Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-13385 State: PUBLISHED Published: 2025-01-18T07:05:09.598Z Last Updated: 2025-01-21T21:22:59.531Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jsmoriss Products: JSM Screenshot Machine Shortcode Problem Types: CWE-79 Description: The JSM Screenshot Machine Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ssm' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will exec
uthenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/91019c36-bf33-4cd6-ac54-86c118d086fe?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3224419%40screenshot-machine-shortcode&new=3224419%40screenshot-machine-shortcode&sfp_email=&sfph_mail= - https://github.com/jsmoriss/screenshot-machine-shortcode/blob/main/screenshot-machine-shortcode.php#L92-L119
CVE ID: CVE-2024-13386 State: PUBLISHED Published: 2025-01-17T07:01:27.447Z Last Updated: 2025-02-12T20:31:23.327Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: tobig Products: quote-posttype-plugin Problem Types: CWE-79 Description: The quote-posttype-plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Author field in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst
to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4aa09e5b-fc3d-4409-bf2c-dd8aae69eeda?source=cve - https://wordpress.org/plugins/quote-post-type-plugin/
CVE ID: CVE-2024-13387 State: PUBLISHED Published: 2025-01-16T09:39:13.521Z Last Updated: 2025-01-16T15:11:17.803Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: fahadmahmood Products: WP Responsive Tabs Problem Types: CWE-79 Description: The WP Responsive Tabs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprtabs' shortcode in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user
rs, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/39e58875-2f6e-453e-b33f-3d7a2a62b7b6?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3222481%40wp-responsive-tabs&new=3222481%40wp-responsive-tabs&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13388 State: PUBLISHED Published: 2025-02-21T03:21:19.113Z Last Updated: 2025-02-21T21:28:40.927Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: tcoder Products: TCBD Tooltip Problem Types: CWE-79 Description: The TCBD Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcbdtooltip_text' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an
ntributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/43ca15b7-8cb4-427f-892d-15022da17b2e?source=cve - https://wordpress.org/plugins/tcbd-tooltip/
CVE ID: CVE-2024-13389 State: PUBLISHED Published: 2025-01-23T11:13:29.293Z Last Updated: 2025-01-23T14:30:11.929Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cliptakes Products: Cliptakes Problem Types: CWE-79 Description: The Cliptakes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cliptakes_input_email' shortcode in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesse
h contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a939be31-7475-4626-ba1b-af9a9d6d5eda?source=cve - https://plugins.trac.wordpress.org/changeset/3226472/cliptakes/tags/1.3.5/public/class-cliptakes-public.php
CVE ID: CVE-2024-13390 State: PUBLISHED Published: 2025-02-19T07:32:07.041Z Last Updated: 2025-02-19T21:21:07.747Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: giuliopanda Products: ADFO – Custom data in admin dashboard Problem Types: CWE-79 Description: The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'adfo_list' shortcode in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in p
s it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/38537a5e-7e36-4c94-9d27-59a53dada47b?source=cve - https://wordpress.org/plugins/admin-form/
CVE ID: CVE-2024-13391 State: PUBLISHED Published: 2025-01-18T07:05:06.023Z Last Updated: 2025-01-21T21:28:17.243Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: videowhisper Products: MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet Problem Types: CWE-79 Description: The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_content_upload_guest' shortcode in all versions up to, and including, 2.9.29 due to insufficient input sanitization and output escaping on user supplied attributes. Thi
up to, and including, 2.9.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1b3948ef-11be-450d-ad20-e4bebc16e790?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3224254%40paid-membership&new=3224254%40paid-membership&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13392 State: PUBLISHED Published: 2025-01-18T07:11:24.414Z Last Updated: 2025-01-21T21:18:53.206Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: videowhisper Products: Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings Problem Types: CWE-79 Description: The Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_reviews' shortcode in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level ac
tput escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eb5a85ba-9545-4d64-ac7c-6b856e4ab354?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3224268%40rate-star-review&new=3224268%40rate-star-review&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13393 State: PUBLISHED Published: 2025-01-18T07:05:10.788Z Last Updated: 2025-01-21T21:20:23.839Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: videowhisper Products: Video Share VOD – Turnkey Video Site Builder Script Problem Types: CWE-79 Description: The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_videos' shortcode in all versions up to, and including, 2.6.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and abo
g on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f9e85d85-76cd-4606-918b-87f07098c967?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3224274%40video-share-vod&new=3224274%40video-share-vod&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13394 State: PUBLISHED Published: 2025-01-15T05:24:54.278Z Last Updated: 2025-01-15T15:04:45.623Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: swarminteractive Products: ViewMedica 9 Problem Types: CWE-79 Description: The ViewMedica 9 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'viewmedica' shortcode in all versions up to, and including, 1.4.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acce
with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b32c1b63-564c-4c38-a149-d5adabda8a8b?source=cve - https://plugins.trac.wordpress.org/browser/viewmedica/trunk/swarm.php - https://wordpress.org/plugins/viewmedica/
CVE ID: CVE-2024-13395 State: PUBLISHED Published: 2025-02-18T08:21:43.882Z Last Updated: 2025-02-18T14:32:26.194Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kerryoco Products: Threepress Problem Types: CWE-79 Description: The Threepress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'threepress' shortcode in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injec
tor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e7021881-2ce9-4c8b-bcfa-6886cce649d9?source=cve - https://plugins.trac.wordpress.org/browser/threepress/tags/1.7.1/threepress.php - https://plugins.trac.wordpress.org/browser/threepress/tags/1.7.2/threepress.php#L263
CVE ID: CVE-2024-13396 State: PUBLISHED Published: 2025-01-31T02:24:18.349Z Last Updated: 2025-01-31T19:36:26.712Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: spgajjar Products: Frictionless Problem Types: CWE-79 Description: The Frictionless plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'frictionless_form' shortcode[s] in all versions up to, and including, 0.0.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user ac
, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b1ec9dce-d0fb-4b7b-a8e4-4ccb474c9d57?source=cve - https://plugins.trac.wordpress.org/browser/frictionless/trunk/frictionless.php - https://wordpress.org/plugins/frictionless/
CVE ID: CVE-2024-13397 State: PUBLISHED Published: 2025-01-31T02:24:18.961Z Last Updated: 2025-01-31T16:53:26.879Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: casterfm Products: WPRadio – WordPress Radio Streaming Plugin Problem Types: CWE-79 Description: The WPRadio – WordPress Radio Streaming Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpradio_player' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web
s. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f153174a-1226-4c16-ba8b-637be1d7e742?source=cve - https://plugins.trac.wordpress.org/browser/wpradio/trunk/Frontend/Frontend.php#L140
CVE ID: CVE-2024-13398 State: PUBLISHED Published: 2025-01-17T04:30:20.060Z Last Updated: 2025-02-12T20:31:23.742Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: naa986 Products: Checkout for PayPal Problem Types: CWE-79 Description: The Checkout for PayPal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'checkout_for_paypal' shortcode in all versions up to, and including, 1.0.32 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute wheneve
d attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c2e552b8-84ad-436d-b029-f7dd4534f7d5?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3223256%40checkout-for-paypal&new=3223256%40checkout-for-paypal&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13399 State: PUBLISHED Published: 2025-01-31T02:24:17.397Z Last Updated: 2025-01-31T16:53:52.267Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gosign Products: Gosign – Posts Slider Block Problem Types: CWE-79 Description: The Gosign – Posts Slider Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'posts-slider-block' block in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inject
or-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0778c676-92e6-4813-a564-06463fc84eec?source=cve - https://wordpress.org/plugins/gosign-posts-slider-block/
CVE ID: CVE-2024-13400 State: PUBLISHED Published: 2025-01-30T13:42:09.686Z Last Updated: 2025-01-30T14:15:09.744Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gubbigubbi Products: Kona Gallery Block Problem Types: CWE-79 Description: The Kona Gallery Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Kona: Instagram for Gutenberg" Block, specifically in the "align" attribute, in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute
enticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e90045df-deb5-41ab-a285-c6b1573ae0f6?source=cve - https://wordpress.org/plugins/kona-instagram-feed-for-gutenberg/
CVE ID: CVE-2024-13401 State: PUBLISHED Published: 2025-01-17T04:30:18.971Z Last Updated: 2025-02-12T20:31:23.856Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: naa986 Products: Payment Button for PayPal Problem Types: CWE-79 Description: The Payment Button for PayPal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_paypal_checkout' shortcode in all versions up to, and including, 1.2.3.35 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will ex
authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/20fc675c-08a4-4d77-9872-335d23146906?source=cve - https://plugins.trac.wordpress.org/browser/wp-paypal/trunk/main.php#L72 - https://plugins.trac.wordpress.org/browser/wp-paypal/trunk/wp-paypal-checkout.php#L3 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3223257%40wp-paypal&new=3223257%40wp-paypal&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13402 State: PUBLISHED Published: 2025-02-27T12:47:01.149Z Last Updated: 2025-02-27T14:19:55.288Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Boss Media Products: Buddyboss Platform Problem Types: CWE-79 Description: The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_title’ parameter in all versions up to, and including, 2.7.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additiona
d above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/42743c2f-053b-4f14-bf11-865f978ec017?source=cve - https://www.buddyboss.com/resources/buddyboss-platform-releases/2-8-00/
CVE ID: CVE-2024-13403 State: PUBLISHED Published: 2025-02-04T08:21:07.076Z Last Updated: 2025-02-04T14:23:58.776Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: smub Products: WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More Problem Types: CWE-79 Description: The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fieldHTML’ parameter in all versions up to, and including, 1.9.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributo
insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/92ea6a89-b14f-4252-b886-e219c1bb658d?source=cve - https://plugins.trac.wordpress.org/browser/wpforms-lite/trunk/assets/js/frontend/wpforms.js#L172 - https://wordpress.org/plugins/wpforms-lite/#developers - https://plugins.trac.wordpress.org/changeset/3230497/wpforms-lite/trunk/assets/js/frontend/wpforms.js?old=3223577&old_path=
ps://plugins.trac.wordpress.org/changeset/3230497/wpforms-lite/trunk/assets/js/frontend/wpforms.js?old=3223577&old_path=wpforms-lite%2Ftrunk%2Fassets%2Fjs%2Ffrontend%2Fwpforms.js
CVE ID: CVE-2024-13404 State: PUBLISHED Published: 2025-01-21T09:21:10.545Z Last Updated: 2025-01-21T15:16:04.974Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: jackdewey Products: Link Library Problem Types: CWE-79 Description: The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'searchll' parameter in all versions up to, and including, 7.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analys
at execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f01362dc-4f3d-4b77-b802-01b436287237?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3225694%40link-library&new=3225694%40link-library&sfp_email=&sfph_mail=