Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-13661 State: PUBLISHED Published: 2025-01-30T13:41:56.484Z Last Updated: 2025-01-30T14:53:45.234Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wptableeditor Products: Table Editor Problem Types: CWE-79 Description: The Table Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wptableeditor_vtabs' shortcode in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user
ers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3fe1f3c3-4a81-4aae-9a5e-e5889f4c69ba?source=cve - https://plugins.trac.wordpress.org/browser/wp-table-editor/trunk/includes/public/shortcode.php#L333 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3228279%40wp-table-editor&new=3228279%40wp-table-editor&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13662 State: PUBLISHED Published: 2025-01-31T11:11:10.343Z Last Updated: 2025-02-18T18:41:46.542Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: vernonsystems Products: eHive Objects Image Grid Problem Types: CWE-79 Description: The eHive Objects Image Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ehive_objects_image_grid' shortcode in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that
ible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/638d8ef6-dab0-4cfa-8ecc-af2ded3c6d79?source=cve - https://plugins.trac.wordpress.org/browser/ehive-objects-image-grid/trunk/templates/eHiveObjectsImageGrid.php#L22 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3230975%40ehive-objects-image-grid&new=3230975%40ehive-objects-image-grid&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13663 State: PUBLISHED Published: 2025-02-19T07:32:04.884Z Last Updated: 2025-02-19T21:16:57.115Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: markodonnell Products: Coaching Staffs Problem Types: CWE-79 Description: The Coaching Staffs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mstw-cs-table' shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user ac
, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/06982502-6055-4a79-93ef-4896ba086322?source=cve - https://plugins.trac.wordpress.org/browser/coaching-staffs/trunk/mstw-coaching-staffs.php#L561
CVE ID: CVE-2024-13664 State: PUBLISHED Published: 2025-01-30T13:42:08.136Z Last Updated: 2025-01-30T14:31:27.316Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpbean Products: WP Post List Table Problem Types: CWE-79 Description: The WP Post List Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpb_post_list_table' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a
ttackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b18f6817-86db-4a72-a2e9-a9e047e05bc5?source=cve - https://plugins.trac.wordpress.org/changeset/3227735/
CVE ID: CVE-2024-13665 State: PUBLISHED Published: 2025-02-12T04:22:16.026Z Last Updated: 2025-02-12T16:09:14.776Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sonalsinha21 Products: Admire Extra Problem Types: CWE-79 Description: The Admire Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'space' shortcode in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inje
utor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bf682127-4b97-44ce-a94d-3a237c5af1cc?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3233979%40admire-extra&new=3233979%40admire-extra
CVE ID: CVE-2024-13666 State: PUBLISHED Published: 2025-03-22T08:24:17.721Z Last Updated: 2025-03-24T13:13:48.376Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: techjewel Products: Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Problem Types: CWE-20 Description: The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 5.2.12 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attack
se of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers spoof their IP address and submit forms that may have IP-based restrictions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e06fe8e4-e27a-4492-b175-3b0846e4cf10?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3258647%40fluentform%2Ftrunk&old=3242624%40fluentform%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13667 State: PUBLISHED Published: 2025-02-18T11:10:20.080Z Last Updated: 2025-02-18T14:19:49.411Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: undsgn Products: Uncode Problem Types: CWE-79 Description: The Uncode theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mle-description’ parameter in all versions up to, and including, 2.9.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA
trary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7ee188cc-2c3f-45e7-b7ce-928242035e37?source=cve - https://support.undsgn.com/hc/en-us/articles/213454129-Change-Log
CVE ID: CVE-2024-13668 State: PUBLISHED Published: 2025-03-07T09:49:49.030Z Last Updated: 2025-03-07T13:35:33.311Z Vendors: Unknown Products: WordPress Activity O Meter Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WordPress Activity O Meter WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a7bfc094-b235-419d-882d-96b439651f65/
CVE ID: CVE-2024-13669 State: PUBLISHED Published: 2025-02-26T06:00:11.629Z Last Updated: 2025-02-26T14:26:19.801Z Vendors: Unknown Products: CalendApp Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The CalendApp WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/71e69cf2-7d41-479c-9721-662b57571c90/
CVE ID: CVE-2024-13670 State: PUBLISHED Published: 2025-01-30T13:42:04.665Z Last Updated: 2025-01-30T14:43:43.464Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: efreja Products: Music Sheet Viewer Problem Types: CWE-79 Description: The Music Sheet Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pn_msv' shortcode in all versions up to, and including, 4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8ec4eb8a-7b03-4392-9137-4f17622bfe54?source=cve - https://plugins.trac.wordpress.org/browser/music-sheet-viewer/trunk/music-sheet-viewer.php#L395
CVE ID: CVE-2024-13671 State: PUBLISHED Published: 2025-01-30T13:41:58.484Z Last Updated: 2025-01-30T14:52:04.818Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: efreja Products: Music Sheet Viewer Problem Types: CWE-22 Description: The Music Sheet Viewer plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.1 via the read_score_file() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/569
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/569f1cd4-195b-41d4-85cb-f529a1eb18d4?source=cve - https://plugins.trac.wordpress.org/browser/music-sheet-viewer/trunk/music-sheet-viewer.php#L748
CVE ID: CVE-2024-13672 State: PUBLISHED Published: 2025-02-21T03:21:21.466Z Last Updated: 2025-02-21T21:28:02.922Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: minicoursegenerator Products: Mini Course Generator | Embed mini-courses and interactive content Problem Types: CWE-79 Description: The Mini Course Generator | Embed mini-courses and interactive content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mcg' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-
n and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b47505a5-fb7f-4e41-a6de-6f0b330aa495?source=cve - https://plugins.trac.wordpress.org/browser/mini-course-generator/tags/1.0.4/includes/class-mcg-shortcodes.php#L10 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3243023%40mini-course-generator&new=3243023%40mini-course-generator&sfp_email=&sfph_
sfp_email=&sfph_mail=&reponame=&old=3243023%40mini-course-generator&new=3243023%40mini-course-generator&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13673 State: PUBLISHED Published: 2025-04-03T07:21:21.832Z Last Updated: 2025-04-03T19:11:19.682Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bigboomdesign Products: Big Boom Directory Problem Types: CWE-79 Description: The Big Boom Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bbd-search' shortcode in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a u
ackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5284cbe4-1550-4f3c-be54-e2de8a089512?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3262078%40big-boom-directory&new=3262078%40big-boom-directory&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3258281%40big-boom-directory&new=3258281%40big-boom-directory&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13674 State: PUBLISHED Published: 2025-02-19T07:32:09.359Z Last Updated: 2025-02-19T16:40:10.479Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: berginformatik Products: Cosmic Blocks (40+) Content Editor Blocks Collection Problem Types: CWE-79 Description: The Cosmic Blocks (40+) Content Editor Blocks Collection plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cwp_social_share' shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and abo
g on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5cccd266-48a8-481e-8fbd-db5a9a72f55a?source=cve - https://wordpress.org/plugins/cosmic-blocks/
CVE ID: CVE-2024-13675 State: PUBLISHED Published: 2025-03-08T11:16:40.969Z Last Updated: 2025-03-11T16:07:09.198Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: amans2k Products: SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) Problem Types: CWE-79 Description: The SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Icon List" Block in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web s
. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f34904b5-3b3d-46d3-9e33-ef661d5f4149?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3251693%40slingblocks&new=3251693%40slingblocks&sfp_email=&sfph_mail=#file5
CVE ID: CVE-2024-13676 State: PUBLISHED Published: 2025-02-19T07:32:12.679Z Last Updated: 2025-02-19T14:37:09.045Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: wamasoftware Products: Categorized Gallery Plugin Problem Types: CWE-89 Description: The Categorized Gallery Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' attribute of the 'image_gallery' shortcode in all versions up to, and including, 2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additiona
query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b409ef44-18fa-4ea0-90a4-69e03fa0116e?source=cve - https://plugins.trac.wordpress.org/browser/categorized-gallery/trunk/init.php#L177
CVE ID: CVE-2024-13677 State: PUBLISHED Published: 2025-02-18T04:21:19.723Z Last Updated: 2025-02-18T15:35:07.771Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: istmoplugins Products: GetBookingsWP – Appointments Booking Calendar Plugin For WordPress Problem Types: CWE-862 Description: The GetBookingsWP – Appointments Booking Calendar Plugin For WordPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.27. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with subscriber-le
ntity prior to updating their details like email. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b6b0dc03-3715-41f8-8888-1cccddb39c0b?source=cve - https://plugins.trac.wordpress.org/browser/get-bookings-wp/trunk/classes/user.php
CVE ID: CVE-2024-13678 State: PUBLISHED Published: 2025-02-26T06:00:11.901Z Last Updated: 2025-02-26T14:18:21.939Z Vendors: Unknown Products: R3W InstaFeed Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The R3W InstaFeed WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ba759796-a152-4f13-a474-f0368b4bc1f6/
CVE ID: CVE-2024-13679 State: PUBLISHED Published: 2025-02-19T07:32:15.599Z Last Updated: 2025-02-19T15:06:54.082Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: simply4net Products: Widget BUY.BOX Problem Types: CWE-79 Description: The Widget BUY.BOX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'buybox-widget' shortcode in all versions up to, and including, 3.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acce
with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fba6abba-fe29-4a94-bf20-3db78737c275?source=cve - https://plugins.trac.wordpress.org/browser/buybox-widget/trunk/functions/Widget/Embed.php#L43
CVE ID: CVE-2024-13680 State: PUBLISHED Published: 2025-01-24T07:04:08.504Z Last Updated: 2025-02-12T20:41:30.518Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: codepeople Products: Form Builder CP Problem Types: CWE-89 Description: The Form Builder CP plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'CP_EASY_FORM_WILL_APPEAR_HERE' shortcode in all versions up to, and including, 1.2.41 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL qu
This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a018fcb1-b7a6-456f-ab0b-59ccc1fd5b67?source=cve - https://plugins.trac.wordpress.org/browser/cp-easy-form-builder/tags/1.2.41/cp_easy_form_builder.php#L297 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3214984%40cp-easy-form-builder&new=3214984%40cp-easy-form-builder&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13681 State: PUBLISHED Published: 2025-02-18T11:10:19.331Z Last Updated: 2025-02-18T14:23:39.182Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: undsgn Products: Uncode Problem Types: CWE-20 Description: The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_admin_get_oembed' function in all versions up to, and including, 2.9.1.6. This makes it possible for unauthenticated attackers to read arbitrary files on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7914ebe6-b5e1-4a1a-8794-80f515e6c9f6?
nrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7914ebe6-b5e1-4a1a-8794-80f515e6c9f6?source=cve - https://support.undsgn.com/hc/en-us/articles/213454129-Change-Log
CVE ID: CVE-2024-13682 State: PUBLISHED Published: 2025-03-04T08:23:40.786Z Last Updated: 2025-03-04T15:09:47.037Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: wpswings Products: Wallet System for WooCommerce Problem Types: CWE-352 Description: The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.2. This is due to missing or incorrect nonce validation in class-wallet-user-table.php. This makes it possible for unauthenticated attackers to modify wallet balances via a forged request granted they can
p. This makes it possible for unauthenticated attackers to modify wallet balances via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/779a9f7a-4582-4d5e-bd9a-9ff7f14b452a?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3244479%40wallet-system-for-woocommerce%2Ftrunk&old=3231275%40wallet-system-for-woocommerce%2Ftrunk&sfp_email=&sfph_mail=