Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-13727 State: PUBLISHED Published: 2025-05-15T20:07:04.058Z Last Updated: 2025-05-20T19:26:27.626Z Vendors: Unknown Products: MemberSpace Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The MemberSpace WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/598d20f2-0f42-48f2-a941-0d6c5da5303e/
CVE ID: CVE-2024-13728 State: PUBLISHED Published: 2025-02-23T05:22:33.304Z Last Updated: 2025-02-24T12:18:53.922Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: scottpaterson Products: Accept Donations with PayPal & Stripe Problem Types: CWE-79 Description: The Accept Donations with PayPal & Stripe plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the rf parameter in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action
rs to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3891a807-aace-460a-ad49-6a282af16084?source=cve - https://plugins.trac.wordpress.org/browser/easy-paypal-donation/tags/1.4.4/core/Base/Stripe.php#L227
CVE ID: CVE-2024-13729 State: PUBLISHED Published: 2025-05-15T20:07:04.266Z Last Updated: 2025-05-20T19:26:19.220Z Vendors: Unknown Products: Podlove Podcast Publisher Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Podlove Podcast Publisher WordPress plugin before 4.1.24 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2feed26b-ef02-4954-ab9d-8b0f958b0ef1/
CVE ID: CVE-2024-13730 State: PUBLISHED Published: 2025-05-15T20:07:04.496Z Last Updated: 2025-05-20T19:26:09.809Z Vendors: Unknown Products: Podlove Podcast Publisher Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4541a285-a095-4178-a64b-6a859eb5034e/
CVE ID: CVE-2024-13731 State: PUBLISHED Published: 2025-03-25T08:22:15.605Z Last Updated: 2025-03-25T13:14:12.152Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bplugins Products: Alert Box Block – Display notice/alerts in the front end. Problem Types: CWE-79 Description: The Alert Box Block – Display notice/alerts in the front end. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Alert Box block in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to in
supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d63cd13e-4a16-483f-8165-6c8090ceebab?source=cve - https://wordpress.org/plugins/alert-box-block/
CVE ID: CVE-2024-13732 State: PUBLISHED Published: 2025-01-30T08:21:25.447Z Last Updated: 2025-01-30T15:07:34.539Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cyberchimps Products: Responsive Blocks – WordPress Gutenberg Blocks Problem Types: CWE-79 Description: The Responsive Blocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘section_tag’ parameter in all versions up to, and including, 1.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will ex
authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1c0e5c85-72c3-4f09-aade-ec5a82b9cc41?source=cve - https://plugins.trac.wordpress.org/browser/responsive-block-editor-addons/trunk/src/blocks/post-carousel/index.php#L643 - https://wordpress.org/plugins/responsive-block-editor-addons - https://plugins.trac.wordpress.org/changeset/3231017/
CVE ID: CVE-2024-13733 State: PUBLISHED Published: 2025-02-04T09:21:07.539Z Last Updated: 2025-02-12T20:51:26.883Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sonalsinha21 Products: SKT Blocks – Gutenberg based Page Builder Problem Types: CWE-79 Description: The SKT Blocks – Gutenberg based Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's skt-blocks/post-carousel block in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary
butes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a84999-bd1b-4b86-9fa1-09c20b50ce37?source=cve - https://plugins.trac.wordpress.org/browser/skt-blocks/trunk/src/blocks/post-carousel/index.php#L751 - https://wordpress.org/plugins/skt-blocks - https://plugins.trac.wordpress.org/changeset/3233980/
CVE ID: CVE-2024-13734 State: PUBLISHED Published: 2025-02-27T09:21:48.112Z Last Updated: 2025-02-27T14:34:23.556Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: techeshta Products: Card Elements for Elementor Problem Types: CWE-79 Description: The Card Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Profile Card widget in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute w
ticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7134bb24-11a1-41f9-ad34-b4527c22463c?source=cve - https://wordpress.org/plugins/card-elements-for-elementor/#developers - https://www.techeshta.com/docs/card-elements-for-elementor/element-settings/profile-card/ - https://plugins.trac.wordpress.org/changeset/3244795/
CVE ID: CVE-2024-13735 State: PUBLISHED Published: 2025-02-14T09:21:31.841Z Last Updated: 2025-02-14T15:19:54.301Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: nlemsieh Products: HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce Problem Types: CWE-79 Description: The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.11.2 due to insufficient input sanitization and output escaping of a campaign name. This makes it possible for authenticated attackers, with Contributor-level access and above,
caping of a campaign name. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a5b247a7-50f4-4d35-b24a-2c788ba0b051?source=cve - https://wordpress.org/plugins/hurrytimer/#developers - https://docs.hurrytimer.com/getting-started/creating-a-one-time-campaign - https://plugins.trac.wordpress.org/changeset/3239755/
CVE ID: CVE-2024-13736 State: PUBLISHED Published: 2025-02-19T07:32:13.520Z Last Updated: 2025-02-19T14:36:25.152Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: pure-chat Products: Pure Chat – Live Chat & More! Problem Types: CWE-79 Description: The Pure Chat – Live Chat & More! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘purechatWidgetName’ parameter in all versions up to, and including, 2.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst No
inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e11993c1-48fa-4e37-850d-d02e3e20d56f?source=cve - https://wordpress.org/plugins/pure-chat/#developers - https://plugins.trac.wordpress.org/browser/pure-chat/trunk/purechat.php#L149 - https://plugins.trac.wordpress.org/browser/pure-chat/trunk/purechat.php#L99
CVE ID: CVE-2024-13737 State: PUBLISHED Published: 2025-03-22T02:22:10.440Z Last Updated: 2025-04-01T16:33:19.189Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: stylemix Products: Motors – Car Dealership & Classified Listings Plugin Problem Types: CWE-862 Description: The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on the motors_create_template and motors_delete_template functions in all versions up to, and including, 1.4.57. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts or create
es it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts or create listing templates. This issue requires Elementor plugin to be installed, which is a required plugin for Motors Starter Theme. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/04fd2d7a-fa75-4b9d-9514-5c24ca5ebc22?source=cve - https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.52/includes/class/Features/Elementor/Nuxy/TemplateManager.php#L191 - https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.52/includes/class/Featur
- https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.52/includes/class/Features/Elementor/Nuxy/TemplateManager.php#L149 - https://plugins.trac.wordpress.org/changeset/3250931/motors-car-dealership-classified-listings/trunk/includes/class/Features/Elementor/Nuxy/TemplateManager.php
CVE ID: CVE-2024-13738 State: PUBLISHED Published: 2025-05-03T02:21:55.753Z Last Updated: 2025-05-06T14:34:25.746Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: StylemixThemes Products: Motors - Car Dealer, Rental & Listing WordPress theme Problem Types: CWE-94 Description: The The Motors - Car Dealer, Rental & Listing WordPress theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.6.65. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcode
a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. *It is unclear exactly which version the issue was patched in from the changelog. Therefore, we used the latest version at the time of verification. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4635f5c1-c326-4f53-bc54-a402cf5dae00?source=cve - https://stylemixthemes.com/motors/ - https://themeforest.net/item/motors-automotive-cars-vehicle-boat-dealership-classifieds-wordpress-theme/13987211
CVE ID: CVE-2024-13739 State: PUBLISHED Published: 2025-03-22T04:22:05.486Z Last Updated: 2025-04-01T16:36:03.837Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: contrid Products: Newsletters Problem Types: CWE-79 Description: The Newsletters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the "to" parameter in all versions up to, and including, 4.9.9.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an admin user into performing an action such as clicking on a link. Additional Analyst
te if they can successfully trick an admin user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2578a863-4129-4f56-8b18-65b2d2b972e3?source=cve - https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.9.9.7/views/admin/history/view.php#L48
CVE ID: CVE-2024-13740 State: PUBLISHED Published: 2025-02-18T02:06:01.231Z Last Updated: 2025-02-18T19:28:43.894Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: metagauss Products: ProfileGrid – User Profiles, Groups and Communities Problem Types: CWE-639 Description: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.4.2 via the pm_messenger_show_messages function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read private conversations of o
akes it possible for authenticated attackers, with Subscriber-level access and above, to read private conversations of other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a1b1a4-df72-4666-b116-882af4cd5796?source=cve - https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.4.2/public/class-profile-magic-public.php#L1299
CVE ID: CVE-2024-13741 State: PUBLISHED Published: 2025-02-18T01:44:00.964Z Last Updated: 2025-02-18T19:28:54.756Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: metagauss Products: ProfileGrid – User Profiles, Groups and Communities Problem Types: CWE-918 Description: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 5.9.4.2 via the pm_upload_image function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be u
er-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to download and view images, as well as validating if a non-image file exists, both on local or remote hosts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/95d2a05d-67ae-45b1-8add-0dcf73d43181?source=cve - https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.4.2/public/partials/crop.php - https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.4.2/public/class-profile-magic-public.php#L1717
CVE ID: CVE-2024-13742 State: PUBLISHED Published: 2025-01-30T13:42:00.219Z Last Updated: 2025-01-30T14:41:00.823Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: paultgoodchild Products: iControlWP – Multiple WordPress Site Manager Problem Types: CWE-502 Description: The iControlWP – Multiple WordPress Site Manager plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.5 via deserialization of untrusted input from the reqpars parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no imp
inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6f25b0cc-60ec-49a0-8356-fd3fba97e987?source=cve - https://plugins.trac.wordpress.org/browser/worpit-admin-dashboard-plugin/tags/4.
0ec-49a0-8356-fd3fba97e987?source=cve - https://plugins.trac.wordpress.org/browser/worpit-admin-dashboard-plugin/tags/4.4.5/src/api/RequestParameters.php#L14 - https://plugins.trac.wordpress.org/browser/worpit-admin-dashboard-plugin/tags/4.4.5/lib/src/LegacyApi/RequestParameters.php#L42
CVE ID: CVE-2024-13743 State: PUBLISHED Published: 2025-02-18T22:21:31.992Z Last Updated: 2025-02-19T15:02:47.071Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wonderplugin Products: Wonder Video Embed Problem Types: CWE-79 Description: The Wonder Video Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wonderplugin_video shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/97bd4897-c0c2-4819-aa25-942e256de9a3?source=cve - https://plugins.trac.wordpress.org/browser/wonderplugin-video-embed/trunk/app/class-wonderplugin-videoembed-widgetview.php#L232
CVE ID: CVE-2024-13744 State: PUBLISHED Published: 2025-04-04T04:21:22.827Z Last Updated: 2025-04-04T14:46:51.411Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: pluggabl Products: Booster for WooCommerce Problem Types: CWE-434 Description: The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the validate_product_input_fields_on_add_to_cart function in versions 4.0.1 to 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
ed site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f8e1aca8-3d82-4b1a-98c8-29501a377846?source=cve - https://plugins.trac.wordpress.org/changeset/3262569/woocommerce-jetpack/trunk/includes/input-fields/class-wcj-product-input-fields-core.php
CVE ID: CVE-2024-13746 State: PUBLISHED Published: 2025-03-01T04:21:48.626Z Last Updated: 2025-03-03T20:57:39.364Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: imznarf Products: Booking Calendar and Notification Problem Types: CWE-862 Description: The Booking Calendar and Notification plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on the wpcb_all_bookings(), wpcb_update_booking_post(), and wpcb_delete_posts() functions in all versions up to, and including, 4.0.3. This makes it possible for unauthenticated attackers to extract data, create or update bookings, or delete arbitrary po
This makes it possible for unauthenticated attackers to extract data, create or update bookings, or delete arbitrary posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/422bb9a5-c848-4492-add7-bc65b1111565?source=cve - https://plugins.trac.wordpress.org/browser/booking-calendar-and-notification/tags/4.0.3/lib/includes/function.php - https://plugins.trac.wordpress.org/browser/booking-calendar-and-notification/trunk/lib/classes/api.php#L270 - https://plugins.trac.wordpress.org/browser/booking-calendar-and-notification/trunk/lib/classes/api.php#L134 - https://plugins.trac.wordpress.org/browser/booking-calendar-and-no
dar-and-notification/trunk/lib/classes/api.php#L134 - https://plugins.trac.wordpress.org/browser/booking-calendar-and-notification/trunk/lib/classes/api.php#L188
CVE ID: CVE-2024-13747 State: PUBLISHED Published: 2025-03-05T09:21:50.106Z Last Updated: 2025-03-05T14:55:10.989Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: CidCode Products: WooMail - WooCommerce Email Customizer Problem Types: CWE-862 Description: The WooMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'template_delete_saved' function in all versions up to, and including, 3.0.34. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject SQL into an existing post deletion query. Additional Analyst Notes: - CISA ADP Vu
iber-level access and above, to inject SQL into an existing post deletion query. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e74e1a7c-4fe6-4041-8c4c-13389dacb9db?source=cve - https://codecanyon.net/item/email-customizer-for-woocommerce-with-drag-drop-builder-woo-email-editor/22400984
CVE ID: CVE-2024-13748 State: PUBLISHED Published: 2025-02-20T09:21:37.344Z Last Updated: 2025-02-20T14:22:24.179Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: webcodingplace Products: Ultimate Classified Listings Problem Types: CWE-79 Description: The Ultimate Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title parameter in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Th