Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11317 State: PUBLISHED Published: 2024-12-05T12:36:27.768Z Last Updated: 2024-12-05T18:49:49.571Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: ABB Products: ASPECT-Enterprise, NEXUS Series, MATRIX Series Problem Types: CWE-384 Description: Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCod
CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108469A7497&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2024-11318 State: PUBLISHED Published: 2024-11-18T13:47:19.215Z Last Updated: 2024-11-18T14:08:35.909Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Baratz Innovación Products: AbsysNet Problem Types: CWE-639 Description: An IDOR (Insecure Direct Object Reference) vulnerability has been discovered in AbsysNet, affecting version 2.3.1. This vulnerability could allow a remote attacker to obtain the session of an unauthenticated user by brute-force attacking the session identifier on the "/cgi-bin/ocap/" endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/idor-vulnerability-ab
t Notes: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/idor-vulnerability-absysnet
CVE ID: CVE-2024-11319 State: PUBLISHED Published: 2024-11-18T11:53:04.244Z Last Updated: 2025-09-16T13:47:11.237Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: django CMS Association Products: django-cms Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django-cms allows Cross-Site Scripting (XSS).This issue affects django-cms: 3.11.7, 3.11.8, 4.1.2, 4.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1859 - https://github.com/django-cms/django-cms/commit/241d1cbe47a68f5d271ce4d27ad
ttps://www.usom.gov.tr/bildirim/tr-24-1859 - https://github.com/django-cms/django-cms/commit/241d1cbe47a68f5d271ce4d27ad5e32e2c360ec3 - https://www.django-cms.org/en/blog/2024/11/13/django-cms-security-update/ - https://iltosec.com/blog/post/django-cms-413-stored-xss-vulnerability-exploiting-the-page-title-field/
CVE ID: CVE-2024-11320 State: PUBLISHED Published: 2024-11-21T10:03:08.739Z Last Updated: 2024-11-21T14:39:13.711Z Vendors: Pandora FMS Products: Pandora FMS Problem Types: CWE-77 Description: Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue affects Pandora FMS: from 700 through <=777.4 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2024-11321 State: PUBLISHED Published: 2024-12-06T13:37:29.699Z Last Updated: 2024-12-06T17:50:04.223Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Hi e-learning Products: Learning Management System (LMS) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hi e-learning Learning Management System (LMS) allows Reflected XSS.This issue affects Learning Management System (LMS): before 06.12.2024. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1878
CVE ID: CVE-2024-11322 State: PUBLISHED Published: 2025-01-15T14:03:00.527Z Last Updated: 2025-01-15T14:27:49.458Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: C4.yberPower Products: PowerPanel Business Problem Types: CWE-287 Description: A denial-of-service vulnerability exists in CyberPower PowerPanel Business (PPB) 4.11.0. An unauthenticated remote attacker can restart the ppbd.exe process via the PowerPanel Business Service Watchdog service listening on TCP port 2003. The attacker can repeatedly restart ppbd.exe to render it unavailable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2025-0
e. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2025-01
CVE ID: CVE-2024-11323 State: PUBLISHED Published: 2024-12-06T08:24:52.190Z Last Updated: 2024-12-06T17:24:32.675Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: kekotron Products: AI Quiz | Quiz Maker Problem Types: CWE-862 Description: The AI Quiz | Quiz Maker plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ai_quiz_update_style() function in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the
ubscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/53591a3b-8a99-40e2-8145-1d7785bcbab4?source=cve - https://plugins.trac.wordpress.org/browser/ai-quiz/tags/1.1/functions.php#L688
CVE ID: CVE-2024-11324 State: PUBLISHED Published: 2024-12-05T09:23:07.729Z Last Updated: 2024-12-05T11:13:24.212Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: bastho Products: Accounting for WooCommerce Problem Types: CWE-79 Description: The Accounting for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Addition
pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f34b7518-5cb3-4b4e-8b18-927c08c045f7?source=cve - https://plugins.trac.wordpress.org/browser/accounting-for-woocommerce/tags/stable/views/export.php#L46 - https://plugins.trac.wordpress.org/changeset/3201725/
CVE ID: CVE-2024-11325 State: PUBLISHED Published: 2024-12-03T09:32:00.451Z Last Updated: 2024-12-03T11:23:41.537Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: fatcatapps Products: AWeber Forms by Optin Cat Problem Types: CWE-79 Description: The AWeber Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additi
in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/21c09207-38a1-47ae-ae1e-52f8eea4785d?source=cve - https://plugins.trac.wordpress.org/browser/aweber-wp/trunk/includes/eoi-subscribers.php#L353 - https://plugins.trac.wordpress.org/changeset/3198559/aweber-wp/trunk/includes/eoi-subscribers.php
CVE ID: CVE-2024-11326 State: PUBLISHED Published: 2024-12-03T11:04:03.533Z Last Updated: 2024-12-03T11:23:41.044Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: fatcatapps Products: Campaign Monitor Forms by Optin Cat Problem Types: CWE-79 Description: The Campaign Monitor Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicki
bitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/95ebb2ad-91a8-4a0d-ba91-f417943545b4?source=cve - https://plugins.trac.wordpress.org/browser/campaign-monitor-wp/trunk/includes/eoi-subscribers.php#L353 - https://plugins.trac.wordpress.org/changeset/3198560/campaign-monitor-wp/trunk/includes/eoi-subscribers.php
CVE ID: CVE-2024-11327 State: PUBLISHED Published: 2025-01-11T02:20:54.908Z Last Updated: 2025-01-13T19:53:17.056Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: flowdee Products: ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages Problem Types: CWE-79 Description: The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.1. This makes it possible for unauthenticated attackers to
escaping on the URL in all versions up to, and including, 2.4.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/96c5836f-6d33-4a56-b30b-5e5d95b81b6b?source=cve - https://plugins.trac.wordpress.org/browser/clickwhale/tags/2.3.0/includes/admin/links/Clickwhale_Links_List_Table.php#L384 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3219341%40clickwhale&new=3219341%40clickwhale&sfp_email=&
ac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3219341%40clickwhale&new=3219341%40clickwhale&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11328 State: PUBLISHED Published: 2025-01-09T11:10:59.019Z Last Updated: 2025-01-09T15:06:07.904Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: cluevo Products: CLUEVO LMS, E-Learning Platform Problem Types: CWE-79 Description: The CLUEVO LMS, E-Learning Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.13.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such a
nject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5bcfe315-2db1-4f6c-9635-a7fdf5404adf?source=cve - https://plugins.trac.wordpress.org/browser/cluevo-lms/tags/1.13.2/functions/functions.module-management.inc.php#L788 - https://plugins.trac.wordpress.org/browser/cluevo-lms/tags/1.13.2/admin-views/class.module-ratings-page.php#L173 - https://plugins.trac.wordpress.org/browser/cluevo-lms/tags/1.13.2/functions/functions.module-management.inc.php#L1228 - https://plugins.trac.wordpress.
org/browser/cluevo-lms/tags/1.13.2/functions/functions.module-management.inc.php#L1228 - https://plugins.trac.wordpress.org/browser/cluevo-lms/tags/1.13.2/functions/functions.module-management.inc.php#L1230 - https://plugins.trac.wordpress.org/browser/cluevo-lms/tags/1.13.2/functions/functions.module-management.inc.php#L1242
CVE ID: CVE-2024-11329 State: PUBLISHED Published: 2024-12-07T01:45:04.050Z Last Updated: 2024-12-09T16:23:50.652Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: comfino Products: Comfino Payment Gateway Problem Types: CWE-79 Description: The Comfino Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.1.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a
web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/006945a3-5f54-4bb8-9522-c832d59624a0?source=cve - https://plugins.trac.wordpress.org/browser/comfino-payment-gateway/tags/4.1.0/views/admin/configuration.php#L39
CVE ID: CVE-2024-11330 State: PUBLISHED Published: 2024-11-23T06:54:49.914Z Last Updated: 2024-11-23T13:18:20.280Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: algoritmika Products: Custom CSS, JS & PHP Problem Types: CWE-79 Description: The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.3.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a li
b scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3497974d-cf58-4b38-a2c9-9bcd119ef43e?source=cve - https://plugins.trac.wordpress.org/browser/custom-css/tags/2.3.0/includes/settings/class-alg-custom-css-js-php-settings.php#L299 - https://plugins.trac.wordpress.org/changeset/3194786/custom-css/trunk/includes/settings/class-alg-custom-css-js-php-settings.php
CVE ID: CVE-2024-11331 State: PUBLISHED Published: 2024-12-20T06:59:08.724Z Last Updated: 2024-12-20T17:37:23.503Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: sisoog Products: استخراج محصولات ووکامرس برای آیسی Problem Types: CWE-79 Description: The استخراج محصولات ووکامرس برای آیسی plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action suc
o inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/af0cc02a-b6dd-4058-b686-9c9a3a4a5962?source=cve - https://plugins.trac.wordpress.org/browser/isee-products-extractor/tags/2.1.2/admin/pages/products_list.php#L92 - https://plugins.trac.wordpress.org/browser/isee-products-extractor/tags/2.1.2/admin/pages/products_list.php#L99 - https://plugins.trac.wordpress.org/browser/isee-products-extractor/tags/2.1.2/admin/pages/products_list.php#L105
CVE ID: CVE-2024-11332 State: PUBLISHED Published: 2024-11-23T04:32:21.198Z Last Updated: 2024-11-23T13:18:23.037Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: hipaatizer Products: HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents Problem Types: CWE-79 Description: The HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hipaatizer' shortcode in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated atta
icient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/988a7d0a-72d2-4962-bcb4-b08859de925c?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3192694%40hipaatizer&new=3192694%40hipaatizer&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11333 State: PUBLISHED Published: 2024-11-28T08:47:32.887Z Last Updated: 2024-11-28T12:45:20.031Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: r00tsector Products: HLS Player Problem Types: CWE-79 Description: The HLS Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hls_player' shortcode in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an in
ibutor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/808695a2-4d34-4b43-88a6-7da788100f2e?source=cve - https://plugins.trac.wordpress.org/changeset/3197684/hls-player/tags/1.0.11/hls-player.php
CVE ID: CVE-2024-11334 State: PUBLISHED Published: 2024-11-21T05:33:50.921Z Last Updated: 2024-11-21T11:40:10.945Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: luydjmi Products: My Contador lesr Problem Types: CWE-862 Description: The My Contador lesr plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportar_registros() function in all versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to export user data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/82cfeff9-7079-408e-9c22-bae0d45000
Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/82cfeff9-7079-408e-9c22-bae0d45000ed?source=cve - https://plugins.trac.wordpress.org/browser/my-contador-wp/trunk/contador.php#L159 - https://plugins.trac.wordpress.org/changeset/3191748/my-contador-wp/trunk/contador.php
CVE ID: CVE-2024-11335 State: PUBLISHED Published: 2025-02-19T07:32:11.445Z Last Updated: 2025-02-19T16:32:55.793Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ultradevs Products: UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included Problem Types: CWE-79 Description: The UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframe' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers
t input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9bfaff5c-25b0-470a-b1ef-fce5976ce205?source=cve - https://wordpress.org/plugins/ultraembed-advanced-iframe/
CVE ID: CVE-2024-11336 State: PUBLISHED Published: 2024-12-06T08:24:52.913Z Last Updated: 2024-12-06T14:18:26.509Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: dactum Products: Clickbank WordPress Plugin (Storefront) Problem Types: CWE-352 Description: The Clickbank WordPress Plugin (Storefront) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing or incorrect nonce validation via the cs_menu page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performi
settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/57789905-1e08-41c5-bfda-b1d6d33de4c0?source=cve - https://plugins.trac.wordpress.org/browser/clickbank-storefront/trunk/admin.inc.php#L700
CVE ID: CVE-2024-11337 State: PUBLISHED Published: 2025-01-07T04:22:02.848Z Last Updated: 2025-01-07T16:22:32.506Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: divineapi Products: Horoscope And Tarot Problem Types: CWE-79 Description: The Horoscope And Tarot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'divine_horoscope' shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6d833338-a343-446f-a3f1-cb5e2cff6585?source=cve - https://wordpress.org/plugins/horoscope-and-tarot/
CVE ID: CVE-2024-11338 State: PUBLISHED Published: 2025-01-07T04:21:56.040Z Last Updated: 2025-01-07T16:25:54.421Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: daniel1088 Products: PIXNET Plugin Problem Types: CWE-79 Description: The PIXNET Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gtm' and 'venue' parameters in all versions up to, and including, 2.9.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional An
ove, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/165bafd4-0cef-4936-af21-6a8ffcfccaef?source=cve - https://wordpress.org/plugins/pixnet/