025-05-22T18:39:07.594Z Vendors: Unknown Products: Download Monitor Problem Types: CWE-89 Description: The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a6571f16-66d2-449e-af83-1c6ddd56edfa
CVE ID: CVE-2021-24787 State: PUBLISHED Published: 2021-11-17T10:15:38 Last Updated: 2024-08-03T19:42:17.334Z Vendors: Unknown Products: Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress Problem Types: CWE-79 Description: The Client Invoicing by Sprout Invoices WordPress plugin before 19.9.7 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c89bf498-f384-49de-820e-6cbd70390db2
CVE ID: CVE-2021-24788 State: PUBLISHED Published: 2021-11-08T17:35:20 Last Updated: 2024-08-03T19:42:17.335Z Vendors: Unknown Products: Batch Cat Problem Types: CWE-863 Description: The Batch Cat WordPress plugin through 0.3 defines 3 custom AJAX actions, which both require authentication but are available for all roles. As a result, any authenticated user (including simple subscribers) can add/set/delete arbitrary categories to posts. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f8fdff8a-f158-46e8-94f1-f051a6c5608b
CVE ID: CVE-2021-24789 State: PUBLISHED Published: 2021-11-01T08:46:23 Last Updated: 2024-08-03T19:42:17.177Z Vendors: Unknown Products: Flat Preloader Problem Types: CWE-79 Description: The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e8550ccd-3898-4e27-aca9-ade89823ff4d
CVE ID: CVE-2021-24790 State: PUBLISHED Published: 2021-12-13T10:40:54 Last Updated: 2024-08-03T19:42:17.185Z Vendors: Unknown Products: Contact Form Advanced Database Problem Types: CWE-862 Description: The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The delete_cf7_data would lead to arbitrary metadata deletion, as well as PHP Object Injection if a suitable gadget chain is present in another plugin, as user data is passed to the maybe_unserialize() functio
ction if a suitable gadget chain is present in another plugin, as user data is passed to the maybe_unserialize() function without being first validated. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/adc5dd9b-0781-4cea-8cc5-2c10ac35b968
CVE ID: CVE-2021-24791 State: PUBLISHED Published: 2021-11-08T17:35:21 Last Updated: 2024-08-03T19:42:17.170Z Vendors: Unknown Products: Header Footer Code Manager Problem Types: CWE-89 Description: The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d55caa9b-d50f-4c13-bc69-dc475641735f
CVE ID: CVE-2021-24792 State: PUBLISHED Published: 2021-12-13T10:40:55 Last Updated: 2024-08-03T19:42:17.349Z Vendors: Unknown Products: Shiny Buttons – CSS3 Button Generator for WordPress Problem Types: CWE-79 Description: The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a template (wpbtn_save_template function hooked to the init action), nor sanitise and escape them before outputting them in the admin dashboard, which allow unauthenticated users to add a malicious template and lead to Stored Cross-Site Scripting issues. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/29514d8e-9d1
g issues. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/29514d8e-9d1c-4fb6-b378-f6b7374989ca
CVE ID: CVE-2021-24793 State: PUBLISHED Published: 2021-11-01T08:46:24 Last Updated: 2024-08-03T19:42:17.224Z Vendors: Unknown Products: WPeMatico RSS Feed Fetcher Problem Types: CWE-79 Description: The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/eeedbb3b-ae10-4472-a1d3-f196f95b9d96
CVE ID: CVE-2021-24794 State: PUBLISHED Published: 2021-11-01T08:46:26 Last Updated: 2024-08-03T19:42:17.200Z Vendors: Unknown Products: Connections Business Directory Problem Types: CWE-79 Description: The Connections Business Directory WordPress plugin before 10.4.3 does not escape the Address settings when creating an Entry, which could allow high privilege users to perform Cross-Site Scripting when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/651dc567-943e-4f57-8ec4-6eee466785f5
CVE ID: CVE-2021-24795 State: PUBLISHED Published: 2021-12-13T10:40:57 Last Updated: 2024-08-03T19:42:17.183Z Vendors: Unknown Products: Filter Portfolio Gallery Problem Types: CWE-352 Description: The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery (CSRF) check when deleting a Gallery, which could allow attackers to make a logged in admin delete arbitrary Gallery. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ef3c1d4f-53a4-439e-9434-b3b4adb687a4
CVE ID: CVE-2021-24796 State: PUBLISHED Published: 2021-11-17T10:15:40 Last Updated: 2024-08-03T19:42:17.335Z Vendors: Unknown Products: My Tickets Problem Types: CWE-79 Description: The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d973dc0f-3cb4-408d-a8b0-01abeb9ef951
CVE ID: CVE-2021-24797 State: PUBLISHED Published: 2021-12-27T10:33:19 Last Updated: 2024-08-03T19:42:17.174Z Vendors: Unknown Products: Tickera – WordPress Event Ticketing Problem Types: CWE-79 Description: The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0eb07cc8-8a19-4e01-ab90-844495413453
CVE ID: CVE-2021-24798 State: PUBLISHED Published: 2021-11-08T17:35:22 Last Updated: 2024-08-03T19:42:17.188Z Vendors: Unknown Products: WP Header Images Problem Types: CWE-79 Description: The WP Header Images WordPress plugin before 2.0.1 does not sanitise and escape the t parameter before outputting it back in the plugin's settings page, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/58c9a007-42db-4142-b096-0b9ba8850f87
CVE ID: CVE-2021-24799 State: PUBLISHED Published: 2021-11-01T08:46:27 Last Updated: 2024-08-03T19:42:17.210Z Vendors: Unknown Products: Far Future Expiry Header Problem Types: CWE-352 Description: The Far Future Expiry Header WordPress plugin before 1.5 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6010ce4e-3e46-4cc1-96d8-560b30b605ed
CVE ID: CVE-2021-24800 State: PUBLISHED Published: 2022-04-25T15:50:41 Last Updated: 2024-08-03T19:42:17.205Z Vendors: Unknown Products: DW Question Answer Pro Problem Types: CWE-639 Description: The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, allowing any user to edit other comments. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/cd37ca81-d683-4955-bc97-60204cb9c346
CVE ID: CVE-2021-24801 State: PUBLISHED Published: 2021-11-08T17:35:23 Last Updated: 2024-08-03T19:42:17.191Z Vendors: Unknown Products: WP Survey Plus Problem Types: CWE-284 Description: The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, due to the lack of sanitization in the Surveys' Title, this could also lead to Stored Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/78405609-2105-4011-b18e-1ba5f438972d
CVE ID: CVE-2021-24802 State: PUBLISHED Published: 2021-11-17T10:15:41 Last Updated: 2024-08-03T19:42:17.223Z Vendors: Unknown Products: Colorful Categories Problem Types: CWE-352 Description: The Colorful Categories WordPress plugin before 2.0.15 does not enforce nonce checks which could allow attackers to make a logged in admin or editor change taxonomy colors via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d92db61f-341c-4f3f-b962-326194ddbd1e
CVE ID: CVE-2021-24803 State: PUBLISHED Published: 2022-02-28T09:06:09 Last Updated: 2024-08-03T19:42:17.331Z Vendors: Unknown Products: Core Tweaks WP Setup Problem Types: CWE-352 Description: The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/97adac02-4163-48d4-ba14-0b1badfd3d42