Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-13486 State: PUBLISHED Published: 2025-05-15T20:07:01.836Z Last Updated: 2025-05-20T19:26:56.432Z Vendors: Unknown Products: Icegram Engage Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cbba8346-41f6-46ee-89ae-ed9524d768ef/
CVE ID: CVE-2024-13487 State: PUBLISHED Published: 2025-02-06T06:53:40.819Z Last Updated: 2025-02-18T18:14:10.170Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: villatheme Products: CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 9.x Problem Types: CWE-94 Description: The The CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution via the get_products_price() function in all versions up to, and including, 2.2.5. This is due to the software allowing users to execute an actio
e() function in all versions up to, and including, 2.2.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d630dd85-0169-4582-a8ae-54e5053425ac?source=cve - https://plugins.trac.wordpress.org/browser/woo-multi-currency/trunk/frontend/cache.php#L60 - https://wordpress.org/plugins/woo-multi-currency/#developers - https://plugins.trac.wordpress.org/changeset/3234505/
CVE ID: CVE-2024-13488 State: PUBLISHED Published: 2025-02-15T11:26:49.179Z Last Updated: 2025-02-18T19:36:05.822Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: enituretechnology Products: LTL Freight Quotes – Estes Edition Problem Types: CWE-89 Description: The LTL Freight Quotes – Estes Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions up to, and including, 3.3.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already
e existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b77b064d-ab8c-4e84-b5cc-efbdeefbf502?source=cve - https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-estes-edition/trunk/warehouse-dropship/wild/includes/wild-delivery-save.php#L250 - https://plugins.trac.wordpress.org/browser/ltl-freight-quotes-estes-edition/trunk/warehouse-dropship/wild/includes/wild-delivery-save.php#L364 - https://plugins.trac.wordpress
quotes-estes-edition/trunk/warehouse-dropship/wild/includes/wild-delivery-save.php#L364 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3239967%40ltl-freight-quotes-estes-edition&new=3239967%40ltl-freight-quotes-estes-edition&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13489 State: PUBLISHED Published: 2025-02-19T09:21:59.000Z Last Updated: 2025-02-19T14:50:41.097Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: enituretechnology Products: LTL Freight Quotes – Old Dominion Edition Problem Types: CWE-89 Description: The LTL Freight Quotes – Old Dominion Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions up to, and including, 4.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queri
eparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3c7d63fc-288b-4f2f-85cd-e94add07a536?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3242160%40ltl-freight-quotes-odfl-edition&new=3242160%40ltl-freight-quotes-odfl-edition&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13490 State: PUBLISHED Published: 2025-02-12T09:22:50.362Z Last Updated: 2025-02-12T16:08:03.901Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: enituretechnology Products: LTL Freight Quotes – XPO Edition Problem Types: CWE-89 Description: The LTL Freight Quotes – XPO Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions up to, and including, 4.3.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already exi
isting SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8bcfbc26-9b5d-4df8-9f16-293734bd2805?source=cve - https://plugins.trac.wordpress.org/changeset/3235163
CVE ID: CVE-2024-13491 State: PUBLISHED Published: 2025-02-19T11:10:41.045Z Last Updated: 2025-02-19T14:27:32.557Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: enituretechnology Products: Small Package Quotes – For Customers of FedEx Problem Types: CWE-89 Description: The Small Package Quotes – For Customers of FedEx plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions up to, and including, 4.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQ
ient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ba311865-be4b-4c56-a761-409582e981b5?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3242108%40small-package-quotes-fedex-edition&new=3242108%40small-package-quotes-fedex-edition&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13492 State: PUBLISHED Published: 2025-02-07T06:00:06.954Z Last Updated: 2025-02-07T15:52:37.852Z Vendors: Unknown Products: Guten Free Options Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Guten Free Options WordPress plugin through 0.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a4a75b75-4801-4ed4-bcc6-4874ac169562/
CVE ID: CVE-2024-13493 State: PUBLISHED Published: 2025-02-14T06:00:05.654Z Last Updated: 2025-02-14T16:35:24.986Z Vendors: Unknown Products: Sensly Online Presence Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Sensly Online Presence WordPress plugin through 0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/dfbdd474-92e5-422b-a185-e441a6014557/
CVE ID: CVE-2024-13494 State: PUBLISHED Published: 2025-02-25T07:30:31.044Z Last Updated: 2025-02-25T14:37:29.136Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: nickboss Products: WordPress File Upload Problem Types: CWE-352 Description: The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. This is due to missing or incorrect nonce validation on the 'wfu_file_details' function. This makes it possible for unauthenticated attackers to modify user data details associated with uploaded files via a forged request granted they can trick a site administrator into performing an acti
associated with uploaded files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/595a6ab3-0731-4ef4-a385-5dfebbd917f4?source=cve - https://plugins.trac.wordpress.org/changeset/3241028/wp-file-upload
CVE ID: CVE-2024-13495 State: PUBLISHED Published: 2025-01-22T11:07:57.323Z Last Updated: 2025-01-22T14:20:45.183Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: rubengc Products: GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress Problem Types: CWE-94 Description: The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via the gamipress_ajax_get_logs() function in all versions up to, and including, 7.2.1. This is due to the software allowing users to execute an action that does not properly validate a value
cluding, 7.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/55fa8423-9a41-4afe-9401-03d232caa656?source=cve - https://wordpress.org/plugins/gamipress/#developers - https://plugins.trac.wordpress.org/browser/gamipress/trunk/includes/ajax-functions.php#L39 - https://plugins.trac.wordpress.org/changeset/3226227/
CVE ID: CVE-2024-13496 State: PUBLISHED Published: 2025-01-22T11:07:58.693Z Last Updated: 2025-03-24T15:50:39.128Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: rubengc Products: GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress Problem Types: CWE-89 Description: The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This ma
sufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: This vulnerability was previously published as being fixed in version 7.2.2 which was incorrect. The correct fixed version is 7.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ea54436c-b623-4049-af19-9995c312476e?source=cve - https://plugins.trac.wordpress.org/browser/gamipress/trunk/libraries/ct/includes/class-ct-
f19-9995c312476e?source=cve - https://plugins.trac.wordpress.org/browser/gamipress/trunk/libraries/ct/includes/class-ct-query.php#L160 - https://plugins.trac.wordpress.org/browser/gamipress/trunk/includes/ajax-functions.php#L39 - https://wordpress.org/plugins/gamipress/#developers - https://plugins.trac.wordpress.org/changeset/3226227/ - https://abrahack.com/posts/gamipress-sqli/
CVE ID: CVE-2024-13497 State: PUBLISHED Published: 2025-03-15T04:22:08.315Z Last Updated: 2025-03-17T16:53:51.856Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: tripetto Products: WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto Problem Types: CWE-80 Description: The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via attachment uploads in all versions up to, and including, 8.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages
tion and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the uploaded file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fbbe006c-1afc-4c8b-a9f3-ffb21cdabb54?source=cve - https://plugins.trac.wordpress.org/browser/tripetto/trunk/lib/attachments.php#L46 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3251202%40tripetto%2Ftrunk&old=3231968%40tripetto%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13498 State: PUBLISHED Published: 2025-03-12T05:22:52.045Z Last Updated: 2025-03-12T13:15:58.966Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: webaways Products: NEX-Forms – Ultimate Form Builder – Contact forms and much more Problem Types: CWE-200 Description: The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.8.1 via file uploads due to insufficient directory listing prevention and lack of randomization of file names. This makes it possible for unauthenticated attackers to extract sensitive data including files u
mization of file names. This makes it possible for unauthenticated attackers to extract sensitive data including files uploaded via a form. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f188a5e6-699e-4e1a-b4e4-7fb4056b0bee?source=cve - https://plugins.trac.wordpress.org/changeset/3235420/nex-forms-express-wp-form-builder
CVE ID: CVE-2024-13499 State: PUBLISHED Published: 2025-01-22T11:07:57.919Z Last Updated: 2025-01-22T14:11:58.151Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: rubengc Products: GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress Problem Types: CWE-94 Description: The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_do_shortcode() function in all versions up to, and including, 7.2.1. This is due to the software allowing users to execute an action that does not properly validate a value befor
ng, 7.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b30ab159-ff3c-4d46-b182-f8938097b837?source=cve - https://plugins.trac.wordpress.org/browser/gamipress/trunk/includes/functions.php - https://plugins.trac.wordpress.org/browser/gamipress/trunk/includes/functions.php#L645 - https://wordpress.org/plugins/gamipress/#developers - https://plugins.trac.wordpress.org/changeset/3226227/
CVE ID: CVE-2024-13500 State: PUBLISHED Published: 2025-02-15T11:26:48.217Z Last Updated: 2025-02-18T19:45:40.102Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: wedevs Products: WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts Problem Types: CWE-89 Description: The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.6.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exi
luding, 2.6.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/70083f93-f110-4029-a3d3-ce8a77799a31?source=cve - https://wordpress.org/plugins/wedevs-project-manager/#developers - https://plugins.trac.wordpress.org/changeset/3239348/
CVE ID: CVE-2024-13501 State: PUBLISHED Published: 2025-02-18T04:21:12.480Z Last Updated: 2025-02-18T19:27:38.855Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: veerwest Products: WP-FormAssembly Problem Types: CWE-79 Description: The WP-FormAssembly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'formassembly' shortcode in all versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acce
with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/25ff6cc3-02ed-470a-aa10-4843e1ec01ce?source=cve - https://plugins.trac.wordpress.org/browser/formassembly-web-forms/tags/2.0.11/wp_formassembly.php#L32 - https://plugins.trac.wordpress.org/browser/formassembly-web-forms/tags/2.0.11/wp_formassembly.php#L47
CVE ID: CVE-2024-13502 State: PUBLISHED Published: 2025-01-17T14:01:03.084Z Last Updated: 2025-01-17T14:49:20.740Z Vendors: Newtec/iDirect Products: NTC2218, NTC2250, NTC2299 Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Newtec/iDirect NTC2218, NTC2250, NTC2299 on Linux, PowerPC, ARM allows Local Code Inclusion.This issue affects NTC2218, NTC2250, NTC2299: from 1.0.1.1 through 2.2.6.19. The `commit_multicast` page used to configure multicasts in the modem's web administration interface uses improperly parses incoming data from the request before passing it to an `eval` statement in a bash script.
terface uses improperly parses incoming data from the request before passing it to an `eval` statement in a bash script. This allows attackers to inject arbitrary shell commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://doi.org/10.1145/3643833.3656139 - https://www.youtube.com/watch?v=-pxmly8xeas
CVE ID: CVE-2024-13503 State: PUBLISHED Published: 2025-01-17T13:52:35.803Z Last Updated: 2025-01-17T16:01:06.569Z Vendors: Newtec/iDirect Products: NTC2218, NTC2250, NTC2299 Problem Types: CWE-120 Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Newtec NTC2218, NTC2250, NTC2299 on Linux, PowerPC, ARM (Updating signaling process in the swdownload binary modules) allows Local Execution of Code, Remote Code Inclusion. This issue affects NTC2218, NTC2250, NTC2299: from 1.0.1.1 through 2.2.6.19. The issue is both present on the PowerPC versions of the modem and the ARM versions. A stack buffer buffer overflow in the swdownload binary allows att
e PowerPC versions of the modem and the ARM versions. A stack buffer buffer overflow in the swdownload binary allows attackers to execute arbitrary code. The parse_INFO function uses an unrestricted `sscanf` to read a string of an incoming network packet into a statically sized buffer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://doi.org/10.1145/3643833.3656139 - https://www.youtube.com/watch?v=-pxmly8xeas
CVE ID: CVE-2024-13504 State: PUBLISHED Published: 2025-01-31T05:22:34.558Z Last Updated: 2025-01-31T19:36:08.219Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: anssilaitila Products: Shared Files – Frontend File Upload Form & Secure File Sharing Problem Types: CWE-79 Description: The Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dfxp File uploads in all versions up to, and including, 1.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a u
makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the dfxp file. This issue affects only Apache-based environments, where dfxp files are handled by default. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9f4210a0-5448-4ff6-876a-37db4ad9b23a?source=cve - https://plugins.trac.wordpress.org/browser/shared-files/tags/1.7.40 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3231372%40shared-files%2Ftrunk&old=3229309%40shared-files%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13505 State: PUBLISHED Published: 2025-01-26T11:23:12.595Z Last Updated: 2025-01-27T14:52:41.152Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: ays-pro Products: Survey Maker Problem Types: CWE-79 Description: The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ays_sections[5][questions][8][title]’ parameter in all versions up to, and including, 5.1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This
level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fc3c22a2-b766-419c-a481-48e6a73b084c?source=cve - https://plugins.trac.wordpress.org/browser/survey-maker/tags/5.1.3.2/admin/partials/surveys/actions/partials/survey-maker-surveys-actions-tab1.php#L1160