Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-25102 State: PUBLISHED Published: 2023-02-12T13:31:04.352Z Last Updated: 2024-08-05T03:00:19.321Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: simple-markdown Problem Types: CWE-1333 Description: A vulnerability, which was classified as problematic, was found in simple-markdown 0.6.0. Affected is an unknown function of the file simple-markdown.js. The manipulation with the input <<<<<<<<<<:/:/:/:/:/:/:/:/:/:/ leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.6.1 is able to address this issue. T
he exploit has been disclosed to the public and may be used. Upgrading to version 0.6.1 is able to address this issue. The patch is identified as 015a719bf5cdc561feea05500ecb3274ef609cd2. It is recommended to upgrade the affected component. VDB-220638 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.220638 - https://vuldb.com/?ctiid.220638 - https://github.com/ariabuckles/simple-markdown/pull/73 - https://github.com/ariabuckles/simple-markdown/commit/015a719bf5cdc561feea05500ecb3274ef609cd2 - https://github.com/ariabuckles/simple-markdown/releases/tag/0.6.1
CVE ID: CVE-2019-25103 State: PUBLISHED Published: 2023-02-12T14:31:03.261Z Last Updated: 2024-08-05T03:00:19.231Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: simple-markdown Problem Types: CWE-1333 Description: A vulnerability has been found in simple-markdown 0.5.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file simple-markdown.js. The manipulation leads to inefficient regular expression complexity. The attack can be launched remotely. Upgrading to version 0.5.2 is able to address this issue. The patch is named 89797fef9abb4cab2fb76a335968266a92588816. It is recommended to upgrade the
le to address this issue. The patch is named 89797fef9abb4cab2fb76a335968266a92588816. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220639. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.220639 - https://vuldb.com/?ctiid.220639 - https://github.com/ariabuckles/simple-markdown/commit/89797fef9abb4cab2fb76a335968266a92588816 - https://github.com/ariabuckles/simple-markdown/releases/tag/0.5.2
CVE ID: CVE-2019-25104 State: PUBLISHED Published: 2023-02-20T17:31:03.555Z Last Updated: 2024-08-05T03:00:19.249Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: rtcwcoop Problem Types: CWE-404 Description: A vulnerability has been found in rtcwcoop 1.0.2 and classified as problematic. Affected by this vulnerability is the function AICast_ScriptLoad of the file code/game/ai_cast_script.c of the component Team Command Handler. The manipulation leads to denial of service. The identifier of the patch is f2cd18bc2e1cbca8c4b78bee9c392272bd5f42ac. It is recommended to apply a patch to fix this issue. The identifier VDB-221485 was assigned to this vulne
2272bd5f42ac. It is recommended to apply a patch to fix this issue. The identifier VDB-221485 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221485 - https://vuldb.com/?ctiid.221485 - https://github.com/rtcwcoop/rtcwcoop/pull/45 - https://github.com/rtcwcoop/rtcwcoop/commit/f2cd18bc2e1cbca8c4b78bee9c392272bd5f42ac
CVE ID: CVE-2019-25105 State: PUBLISHED Published: 2023-02-26T07:31:03.025Z Last Updated: 2024-08-05T03:00:19.264Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: dro.pm Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in dro.pm. This affects an unknown part of the file web/fileman.php. The manipulation of the argument secret/key leads to cross site scripting. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named fa73c3a42bc5c246a1b8f815699ea241aef154bb. It is recommended to apply a patch
leases are unavailable. The patch is named fa73c3a42bc5c246a1b8f815699ea241aef154bb. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221763. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.221763 - https://vuldb.com/?ctiid.221763 - https://github.com/lgommans/dro.pm/commit/fa73c3a42bc5c246a1b8f815699ea241aef154bb
CVE ID: CVE-2019-25136 State: PUBLISHED Published: 2023-06-19T10:45:09.806Z Last Updated: 2024-12-11T16:23:45.378Z Vendors: Mozilla Products: Firefox Problem Types: Invalid styles allowed from content processes Description: A compromised child process could have injected XBL Bindings into privileged CSS rules, resulting in arbitrary code execution and a sandbox escape. This vulnerability affects Firefox < 70. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1530709 - https://www.mozilla.org/security/advisories/mfsa2019-34/
CVE ID: CVE-2019-25137 State: PUBLISHED Published: 2023-05-18T00:00:00 Last Updated: 2025-01-22T16:43:41.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/Xslt/xsltVisualize.aspx. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/46153 - https://github.com/noraj/Umbraco-RCE - https://0xdf.gitlab.io/2020/09/05/htb-remote.html - https://github.com/Ickarah/CVE-2019-25137-Version-Research
CVE ID: CVE-2019-25138 State: PUBLISHED Published: 2023-06-07T01:51:22.056Z Last Updated: 2024-12-28T00:56:25.374Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: specialk Products: User Submitted Posts – Enable Users to Submit Posts from the Front End Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The User Submitted Posts plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the usp_check_images function in versions up to, and including, 20190312. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remot
es it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5a97877b-fb4d-4e87-bcff-56be65fee6ce?source=cve - https://blog.nintechnet.com/arbitrary-file-upload-vulnerability-in-wordpress-user-submitted-posts-plugin/ - https://wordpress.org/plugins/user-submitted-posts/#developers
CVE ID: CVE-2019-25139 State: PUBLISHED Published: 2023-06-07T01:51:23.388Z Last Updated: 2024-12-28T00:56:11.388Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: wpshopmart Products: Coming Soon Page & Maintenance Mode Problem Types: CWE-862 Missing Authorization Description: The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthenticated settings reset in versions up to, and including 1.8.1 due to missing capability checks in the ~/functions/data-reset-post.php file which makes it possible for unauthenticated attackers to trigger a plugin settings reset. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
attackers to trigger a plugin settings reset. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/61fdc6e9-75ea-4226-9527-a5fd02efde70?source=cve - https://blog.nintechnet.com/unauthenticated-stored-xss-in-wordpress-coming-soon-page-and-maintenance-mode-plugin/ - https://plugins.trac.wordpress.org/changeset/2121321 - https://plugins.trac.wordpress.org/changeset/2123149
CVE ID: CVE-2019-25140 State: PUBLISHED Published: 2023-06-07T01:51:26.427Z Last Updated: 2024-12-28T00:55:49.022Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: wpshopmart Products: Coming Soon Page & Maintenance Mode Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WordPress Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logo_width, logo_height, rcsp_logo_url, home_sec_link_txt, rcsp_headline and rcsp_description parameters in versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping.
scription parameters in versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/738c6c77-97ef-4e47-9f14-9b73ea425bc2?source=cve - https://blog.nintechnet.com/unauthenticated-stored-xss-in-wordpress-coming-soon-page-and-maintenance-mode-plugin/ - https://plugins.trac.wordpress.org/changeset/2123149/responsive-coming-soon - https://plugins.trac.wordpress.o
plugin/ - https://plugins.trac.wordpress.org/changeset/2123149/responsive-coming-soon - https://plugins.trac.wordpress.org/changeset/2121321/responsive-coming-soon
CVE ID: CVE-2019-25141 State: PUBLISHED Published: 2023-06-07T01:51:28.969Z Last Updated: 2024-12-28T00:55:25.444Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: smub Products: Easy WP SMTP by SendLayer – WordPress SMTP and Email Log Plugin Problem Types: CWE-862 Missing Authorization Description: The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admin_init() function, in addition to insufficient input validation. This makes it possible for unauthenticated attackers to modify the plugins settings and arbitrary options on the site that can be
it possible for unauthenticated attackers to modify the plugins settings and arbitrary options on the site that can be used to inject new administrative user accounts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/84b75f7d-7258-46f6-aee6-b96d70bee264?source=cve - https://plugins.trac.wordpress.org/changeset?old_path=%2Feasy-wp-smtp&old=2052057&new_path=%2Feasy-wp-smtp&new=2052058&sfp_email=&sfph_mail= - https://blog.nintechnet.com/critical-0day-vulnerability-fixed-in-wordpress-easy-wp-smtp-plugin/ - https://wordpress.org/support/topic/vulnerability-26/
CVE ID: CVE-2019-25142 State: PUBLISHED Published: 2023-06-07T01:51:30.289Z Last Updated: 2024-12-23T16:21:26.567Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: extendthemes Products: Mesmerize, Materialis Problem Types: CWE-862 Missing Authorization Description: The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172 (Materialis). This is due to 'companion_disable_popup' function only checking the nonce while sending user input to the 'update_option' function. This makes it possible for authenticated attackers to change otherwise restricted options. Additi
date_option' function. This makes it possible for authenticated attackers to change otherwise restricted options. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8c9c3302-47cd-4dbe-b79e-5e6032928074?source=cve - https://blog.nintechnet.com/wordpress-mesmerize-and-materialis-themes-fixed-an-authenticated-options-change-vulnerability/ - https://wpscan.com/vulnerability/e4d70f03-69d5-4cca-8300-985f68d19ddc - https://wordpress.org/themes/mesmerize/ - https://wordpress.org/themes/materialis/ - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=121291%40mesmerize&new=121
materialis/ - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=121291%40mesmerize&new=121291%40mesmerize&sfp_email=&sfph_mail= - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=121290%40materialis&new=121290%40materialis&sfp_email=&sfph_mail=
CVE ID: CVE-2019-25143 State: PUBLISHED Published: 2023-06-07T01:51:31.166Z Last Updated: 2024-12-20T23:52:20.534Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: mooveagency Products: GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) Problem Types: CWE-862 Missing Authorization Description: The GDPR Cookie Compliance plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the gdpr_cookie_compliance_reset_settings AJAX action in versions up to, and including, 4.0.2. This makes it possible for authenticated attackers to reset all of the settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichm
nticated attackers to reset all of the settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9116d719-f536-4b8a-9e73-9a8a922f8a35?source=cve - https://blog.nintechnet.com/wordpress-gdpr-cookie-compliance-plugin-fixed-authenticated-settings-deletion-vulnerability/ - https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-gdpr-cookie-compliance-security-bypass-4-0-2/ - https://wpscan.com/vulnerability/5ac51325-a7f5-4d38-9b41-61855206083d
CVE ID: CVE-2019-25144 State: PUBLISHED Published: 2023-06-07T01:51:32.470Z Last Updated: 2024-12-20T23:52:12.158Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: a3rev Products: WP Email Template Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.2.10 due to insufficient input sanitization. This makes it possible for unauthenticated attackers to inject arbitrary HTML in pages that execute if they can successfully trick a administrator into performing an action such as clicking on a link. Addi
s that execute if they can successfully trick a administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/946ba166-3309-4e47-8b6b-d3f017bbfcc8?source=cve - https://blog.nintechnet.com/multiple-wordpress-plugins-vulnerable-to-html-injection/
CVE ID: CVE-2019-25145 State: PUBLISHED Published: 2023-06-07T01:51:33.912Z Last Updated: 2024-12-28T00:54:50.940Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: smub Products: Contact Form & SMTP Plugin for WordPress by PirateForms Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.php’ file in versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject ar
o insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary HTML in emails that could be used to phish unsuspecting victims. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9e34c3f6-cc84-4e45-9948-6f7fd5cba8cd?source=cve - https://blog.nintechnet.com/html-injection-vulnerability-in-wordpress-pirate-forms-plugin/
CVE ID: CVE-2019-25146 State: PUBLISHED Published: 2023-06-07T01:51:37.944Z Last Updated: 2024-12-28T00:54:16.524Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: delucks Products: DELUCKS SEO Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The DELUCKS SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the saveSettings() function that had no capability checks in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute when
scaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute whenever a victim accesses the page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aaa2f738-4764-467c-9544-889ca8ba73d1?source=cve - https://blog.nintechnet.com/vulnerability-in-the-wordpress-delucks-seo-plugin-actively-exploited/ - https://plugins.trac.wordpress.org/changeset/2161211 - https://www.pluginvulnerabilities.com/2019/09/21/hackers-may-already-be-targeting-this-persistent-xss-vulnerability-in-delucks-seo/ - https://www.acunetix.com/vulnerabilities/web/wordpress-plugi
rgeting-this-persistent-xss-vulnerability-in-delucks-seo/ - https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-delucks-seo-cross-site-scripting-2-1-7/
CVE ID: CVE-2019-25147 State: PUBLISHED Published: 2023-06-07T01:51:38.889Z Last Updated: 2024-12-28T00:54:09.703Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: supercleanse Products: Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Pretty Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various IP headers as well as the referer header in versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping in the track_link function. This makes it possi
luding, 2.1.9 due to insufficient input sanitization and output escaping in the track_link function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ae058c5b-b90b-4a1e-9f56-d56dbd2d3607?source=cve - https://blog.nintechnet.com/stored-xss-and-csv-injection-vulnerabilities-in-wordpress-shortlinks-by-pretty-links-plugin/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2108490%40pretty-link%2Ftrunk&old=2078274%
ps://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2108490%40pretty-link%2Ftrunk&old=2078274%40pretty-link%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2019-25148 State: PUBLISHED Published: 2023-06-07T01:51:39.732Z Last Updated: 2024-12-20T23:51:09.480Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: haet Products: Email Template Designer – WP HTML Mail Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.9.0.3 due to insufficient input sanitization. This makes it possible for unauthenticated attackers to inject arbitrary HTML in pages that execute if they can successfully trick a administrator into performing an action such
nject arbitrary HTML in pages that execute if they can successfully trick a administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b3af900c-4048-4f4f-93e9-c60ca34d015b?source=cve - https://blog.nintechnet.com/multiple-wordpress-plugins-vulnerable-to-html-injection/ - https://plugins.svn.wordpress.org/wp-html-mail/trunk/readme.txt
CVE ID: CVE-2019-25149 State: PUBLISHED Published: 2023-06-07T01:51:47.456Z Last Updated: 2024-12-20T23:49:51.806Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: galleryape Products: Gallery Images Ape Problem Types: CWE-285 Improper Authorization Description: The Gallery Images Ape plugin for WordPress is vulnerable to Arbitrary Plugin Deactivation in versions up to, and including, 2.0.6. This allows authenticated attackers with any capability level to deactivate any plugin on the site, including plugins necessary to site functionality or security. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence
ecurity. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dfd6c2b8-b00c-49d1-930f-50397e742ac5?source=cve - https://blog.nintechnet.com/wordpress-ape-gallery-plugin-fixed-authenticated-arbitrary-plugin-deactivation-vulnerability/
CVE ID: CVE-2019-25150 State: PUBLISHED Published: 2023-06-07T01:51:53.028Z Last Updated: 2024-12-23T16:20:46.099Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: wpexpertsio Products: Email Templates Customizer and Designer for WordPress and WooCommerce Problem Types: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Description: The Email Templates plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.3. This makes it possible for attackers to present phishing forms or conduct cross-site request forgery attacks against site administrators. Additional Analyst Notes: - C
phishing forms or conduct cross-site request forgery attacks against site administrators. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f5c449f1-4715-4033-b0a3-6a8ca968aabc?source=cve - https://blog.nintechnet.com/multiple-wordpress-plugins-vulnerable-to-html-injection/ - https://wordpress.org/plugins/email-templates/#developers
CVE ID: CVE-2019-25151 State: PUBLISHED Published: 2023-06-07T01:51:51.674Z Last Updated: 2024-12-20T23:49:16.656Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: cartflowswp Products: WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce Problem Types: CWE-269 Improper Privilege Management Description: The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activate_plugin function in versions up to, and including, 1.3.0. This makes it possible for authenticated attackers to activate any plugin on the vulnerable service. Additional Analyst Notes: - CV
it possible for authenticated attackers to activate any plugin on the vulnerable service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f0b95670-0767-4325-88d0-4ae6d7302558?source=cve - https://blog.nintechnet.com/privilege-escalation-vulnerability-fixed-in-wordpress-cartflows-plugin/ - https://wpscan.com/vulnerability/b6725319-909f-4d5c-9b34-8b6ea627b223%5D - https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-funnel-builder-by-cartflows-create-high-converting-sales-funnels-for-wordpress-privilege-escalation-1-3-0/