Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ct arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b91ec428-8444-4304-8901-4bc3ef146e3e?source=cve - https://wordpress.org/plugins/opt-in-hound/#developers - https://plugins.trac.wordpress.org/browser/opt-in-hound/trunk/includes/subscribers/views/view-submenu-page-subscribers.php#L17
CVE ID: CVE-2024-9268 State: REJECTED Published: N/A Last Updated: 2024-09-27T16:51:06.016Z Description: No description available.
CVE ID: CVE-2024-9269 State: PUBLISHED Published: 2024-10-01T07:30:08.091Z Last Updated: 2024-10-01T16:09:08.391Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cconover Products: Relogo Problem Types: CWE-79 Description: The Relogo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
n pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/12515236-753e-49e8-b8c8-b0c8831c6005?source=cve - https://wordpress.org/plugins/relogo/#developers
CVE ID: CVE-2024-9270 State: PUBLISHED Published: 2024-11-09T02:03:01.684Z Last Updated: 2024-11-09T15:44:42.230Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ogunlab Products: Lenxel Core for Lenxel(LNX) LMS Problem Types: CWE-79 Description: The Lenxel Core for Lenxel(LNX) LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Addition
ss and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2e1d1283-3bd9-458e-81ca-9934b293415a?source=cve - https://wordpress.org/plugins/lenxel-core/#developers
CVE ID: CVE-2024-9271 State: PUBLISHED Published: 2024-10-04T09:30:42.195Z Last Updated: 2024-10-04T13:40:55.475Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: remydcf Products: Re:WP Problem Types: CWE-79 Description: The Re:WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
ages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a7d340b9-6a77-481c-983c-f4774ecff285?source=cve - https://wordpress.org/plugins/rewp/#developers - https://plugins.trac.wordpress.org/changeset/3161983/
CVE ID: CVE-2024-9272 State: PUBLISHED Published: 2024-10-01T07:30:12.276Z Last Updated: 2024-10-01T13:53:56.889Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mascotdevelopers Products: R Animated Icon Plugin Problem Types: CWE-79 Description: The R Animated Icon Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analys
ove, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/56fd8166-da22-4a0b-a23f-41817acba6df?source=cve - https://wordpress.org/plugins/r-animated-icon/#developers
CVE ID: CVE-2024-9273 State: REJECTED Published: N/A Last Updated: 2024-09-27T16:51:13.902Z Description: No description available.
CVE ID: CVE-2024-9274 State: PUBLISHED Published: 2024-10-01T07:30:10.278Z Last Updated: 2024-10-01T15:47:56.017Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: azexo Products: Elastik Page Builder Problem Types: CWE-79 Description: The Elastik Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.27.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - C
ct arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/315687d4-9125-440b-9d53-81d71e56d4ef?source=cve - https://wordpress.org/plugins/elastik-page-builder/#developers
CVE ID: CVE-2024-9275 State: PUBLISHED Published: 2024-09-27T10:31:04.525Z Last Updated: 2024-09-27T15:39:36.388Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: jeanmarc77 Products: 123solar Problem Types: CWE-73 Description: A vulnerability was found in jeanmarc77 123solar up to 1.8.4.5. It has been rated as critical. This issue affects some unknown processing of the file /admin/admin_invt2.php. The manipulation of the argument PROTOCOLx leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278657 - https://vuldb.com/?cti
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278657 - https://vuldb.com/?ctiid.278657 - https://vuldb.com/?submit.408326 - https://github.com/jeanmarc77/123solar/issues/75
CVE ID: CVE-2024-9276 State: PUBLISHED Published: 2024-09-27T10:31:05.584Z Last Updated: 2024-09-27T15:34:32.926Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: TMsoft Products: MyAuth Gateway Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in TMsoft MyAuth Gateway 3. Affected is an unknown function of the file /index.php. The manipulation of the argument console/nocache/cmd leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnr
dor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278658 - https://vuldb.com/?ctiid.278658 - https://vuldb.com/?submit.409126
CVE ID: CVE-2024-9277 State: PUBLISHED Published: 2024-09-27T11:00:06.911Z Last Updated: 2024-09-27T15:02:06.393Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Langflow Problem Types: CWE-1333 Description: A vulnerability classified as problematic was found in Langflow up to 1.0.18. Affected by this vulnerability is an unknown functionality of the file \src\backend\base\langflow\interface\utils.py of the component HTTP POST Request Handler. The manipulation of the argument remaining_text leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disc
complexity. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278659 - https://vuldb.com/?ctiid.278659 - https://vuldb.com/?submit.410043 - https://rumbling-slice-eb0.notion.site/Remote-Redos-in-https-github-com-langflow-ai-langflow-067159ced0d5494e91b06071384969c4?pvs=4
CVE ID: CVE-2024-9278 State: PUBLISHED Published: 2024-09-27T11:00:11.336Z Last Updated: 2024-09-27T14:58:00.573Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: HuankeMao Products: SCRM Problem Types: CWE-434 Description: A vulnerability, which was classified as critical, has been found in HuankeMao SCRM up to 0.0.3. Affected by this issue is the function upload_domain_verification_file of the file WxkConfig.php of the component Administrator Backend. The manipulation of the argument domain_verification_file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnri
ched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278660 - https://vuldb.com/?ctiid.278660 - https://vuldb.com/?submit.410393 - https://wiki.shikangsi.com/post/share/96b7d919-1749-4e2b-bda2-b80d2fd23865
CVE ID: CVE-2024-9279 State: PUBLISHED Published: 2024-09-27T11:31:04.891Z Last Updated: 2024-09-27T14:35:16.383Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: funnyzpc Products: Mee-Admin Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in funnyzpc Mee-Admin up to 1.6. This affects an unknown part of the file /mee/index of the component User Center. The manipulation of the argument User Nickname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additiona
e public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278661 - https://vuldb.com/?ctiid.278661 - https://vuldb.com/?submit.411118 - https://github.com/Armnying/Vulnerability-recurrence-sortin/blob/main/Mee-admin-xss.md
CVE ID: CVE-2024-9280 State: PUBLISHED Published: 2024-09-27T12:00:07.760Z Last Updated: 2024-09-27T14:29:52.320Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: kalvinGit Products: kvf-admin Problem Types: CWE-434 Description: A vulnerability has been found in kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff and classified as critical. This vulnerability affects the function fileUpload of the file FileUploadKit.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, n
disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278662 - https://vuldb.com/?ctiid.278662 - https://vuldb.com/?submit.410994 - https://github.com/Arvin-Shi/111/issues/1
CVE ID: CVE-2024-9281 State: PUBLISHED Published: 2024-09-27T12:31:04.158Z Last Updated: 2024-09-27T14:23:39.621Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: bg5sbk Products: MiniCMS Problem Types: CWE-352 Description: A vulnerability was found in bg5sbk MiniCMS up to 1.11 and classified as problematic. This issue affects some unknown processing of the file post-edit.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions confusing version and file name information. The vendor was contacted early about this disclosure but did not respo
ions confusing version and file name information. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278663 - https://vuldb.com/?ctiid.278663 - https://vuldb.com/?submit.411164 - https://github.com/bg5sbk/MiniCMS/issues/51
CVE ID: CVE-2024-9282 State: PUBLISHED Published: 2024-09-27T13:00:07.408Z Last Updated: 2024-09-27T14:33:07.666Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: bg5sbk Products: MiniCMS Problem Types: CWE-352 Description: A vulnerability was found in bg5sbk MiniCMS 1.11. It has been classified as problematic. Affected is an unknown function of the file page-edit.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions confusing version and file name information. The vendor was contacted early about this disclosure but did not respo
ions confusing version and file name information. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278664 - https://vuldb.com/?ctiid.278664 - https://vuldb.com/?submit.411165 - https://github.com/bg5sbk/MiniCMS/issues/52
CVE ID: CVE-2024-9283 State: PUBLISHED Published: 2024-09-27T14:00:06.600Z Last Updated: 2024-09-27T14:12:14.364Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: RelaxedJS Products: ReLaXed Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in RelaxedJS ReLaXed up to 0.2.2. Affected is an unknown function of the component Pug to PDF Converter. The manipulation leads to cross site scripting. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278676 - https://vuldb.com/?ctiid.278676 - ht
nalyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278676 - https://vuldb.com/?ctiid.278676 - https://vuldb.com/?submit.411185 - https://drive.google.com/file/d/1Ll1dRwQds8987S-l5o2iJu4MQRG-p4-A/view?usp=sharing
CVE ID: CVE-2024-9284 State: PUBLISHED Published: 2024-09-27T16:31:04.406Z Last Updated: 2024-09-27T18:38:13.225Z Severity: N/A (CVSS 6.8 AV:N/AC:L/Au:S/C:N/I:N/A:C) Vendors: TP-LINK Products: TL-WR841ND Problem Types: CWE-121 Description: A vulnerability was found in TP-LINK TL-WR841ND up to 20240920. It has been rated as critical. Affected by this issue is some unknown functionality of the file /userRpm/popupSiteSurveyRpm.htm. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additio
the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278684 - https://vuldb.com/?ctiid.278684 - https://vuldb.com/?submit.411526 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TP-LINK/WR-841ND/popupSiteSurveyRpm.md - https://www.tp-link.com/
CVE ID: CVE-2024-9285 State: PUBLISHED Published: 2025-02-27T16:35:04.148Z Last Updated: 2025-02-27T18:30:44.664Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Tu Yafeng Products: Via Browser Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Tu Yafeng Via Browser up to 5.9.0 on Android. It has been rated as problematic. This issue affects some unknown processing of the component Javascript Bridge. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
ed. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.297863 - https://vuldb.com/?ctiid.297863 - https://modzero.com/en/advisories/mz-25-01-via-browser/ - https://modzero.com/static/MZ-25-01_modzero_uXSS-in-Via-Browser.pdf
CVE ID: CVE-2024-9286 State: PUBLISHED Published: 2024-10-09T13:13:44.499Z Last Updated: 2025-10-14T13:05:47.775Z Vendors: TRtek Software Products: Distant Education Platform Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TRtek Software Distant Education Platform allows SQL Injection, Parameter Injection.This issue affects Distant Education Platform: before 3.2024.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1649
CVE ID: CVE-2024-9287 State: PUBLISHED Published: 2024-10-22T16:34:39.210Z Last Updated: 2025-11-03T22:33:21.116Z Vendors: Python Software Foundation Products: CPython Problem Types: CWE-428 Description: A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being
vironment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/python/cpython/issues/124651 - https://github.com/python/cpython/pull/124712 - https://mail.python.org/archives/list/security-announce@python.org/thread/RSPJ2B5JL22FG3TKUJ7D7DQ4N5JRRBZL/ - https://github.com/python/cpython/commit/e52095a0c1005a87eed2276af7a1f2f66e2b6483 - https://github.com/python/cpython/commit/633555735a023d3e4d92ba31da35b1205f9ecbd7 - https://github.com/python/cpython/commit/8450b2482586857d689b6658
thon/commit/633555735a023d3e4d92ba31da35b1205f9ecbd7 - https://github.com/python/cpython/commit/8450b2482586857d689b6658f08de9c8179af7db - https://github.com/python/cpython/commit/9286ab3a107ea41bd3f3c3682ce2512692bdded8 - https://github.com/python/cpython/commit/ae961ae94bf19c8f8c7fbea3d1c25cc55ce8ae97 - https://github.com/python/cpython/commit/d48cc82ed25e26b02eb97c6263d95dcaa1e9111b
CVE ID: CVE-2024-9289 State: PUBLISHED Published: 2024-10-01T08:30:19.607Z Last Updated: 2024-10-01T14:27:13.343Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: RedefiningTheWeb Products: WordPress & WooCommerce Affiliate Program Problem Types: CWE-288 Description: The WordPress & WooCommerce Affiliate Program plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 8.4.1. This is due to the rtwwwap_login_request_callback() function not properly validating a user's identity prior to authenticating them to the site. This makes it possible for unauthenticated attackers to log in as any user, including administrators,
them to the site. This makes it possible for unauthenticated attackers to log in as any user, including administrators, granted they have access to the administrator's email. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ed19835f-2718-41d8-95af-47c8b9589529?source=cve - https://codecanyon.net/item/wordpress-woocommerce-affiliate-program/23580333
CVE ID: CVE-2024-9290 State: PUBLISHED Published: 2024-12-13T09:27:28.638Z Last Updated: 2024-12-23T20:09:37.055Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: azzaroco Products: Super Backup & Clone - Migrate for WordPress Problem Types: CWE-434 Description: The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibk_restore_migrate_check() function in all versions up to, and including, 2.3.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code
ssible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7c31d9b3-38b1-49a1-b361-ffe97e02bff0?source=cve - https://codecanyon.net/item/super-backup-clone-migrate-for-wordpress/12943030
CVE ID: CVE-2024-9291 State: PUBLISHED Published: 2024-09-27T21:00:09.184Z Last Updated: 2024-09-30T16:46:08.923Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: kalvinGit Products: kvf-admin Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff. Affected is an unknown function of the file /ueditor/upload?configPath=ueditor/config.json&action=uploadfile of the component XML File Handler. The manipulation of the argument upfile leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This produc
It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The GitHub repository of the project did not receive an update for more than two years. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.278784 - https://vuldb.com/?ctiid.278784 - https://vuldb.com/?submit.411202 - https://github.com/daxiangya/kvf-admin/issues/1 - https://github.com/user-attachments/files/17058501/kvf-admin_xss.md
CVE ID: CVE-2024-9292 State: PUBLISHED Published: 2024-10-08T05:36:26.043Z Last Updated: 2024-10-08T14:07:41.402Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: QODE Products: Bridge Core Problem Types: CWE-79 Description: The Bridge Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formforall' shortcode in versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additio
ermissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1baa93da-9b55-45e7-b9a9-db331b5d0584?source=cve - https://themeforest.net/item/bridge-creative-multipurpose-wordpress-theme/7315054