Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
nitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/28ba6f91-c696-4019-ae87-28ebfbe464cf?source=cve - https://plugins.trac.wordpress.org/browser/image-horizontal-reel-scroll-slideshow/trunk/image-horizontal-reel-scroll-slideshow.php#L212 - https://plugins.trac.wordpress.org/changeset/3010834/image-horizontal-reel-scroll-slideshow
CVE ID: CVE-2023-5414 State: PUBLISHED Published: 2023-10-20T06:35:19.665Z Last Updated: 2025-02-05T19:07:47.711Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: icegram Products: Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Icegram Express plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.6.23 via the show_es_logs function. This allows administrator-level attackers to read the contents of arbitrary files on the server, which can contain sensitive infor
s administrator-level attackers to read the contents of arbitrary files on the server, which can contain sensitive information including those belonging to other sites, for example in shared hosting environments. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/417186ba-36ef-4d06-bbcd-e85eb9219689?source=cve - https://plugins.trac.wordpress.org/browser/email-subscribers/trunk/lite/includes/classes/class-email-subscribers-logs.php?rev=2919465#L28 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2977318%40email-subscribers%2Ftrunk&old=2972043%40email-subscribers%
s.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2977318%40email-subscribers%2Ftrunk&old=2972043%40email-subscribers%2Ftrunk&sfp_email=&sfph_mail=#file4
CVE ID: CVE-2023-5415 State: PUBLISHED Published: 2023-11-22T15:33:26.588Z Last Updated: 2024-08-02T07:59:44.751Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: funnelforms Products: Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free Problem Types: CWE-862 Missing Authorization Description: The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_add_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to add new categories. Addition
es it possible for authenticated attackers, with subscriber-level permissions and above, to add new categories. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6ec3051e-a5e4-48ee-8f8e-eb5dbc482f33?source=cve - https://plugins.trac.wordpress.org/changeset/2986938/funnelforms-free
CVE ID: CVE-2023-5416 State: PUBLISHED Published: 2023-11-22T15:33:32.162Z Last Updated: 2024-10-11T18:05:55.700Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: funnelforms Products: Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free Problem Types: CWE-862 Missing Authorization Description: The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete categories. Additi
makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete categories. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/992fc98f-4b23-4596-81fb-5543d82fd615?source=cve - https://plugins.trac.wordpress.org/changeset/2986938/funnelforms-free
CVE ID: CVE-2023-5417 State: PUBLISHED Published: 2023-11-22T15:33:20.139Z Last Updated: 2024-08-02T07:59:44.310Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: funnelforms Products: Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free Problem Types: CWE-862 Missing Authorization Description: The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_update_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify the Funnelforms ca
makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify the Funnelforms category for a given post ID. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/148794ea-3bc9-4084-bdb9-6ee63a781a39?source=cve - https://plugins.trac.wordpress.org/changeset/2986938/funnelforms-free
CVE ID: CVE-2023-5419 State: PUBLISHED Published: 2023-11-22T15:33:25.228Z Last Updated: 2024-08-02T07:59:44.530Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: funnelforms Products: Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free Problem Types: CWE-862 Missing Authorization Description: The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_test_mail function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to send test emails to an arbi
kes it possible for authenticated attackers, with subscriber-level permissions and above, to send test emails to an arbitrary email address. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/64248d15-e6a7-442f-b269-e9f629d297d3?source=cve - https://plugins.trac.wordpress.org/changeset/2986938/funnelforms-free
CVE ID: CVE-2023-5421 State: PUBLISHED Published: 2023-10-16T08:10:55.114Z Last Updated: 2024-09-16T16:55:01.099Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: OTRS AG Products: OTRS, ((OTRS)) Community Edition Problem Types: CWE-20 Description: An attacker who is logged into OTRS as an user with privileges to create and change customer user data may manipulate the CustomerID field to execute JavaScript code that runs immediatly after the data is saved.The issue onlyoccurs if the configuration for AdminCustomerUser::UseAutoComplete was changed before. This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from
ed before. This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-advisory-2023-09/
CVE ID: CVE-2023-5422 State: PUBLISHED Published: 2023-10-16T08:10:35.192Z Last Updated: 2024-09-16T17:02:52.542Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: OTRS AG Products: OTRS, ((OTRS)) Community Edition Problem Types: CWE-295 Description: The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSL_get_verify_result() function is not used the certificated is trusted always and it can not be ensured that the certificate satisfies all necessary security requirements. This could allow an attacker to use an invalid certificate to claim to be a trusted host, use expired
rity requirements. This could allow an attacker to use an invalid certificate to claim to be a trusted host, use expired certificates, or conduct other attacks that could be detected if the certificate is properly validated. This issue affects OTRS: from 7.0.X before 7.0.47, from 8.0.X before 8.0.37; ((OTRS)) Community Edition: from 6.0.X through 6.0.34. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-advisory-2023-10/
CVE ID: CVE-2023-5423 State: PUBLISHED Published: 2023-10-05T17:00:07.714Z Last Updated: 2024-08-02T07:59:44.769Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Pizza Ordering System Problem Types: CWE-89 Description: A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/ajax.php?action=confirm_order. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The identifier of this vulnerability is VDB-241384. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References
this vulnerability is VDB-241384. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.241384 - https://vuldb.com/?ctiid.241384
CVE ID: CVE-2023-5424 State: PUBLISHED Published: 2024-06-07T09:33:35.882Z Last Updated: 2024-08-02T07:59:44.535Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: westguard, WS Form Products: WS Form LITE – Drag & Drop Contact Form Builder for WordPress, WS Form Pro Problem Types: CWE-1236 Improper Neutralization of Formula Elements in a CSV File Description: The WS Form LITE plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.9.217. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vu
ted CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/38ccaa81-77ec-46f2-9bec-d74fa2e093f3?source=cve - https://wsform.com/changelog/?utm_source=wp_plugins&utm_medium=readme - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3098265%40ws-form&new=3098265%40ws-form&sfp_email=&sfph_mail=
CVE ID: CVE-2023-5425 State: PUBLISHED Published: 2023-10-28T11:06:04.112Z Last Updated: 2025-02-05T18:56:41.226Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: gandhihitesh9 Products: Post Meta Data Manager Problem Types: CWE-862 Missing Authorization Description: The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_change_user_meta and pmdm_wp_change_post_meta functions in versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to gain elevated (e.g., administrator) privileges. Addition
ated attackers, with subscriber-level permissions and above, to gain elevated (e.g., administrator) privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d7f4e710-99a2-49df-a513-725e1daaa18a?source=cve - https://plugins.trac.wordpress.org/changeset/2981559/post-meta-data-manager
CVE ID: CVE-2023-5426 State: PUBLISHED Published: 2023-10-28T11:06:03.537Z Last Updated: 2025-02-05T18:56:50.846Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: gandhihitesh9 Products: Post Meta Data Manager Problem Types: CWE-862 Missing Authorization Description: The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_delete_user_meta, pmdm_wp_delete_term_meta, and pmdm_wp_ajax_delete_meta functions in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to delete user, term, and post meta belonging to arbitrary users. Additional
s it possible for unauthenticated attackers to delete user, term, and post meta belonging to arbitrary users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d6a7f882-4582-4b08-9597-329d140ad782?source=cve - https://plugins.trac.wordpress.org/changeset/2981559/post-meta-data-manager
CVE ID: CVE-2023-5427 State: PUBLISHED Published: 2023-12-01T10:13:49.299Z Last Updated: 2025-02-13T17:25:29.133Z Vendors: Arm Ltd Products: Bifrost GPU Kernel Driver, Valhall GPU Kernel Driver, Arm 5th Gen GPU Architecture Kernel Driver Problem Types: CWE-416 Description: Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r44p0 through r45p0; Valhall GPU Kernel Driver: from r44p0 through r45p0; Arm 5th Gen GPU Architecture Ke
l Driver: from r44p0 through r45p0; Valhall GPU Kernel Driver: from r44p0 through r45p0; Arm 5th Gen GPU Architecture Kernel Driver: from r44p0 through r45p0. Additional Analyst Notes: - CVE Program Container: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities - http://packetstormsecurity.com/files/176029/ARM-Mali-r44p0-Use-After-Free.html
CVE ID: CVE-2023-5428 State: PUBLISHED Published: 2023-10-31T08:32:47.779Z Last Updated: 2025-02-05T18:54:32.071Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: gopiplus Products: Image vertical reel scroll slideshow Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Image vertical reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers
rameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/01d31d8a-4459-488a-9cbe-92761faa58b4?source=cve - https://plugins.trac.wordpress.org/browser/image-vertical-reel-scroll-slideshow/trunk/image-vertical-reel-scroll-slideshow.php?rev=2827122#L273 - https://plugins.trac.wordpress.org/changeset/2985333/image-
/image-vertical-reel-scroll-slideshow.php?rev=2827122#L273 - https://plugins.trac.wordpress.org/changeset/2985333/image-vertical-reel-scroll-slideshow#file1
CVE ID: CVE-2023-5429 State: PUBLISHED Published: 2023-10-31T08:32:51.272Z Last Updated: 2025-02-05T18:53:34.687Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: gopiplus Products: Information Reel Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Information Reel plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permis
ion on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/64db63e5-ff76-494a-be4f-d820f0cc9ab0?source=cve - https://plugins.trac.wordpress.org/browser/information-reel/trunk/information-reel.php?rev=2827123#L134 - https://plugins.trac.wordpress.org/changeset/2985373/information-reel#file1
CVE ID: CVE-2023-5430 State: PUBLISHED Published: 2023-10-31T08:32:50.362Z Last Updated: 2025-02-05T18:53:48.200Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: gopiplushotmailcom Products: Jquery news ticker Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Jquery news ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and
ient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3b7f8739-7f40-40a7-952e-002ea3b82ac7?source=cve - https://plugins.trac.wordpress.org/browser/jquery-news-ticker/trunk/jquery-news-ticker.php?rev=2827068#L92 - https://plugins.trac.wordpress.org/changeset/2985559/jquery-news-ticker#file1
CVE ID: CVE-2023-5431 State: PUBLISHED Published: 2023-10-31T08:32:51.725Z Last Updated: 2025-02-05T18:53:27.113Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: gopiplus Products: Left right image slideshow gallery Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Left right image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers wi
eter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/69902627-ce79-4a43-8949-43db6a9cc0dd?source=cve - https://plugins.trac.wordpress.org/browser/left-right-image-slideshow-gallery/trunk/left-right-image-slideshow-gallery.php?rev=2827127#L211 - https://plugins.trac.wordpress.org/changeset/2985417/left-right-im
-right-image-slideshow-gallery.php?rev=2827127#L211 - https://plugins.trac.wordpress.org/changeset/2985417/left-right-image-slideshow-gallery#file0
CVE ID: CVE-2023-5432 State: PUBLISHED Published: 2023-12-19T03:30:30.598Z Last Updated: 2024-08-02T07:59:44.625Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gopiplushotmailcom Products: Jquery news ticker Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Jquery news ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jquery-news-ticker' shortcode in versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above pe
ping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d22d9414-2df9-4528-a426-dce6e83f8d44?source=cve - https://plugins.trac.wordpress.org/browser/jquery-news-ticker/trunk/jquery-news-ticker.php?rev=2827068#L124 - https://plugins.trac.wordpress.org/changeset/3010828/jquery-news-ticker
CVE ID: CVE-2023-5433 State: PUBLISHED Published: 2023-10-31T08:32:53.529Z Last Updated: 2025-02-05T18:52:56.184Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: gopiplus Products: Message ticker Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Message ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions
n the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d0b1fa88-2fc6-41af-bd39-12af92dc6533?source=cve - https://plugins.trac.wordpress.org/browser/message-ticker/trunk/message-ticker.php?rev=2827131#L142 - https://plugins.trac.wordpress.org/changeset/2985499/message-ticker#file1
CVE ID: CVE-2023-5434 State: PUBLISHED Published: 2023-10-31T08:32:49.889Z Last Updated: 2025-02-05T18:53:59.017Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: gopiplus Products: Superb slideshow gallery Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Superb slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level
ficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3a12945d-a67c-4a19-a4e7-f65f5f2a21bb?source=cve - https://plugins.trac.wordpress.org/browser/superb-slideshow-gallery/trunk/superb-slideshow-gallery.php?rev=2827170#L127 - https://plugins.trac.wordpress.org/changeset/2985501/superb-slideshow-gallery#file2