Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-4525 State: PUBLISHED Published: 2022-12-15T00:00:00 Last Updated: 2024-08-03T01:41:45.694Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: National Sleep Research Resource Products: sleepdata.org Problem Types: CWE-79 Description: A vulnerability has been found in National Sleep Research Resource sleepdata.org up to 58.x and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 59.0.0.rc is able to address this issue. The name of the patch is da44a3893b407087829b006d09339780919714cd. It is recommended to up
s able to address this issue. The name of the patch is da44a3893b407087829b006d09339780919714cd. It is recommended to upgrade the affected component. The identifier VDB-215905 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.215905 - https://github.com/nsrr/sleepdata.org/commit/da44a3893b407087829b006d09339780919714cd - https://github.com/nsrr/sleepdata.org/releases/tag/59.0.0.rc
CVE ID: CVE-2022-4526 State: PUBLISHED Published: 2022-12-15T00:00:00.000Z Last Updated: 2025-04-15T13:03:35.573Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: django-photologue Problem Types: CWE-707 Description: A vulnerability was found in django-photologue up to 3.15.1 and classified as problematic. Affected by this issue is some unknown functionality of the file photologue/templates/photologue/photo_detail.html of the component Default Template Handler. The manipulation of the argument object.caption leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.16 is able to address this issue. The name
site scripting. The attack may be launched remotely. Upgrading to version 3.16 is able to address this issue. The name of the patch is 960cb060ce5e2964e6d716ff787c72fc18a371e7. It is recommended to apply a patch to fix this issue. VDB-215906 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/richardbarran/django-photologue/issues/223 - https://github.com/richardbarran/django-photologue/commit/960cb060ce5e2964e6d716ff787c72fc18a371e7 - https://vuldb.com/?id.215906
CVE ID: CVE-2022-4527 State: PUBLISHED Published: 2022-12-15T00:00:00 Last Updated: 2024-08-03T01:41:45.490Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: n/a Products: collective.task Problem Types: CWE-79 Description: A vulnerability was found in collective.task up to 3.0.8. It has been classified as problematic. This affects the function renderCell/AssignedGroupColumn of the file src/collective/task/browser/table.py. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 3.0.9 is able to address this issue. The name of the patch is 1aac7f83fa2c2b41d59ba02748912953461f3fac. It is recommended to u
is able to address this issue. The name of the patch is 1aac7f83fa2c2b41d59ba02748912953461f3fac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215907. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.215907 - https://github.com/collective/collective.task/commit/1aac7f83fa2c2b41d59ba02748912953461f3fac - https://github.com/collective/collective.task/releases/tag/3.0.9
CVE ID: CVE-2022-4528 State: REJECTED Published: N/A Last Updated: 2024-08-30T20:21:08.754Z Description: No description available.
CVE ID: CVE-2022-4529 State: PUBLISHED Published: 2024-09-05T11:00:15.651Z Last Updated: 2024-09-05T18:04:33.796Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: msoftplugins Products: Security, Antivirus, Firewall – S.A.F Problem Types: CWE-348 Description: The Security, Antivirus, Firewall – S.A.F plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.3.5. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass
ers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address from logging in. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cd177a43-6059-4125-9408-1090b9a54117?source=cve - https://plugins.trac.wordpress.org/browser/security-antivirus-firewall/trunk/includes/wptsafEnv.php#L68
CVE ID: CVE-2022-4530 State: REJECTED Published: N/A Last Updated: 2024-08-30T19:36:23.649Z Description: No description available.
CVE ID: CVE-2022-4531 State: REJECTED Published: N/A Last Updated: 2023-10-20T02:25:57.344Z Description: No description available.
CVE ID: CVE-2022-4532 State: PUBLISHED Published: 2024-08-17T07:34:21.670Z Last Updated: 2024-08-19T17:12:44.937Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: krut1 Products: LOGIN AND REGISTRATION ATTEMPTS LIMIT Problem Types: CWE-348 Description: The LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings
upply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address from logging in. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/50421e90-ccd6-4896-8041-b99279314301?source=cve - https://plugins.trac.wordpress.org/browser/login-attempts-limit-wp/trunk/includes/Ip.php#L41
CVE ID: CVE-2022-4533 State: PUBLISHED Published: 2024-09-19T03:59:15.075Z Last Updated: 2024-09-19T13:50:33.884Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: devfelixmoira Products: Limit Login Attempts Plus – WordPress Limit Login Attempts By Felix Problem Types: CWE-348 Description: The Limit Login Attempts Plus plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1.0. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and ca
estrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aec7b59f-1c8a-4403-b33b-c119bd96ad9d?source=cve - https://plugins.trac.wordpress.org/browser/limit-login-attempts-plus/trunk/core/LimitLoginAttempts.php#L1043
CVE ID: CVE-2022-4534 State: PUBLISHED Published: 2024-10-08T08:33:17.452Z Last Updated: 2024-10-09T15:44:39.064Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: wp-buy Products: Limit Login Attempts (Spam Protection) Problem Types: CWE-348 Description: The Limit Login Attempts (Spam Protection) plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.3. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass setti
n supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/561ec1b2-ee26-4e0c-b437-d70b04be5b4c?source=cve - https://plugins.trac.wordpress.org/browser/wp-limit-failed-login-attempts/tags/5.3/login.php#L466 - https://plugins.trac.wordpress.org/changeset/3163023/
CVE ID: CVE-2022-4536 State: PUBLISHED Published: 2024-08-31T08:35:18.197Z Last Updated: 2024-09-03T14:21:17.187Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: youtag Products: Two-factor authentication (formerly IP Vault) Problem Types: CWE-348 Description: The IP Vault – WP Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that
the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/66e89753-f83e-4e60-b165-6d3d101d6c59?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2922250%40ip-vault-wp-firewall&new=2922250%40ip-vault-wp-firewall&sfp_email=&sfph_mail=
CVE ID: CVE-2022-4537 State: PUBLISHED Published: 2023-05-09T02:47:14.059Z Last Updated: 2025-01-13T16:50:23.117Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: johndarrel Products: Hide My WP Ghost – Security Plugin Problem Types: CWE-348 Use of Less Trusted Source Description: The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and c
restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address from logging in. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4cf89f94-587a-4fed-a6e4-3876b7dbc9ba?source=cve - https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/5.0.18/models/Brute.php#L131 - https://plugins.trac.wordpress.org/browser/hide-my-wp/trunk/models/Brute.php#L132
CVE ID: CVE-2022-4538 State: REJECTED Published: N/A Last Updated: 2024-08-30T20:54:59.612Z Description: No description available.
CVE ID: CVE-2022-4539 State: PUBLISHED Published: 2024-08-31T09:35:55.748Z Last Updated: 2024-09-03T14:37:17.494Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: cyberlord92 Products: Web Application Firewall – website security Problem Types: CWE-348 Description: The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1.2. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass setting
supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0e99531c-8742-4f91-8525-65bb3cb06644?source=cve - https://plugins.trac.wordpress.org/changeset/3055548/web-application-firewall/trunk/helper/utility.php
CVE ID: CVE-2022-4540 State: REJECTED Published: N/A Last Updated: 2024-08-30T19:58:11.099Z Description: No description available.
CVE ID: CVE-2022-4541 State: PUBLISHED Published: 2024-09-26T09:29:43.280Z Last Updated: 2024-09-26T13:28:37.408Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: nitinmaurya12 Products: WordPress Visitors Problem Types: CWE-79 Description: The WordPress Visitors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a spoofed HTTP Header value in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the nm_vistior page. Additional Analyst Notes: - CISA ADP Vulnrichment:
ages that will execute whenever a user accesses the nm_vistior page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fa15c0a4-c99d-40c9-a654-f3a910460502?source=cve - https://plugins.trac.wordpress.org/browser/nm-visitors/trunk/nm-visitors.php#L105 - https://plugins.trac.wordpress.org/browser/nm-visitors/trunk/nm-visitors.php#L63
CVE ID: CVE-2022-4542 State: PUBLISHED Published: 2023-01-23T14:31:58.971Z Last Updated: 2025-04-03T19:17:25.652Z Vendors: Unknown Products: Compact WP Audio Player Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f0bef96f-dfe2-4988-
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f0bef96f-dfe2-4988-adf8-e1bd493c5242
CVE ID: CVE-2022-4543 State: PUBLISHED Published: 2023-01-11T00:00:00.000Z Last Updated: 2025-04-08T19:55:00.788Z Vendors: n/a Products: Linux kernel Problem Types: CWE-200 Description: A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local attacker to leak KASLR base via prefetch side-channels based on TLB timing for Intel systems. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-security/2022/12/16/3 - https://www.willsroot.io/2022/12/entrybleed.html
CVE ID: CVE-2022-4544 State: PUBLISHED Published: 2023-01-16T15:38:04.500Z Last Updated: 2025-04-04T17:48:09.670Z Vendors: Unknown Products: Social Media Share Buttons | MashShare Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The MashShare WordPress plugin before 3.8.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/96e34d3d-627f-42f2
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/96e34d3d-627f-42f2-bfdb-c9d47dbf396c
CVE ID: CVE-2022-4545 State: PUBLISHED Published: 2023-01-23T14:31:42.271Z Last Updated: 2025-04-03T19:22:20.281Z Vendors: Unknown Products: Sitemap Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Sitemap WordPress plugin before 4.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/19f482cb-fcfd-43e6-9a04-143e06351a70
CVE ID: CVE-2022-4546 State: PUBLISHED Published: 2023-02-13T14:32:13.555Z Last Updated: 2025-03-21T18:01:39.660Z Vendors: Unknown Products: Mapwiz Problem Types: CWE-89 SQL Injection Description: The Mapwiz WordPress plugin through 1.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/009578b9-016d-49c2-9577-49756c35e1e8 - https://bulletin.iese.de/post/mapwiz_1-0-1/
CVE ID: CVE-2022-4547 State: PUBLISHED Published: 2023-01-16T15:37:50.411Z Last Updated: 2025-04-04T18:23:07.899Z Vendors: Unknown Products: Conditional Payment Methods for WooCommerce Problem Types: CWE-89 SQL Injection Description: The Conditional Payment Methods for WooCommerce WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by [high privilege users such as admin|users with a role as low as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fe1514b4-74e1-4c19-8741-c0d4db9bab99 - https://bulletin.iese.de/pos
ment: References: - https://wpscan.com/vulnerability/fe1514b4-74e1-4c19-8741-c0d4db9bab99 - https://bulletin.iese.de/post/conditional-payment-methods-for-woocommerce_1-0/
CVE ID: CVE-2022-4548 State: PUBLISHED Published: 2023-01-23T14:31:47.111Z Last Updated: 2025-04-02T14:59:15.861Z Vendors: Unknown Products: Optimize images ALT Text (alt tag) & names for SEO using AI Problem Types: CWE-284 Improper Access Control, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Optimize images ALT Text & names for SEO using AI WordPress plugin before 2.0.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0ff435bc-ea20-4993-98ae-1f61b1732b59
CVE ID: CVE-2022-4549 State: PUBLISHED Published: 2023-01-16T15:37:59.475Z Last Updated: 2025-04-04T17:59:33.360Z Vendors: Unknown Products: Tickera Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Tickera WordPress plugin before 3.5.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/06e1be38-fc1a-4799-a006-556b678ae701
CVE ID: CVE-2022-4550 State: PUBLISHED Published: 2023-02-27T15:24:36.587Z Last Updated: 2025-03-18T15:06:30.112Z Vendors: Unknown Products: User Activity Problem Types: CWE-290 Authentication Bypass by Spoofing Description: The User Activity WordPress plugin through 1.0.1 checks headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a1179959-2044-479f-a5ca-3c9ffc46d00e
CVE ID: CVE-2022-4551 State: PUBLISHED Published: 2023-02-13T14:32:08.804Z Last Updated: 2025-03-21T16:20:10.812Z Vendors: Unknown Products: Rich Table of Contents Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Rich Table of Contents WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/91c00b17-00ba-4c3f-8587-d54449a02659
CVE ID: CVE-2022-4552 State: PUBLISHED Published: 2023-01-30T20:31:51.944Z Last Updated: 2025-03-27T19:13:12.983Z Vendors: Unknown Products: FL3R FeelBox Problem Types: CWE-352 Cross-Site Request Forgery (CSRF), CWE-79 Cross-Site Scripting (XSS) Description: The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/307b0fe4-39de-4fbb-8bb0-f7f15ec6ef52
CVE ID: CVE-2022-4553 State: PUBLISHED Published: 2023-01-30T20:31:44.026Z Last Updated: 2025-03-27T19:44:35.223Z Vendors: Unknown Products: FL3R FeelBox Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating reseting moods which could allow attackers to make logged in admins perform such action via a CSRF attack and delete the lydl_posts & lydl_poststimestamp DB tables Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/483ed482-a1d1-44f6-8b99-56e653d3e45f
CVE ID: CVE-2022-4554 State: PUBLISHED Published: 2023-01-24T00:00:00 Last Updated: 2024-08-03T01:41:45.642Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: ID Software Project and Consultancy Services Products: B2B Customer Ordering System Problem Types: CWE-79 Description: B2B Customer Ordering System developed by ID Software Project and Consultancy Services before version 1.0.0.347 has an authenticated Reflected XSS vulnerability. This has been fixed in the version 1.0.0.347. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-23-0022
CVE ID: CVE-2022-4555 State: PUBLISHED Published: 2022-12-16T13:54:19.311Z Last Updated: 2025-01-14T21:34:50.286Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: wpvar Products: WP Shamsi – افزونه تاریخ شمسی و فارسی ساز وردپرس Problem Types: CWE-862 Missing Authorization Description: The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hooked via init() in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can be used to deactivate security plugins that aids in exploiting other vulnerabil
arbitrary plugins on the site. This can be used to deactivate security plugins that aids in exploiting other vulnerabilities. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7b498c5a-9fd1-43b8-b456-f6cec65d5077 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2645044%40wp-shamsi&new=2645044%40wp-shamsi&sfp_email=&sfph_mail=