Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-13878 State: PUBLISHED Published: 2025-03-20T06:00:06.978Z Last Updated: 2025-03-20T19:36:29.014Z Vendors: Unknown Products: SpotBot Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The SpotBot WordPress plugin through 0.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/882b2022-4ed6-4d9e-8b35-f48ea1580884/
CVE ID: CVE-2024-13879 State: PUBLISHED Published: 2025-02-17T15:21:19.607Z Last Updated: 2025-02-18T19:29:35.893Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: xwp Products: Stream Problem Types: CWE-918 Description: The Stream plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.2 due to insufficient validation on the webhook feature. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services. Additional Analyst N
from the web application which can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8680ad0a-7513-408d-a62d-ffb0b0e7addb?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3226637%40stream&new=3226637%40stream&sfp_email=&sfph_mail= - https://github.com/xwp/stream/blob/develop/changelog.md#410---january-15-2025
CVE ID: CVE-2024-13880 State: PUBLISHED Published: 2025-03-20T06:00:07.305Z Last Updated: 2025-03-20T19:35:40.358Z Vendors: Unknown Products: My Quota Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The My Quota WordPress plugin through 1.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/bee3b002-e808-4402-8bf6-4375ed7b3807/
CVE ID: CVE-2024-13881 State: PUBLISHED Published: 2025-03-20T06:00:07.996Z Last Updated: 2025-03-20T19:30:08.203Z Vendors: Unknown Products: Link My Posts Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Link My Posts WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/900fa2c6-0cac-4920-aef2-e8b94248b62e/
CVE ID: CVE-2024-13882 State: PUBLISHED Published: 2025-03-08T08:22:56.807Z Last Updated: 2025-03-10T15:56:08.200Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: CodeRevolution Products: Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit Problem Types: CWE-434 Description: The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aiomatic_generate_featured_image' function in all versions up to, and including, 2.3.8. This makes it possible for authenticated attackers, with Cont
age' function in all versions up to, and including, 2.3.8. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7108df0d-771a-4404-b90d-8ac8bc572898?source=cve - https://coderevolution.ro/knowledge-base/faq/full-changelog-aiomatic-automatic-ai-content-writer-editor-gpt-3-gpt-4-chatgpt-chatbot-ai-toolkit/
CVE ID: CVE-2024-13883 State: PUBLISHED Published: 2025-02-21T03:21:20.350Z Last Updated: 2025-02-21T21:28:25.866Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: victorfreitas Products: WPUpper Share Buttons Problem Types: CWE-352 Description: The WPUpper Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.51. This is due to missing or incorrect nonce validation on the 'save_custom_css_request' function. This makes it possible for unauthenticated attackers to inject custom CSS to modify a site via a forged request granted they can trick a site administrator into performing an action such as
CSS to modify a site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5ca55c87-6548-43b8-a23f-d31a51df9533?source=cve - https://plugins.trac.wordpress.org/browser/wpupper-share-buttons/trunk/Controller/ajax.controller.php#L94
CVE ID: CVE-2024-13884 State: PUBLISHED Published: 2025-03-13T06:00:03.037Z Last Updated: 2025-03-14T16:29:53.044Z Vendors: Unknown Products: Limit Bio Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Limit Bio WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/759a60ac-c890-4961-91e4-53db5096eb3c/
CVE ID: CVE-2024-13885 State: PUBLISHED Published: 2025-03-13T06:00:04.928Z Last Updated: 2025-03-14T16:23:53.184Z Vendors: Unknown Products: WP e-Customers Beta Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP e-Customers Beta WordPress plugin through 0.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b64d17d6-8416-476e-ad78-b7b9cb85b84f/
CVE ID: CVE-2024-13887 State: PUBLISHED Published: 2025-03-13T03:21:01.466Z Last Updated: 2025-03-14T13:52:54.421Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: strategy11team Products: Business Directory Plugin – Easy Listing Directories for WordPress Problem Types: CWE-639 Description: The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.4.14 via the 'ajax_listing_submit_image_upload' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to add arbitrary images to list
alidation on a user controlled key. This makes it possible for unauthenticated attackers to add arbitrary images to listings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/06c3de6d-92e7-46f8-86a9-37f027767fc0?source=cve - https://plugins.trac.wordpress.org/changeset/3249927/business-directory-plugin/trunk/includes/class-wpbdp.php
CVE ID: CVE-2024-13888 State: PUBLISHED Published: 2025-02-20T08:22:06.037Z Last Updated: 2025-02-20T16:11:42.708Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: amauric Products: WPMobile.App Problem Types: CWE-601 Description: The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficient validation on the redirect URL supplied via the 'redirect' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. Additional Analyst Notes: - CISA ADP Vulnrichment: References
hey can successfully trick them into performing an action. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a139f0fc-f3e0-4759-aa8d-ba138e5ccc87?source=cve - https://wordpress.org/plugins/wpappninja/#developers - https://plugins.trac.wordpress.org/changeset/3243366
CVE ID: CVE-2024-13889 State: PUBLISHED Published: 2025-03-26T11:22:09.743Z Last Updated: 2025-03-26T13:28:38.664Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: wordpressdotorg Products: WordPress Importer Problem Types: CWE-502 Description: The WordPress Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.8.3 via deserialization of untrusted input in the 'maybe_unserialize' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact
ct a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5f0795f7-6eba-4ff0-b0da-5d2b544adf14?source=cve - https://plugins.trac.wordpress.org/browser/wordpress-importer/trunk/class-wp-import.
4ff0-b0da-5d2b544adf14?source=cve - https://plugins.trac.wordpress.org/browser/wordpress-importer/trunk/class-wp-import.php#L602 - https://plugins.trac.wordpress.org/browser/wordpress-importer/trunk/class-wp-import.php#L857 - https://plugins.trac.wordpress.org/browser/wordpress-importer/trunk/class-wp-import.php#L891 - https://plugins.trac.wordpress.org/browser/wordpress-importer/trunk/class-wp-import.php#L975 - https://plugins.trac.wordpress.org/changeset/3261419/
CVE ID: CVE-2024-13890 State: PUBLISHED Published: 2025-03-08T02:24:03.309Z Last Updated: 2025-03-10T16:04:08.346Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: sksdev Products: Allow PHP Execute Problem Types: CWE-94 Description: The Allow PHP Execute plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0. This is due to allowing PHP code to be entered by all users for whom unfiltered HTML is allowed. This makes it possible for authenticated attackers, with Editor-level access and above, to inject PHP code into posts and pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.
t PHP code into posts and pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/412c39e9-9378-4c2c-817c-8d37f156af6e?source=cve - https://plugins.trac.wordpress.org/browser/allow-php-execute/trunk/allow-php-execute.php#L10
CVE ID: CVE-2024-13891 State: PUBLISHED Published: 2025-03-13T06:00:05.847Z Last Updated: 2025-03-14T16:12:55.517Z Vendors: Unknown Products: Schedule Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Schedule WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/58c8b73c-3a29-4a66-9b2e-f24b5c2769ac/
CVE ID: CVE-2024-13892 State: PUBLISHED Published: 2025-03-06T14:00:41.444Z Last Updated: 2025-10-03T08:52:55.831Z Vendors: Smartwares Products: CIP-37210AT, C724IP Problem Types: CWE-78 Description: Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, are vulnerable to command injection. During the initialization process, a user has to use a mobile app to provide devices with Access Point credentials. This input is not properly sanitized, what allows for command injection. The vendor has not replied to reports, so the patching status remains unknown. Newer firmware versions might be vulnerable as well. Additional Analyst Notes:
so the patching status remains unknown. Newer firmware versions might be vulnerable as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/03/CVE-2024-13892/ - https://www.smartwares.eu/en-gb/smartwares-cip-37210at-indoor-wi-fi-camera-cip--37210at
CVE ID: CVE-2024-13893 State: PUBLISHED Published: 2025-03-06T14:01:06.389Z Last Updated: 2025-03-06T14:47:20.695Z Vendors: Smartwares Products: CIP-37210AT, C724IP Problem Types: CWE-1392 Description: Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, might share same credentials for telnet service. Hash of the password can be retrieved through physical access to SPI connected memory. For the telnet service to be enabled, the inserted SD card needs to have a folder with a specific name created. Two products were tested, but since the vendor has not replied to reports, patching status remains unknown, as well as groups of devic
ere tested, but since the vendor has not replied to reports, patching status remains unknown, as well as groups of devices and firmware ranges in which the same password is shared. Newer firmware versions might be vulnerable as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/03/CVE-2024-13892/ - https://www.smartwares.eu/en-gb/smartwares-cip-37210at-indoor-wi-fi-camera-cip--37210at
CVE ID: CVE-2024-13894 State: PUBLISHED Published: 2025-03-06T14:03:20.063Z Last Updated: 2025-03-06T14:46:41.940Z Vendors: Smartwares Products: CIP-37210AT, C724IP Problem Types: CWE-22 Description: Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, are vulnerable to path traversal. When an affected device is connected to a mobile app, it opens a port 10000 enabling a user to download pictures shot at specific moments by providing paths to the files. However, the directories to which a user has access are not limited, allowing for path traversal attacks and downloading sensitive information. The vendor has not replied to repor
limited, allowing for path traversal attacks and downloading sensitive information. The vendor has not replied to reports, so the patching status remains unknown. Newer firmware versions might be vulnerable as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/03/CVE-2024-13892/ - https://www.smartwares.eu/en-gb/smartwares-cip-37210at-indoor-wi-fi-camera-cip--37210at
CVE ID: CVE-2024-13895 State: PUBLISHED Published: 2025-03-08T02:24:04.601Z Last Updated: 2025-03-10T16:00:26.958Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: jtsternberg Products: Code Snippets CPT Problem Types: CWE-94 Description: The The Code Snippets CPT plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.1.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. Additional Analyst Notes: - CIS
ated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/65f521f4-1968-4c43-a3f0-b0f81632d7aa?source=cve - https://plugins.trac.wordpress.org/browser/code-snippets-cpt/trunk/lib/CodeSnippitButton.php#L201
CVE ID: CVE-2024-13896 State: PUBLISHED Published: 2025-04-10T06:00:06.303Z Last Updated: 2025-08-27T12:00:18.812Z Vendors: Unknown Products: WP-GeSHi-Highlight — rock-solid syntax highlighting for 259 languages Problem Types: CWE-1333 Inefficient Regular Expression Complexity Description: The WP-GeSHi-Highlight — rock-solid syntax highlighting for 259 languages WordPress plugin through 1.4.3 processes user-supplied input as a regular expression via the wp_geshi_filter_replace_code() function, which could lead to Regular Expression Denial of Service (ReDoS) issue Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b8b622ea-e090-45ad-8755-b050fc05
Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b8b622ea-e090-45ad-8755-b050fc055231/
CVE ID: CVE-2024-13897 State: PUBLISHED Published: 2025-03-06T08:21:38.783Z Last Updated: 2025-03-06T16:35:05.552Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: katsushi-kawamori Products: Moving Media Library Problem Types: CWE-22 Description: The Moving Media Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the generate_json_page function in all versions up to, and including, 1.22. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is delete
e, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/815ce00b-3753-4c38-8a30-5242a5841734?source=cve - https://plugins.trac.wordpress.org/browser/moving-media-library/trunk/lib/class-movingmedialibraryadmin.php#L166 - https://plugins.trac.wordpress.org/changeset/3244709/moving-media-library/trunk/lib/class-movingmedialibraryadmin.php
CVE ID: CVE-2024-13898 State: PUBLISHED Published: 2025-04-04T05:22:44.837Z Last Updated: 2025-04-04T13:08:41.856Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: rpetersen29 Products: Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website Problem Types: CWE-79 Description: The Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output escaping. This makes it possible fo
rsions up to, and including, 3.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6a2dea28-14cf-4e83-ac72-efc7c97ecf54?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3264130%40simple-banner%2Ftrunk&old=3210193%40s
plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3264130%40simple-banner%2Ftrunk&old=3210193%40simple-banner%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13899 State: PUBLISHED Published: 2025-02-22T03:21:00.665Z Last Updated: 2025-02-22T15:26:12.893Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: misterpah Products: Mambo Importer Problem Types: CWE-502 Description: The Mambo Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0 via deserialization of untrusted input via the $data parameter in the fImportMenu function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact
ct a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b6d448c2-5acc-47f8-8e86-9ef10fa01513?source=cve - https://plugins.trac.wordpress.org/browser/mambo-joomla-importer/trunk/mamboImporter
47f8-8e86-9ef10fa01513?source=cve - https://plugins.trac.wordpress.org/browser/mambo-joomla-importer/trunk/mamboImporter.php#L45
CVE ID: CVE-2024-13900 State: PUBLISHED Published: 2025-02-21T11:09:32.964Z Last Updated: 2025-02-21T13:44:41.525Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: satollo Products: Head, Footer and Post Injections Problem Types: CWE-94 Description: The Head, Footer and Post Injections plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.3.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject PHP Code in multisite environments. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5177bde6-4922-
t Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5177bde6-4922-48ee-9155-577c392809a0?source=cve - https://plugins.trac.wordpress.org/changeset/3244016/
CVE ID: CVE-2024-13901 State: PUBLISHED Published: 2025-03-01T05:30:59.247Z Last Updated: 2025-03-03T17:38:34.221Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: wpcalc Products: Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site Problem Types: CWE-79 Description: The Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level acce
nput sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/251b17a7-781f-4f17-af90-9a6fbae69243?source=cve - https://plugins.trac.wordpress.org/browser/counter-box/trunk/admin/assets/js/5.builder.js#L10 - https://plugins.trac.wordpress.org/changeset/3247696/