Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ile. The specific flaw exists within the parsing of PIC files. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23974. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-666/
CVE ID: CVE-2024-5878 State: PUBLISHED Published: 2025-05-20T07:22:29.588Z Last Updated: 2025-05-20T13:46:50.915Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: aknieriem, smub Products: Simplelightbox, Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery Problem Types: CWE-79 Description: Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled SimpleLightbox JavaScript library (version 2.1.5) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject ar
ed attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bcbc8ce6-5eb7-4599-b844-72eb2ff3093c?source=cve - https://plugins.trac.wordpress.org/browser/nextgen-gallery/trunk/static/Lightbox/simplelightbox/nextgen_simple_lightbox_init.js - https://plugins.trac.wordpress.org/browser/simplelightbox/trunk/dist/simple-lightbox.js - https://plugins.trac.wordpress.org/changeset/3157076/nextgen-gallery
CVE ID: CVE-2024-5879 State: PUBLISHED Published: 2024-08-30T04:29:57.206Z Last Updated: 2024-08-30T14:05:55.285Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: hubspotdev Products: HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics Problem Types: CWE-79 Description: The HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute of the HubSpot Meeting Widget in all versions up to, and including, 11.1.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to
on and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ac004fb0-e178-4e9b-9aa3-b14eab43f22d?source=cve - https://plugins.trac.wordpress.org/browser/leadin/tags/11.1.13/public/admin/widgets/class-elementormeeting.php#L108 - https://plugins.trac.wordpress.org/changeset/3123662/leadin/trunk/public/admin/widgets/class-elementormeeting.php
CVE ID: CVE-2024-5880 State: PUBLISHED Published: 2024-08-21T05:30:19.090Z Last Updated: 2024-08-21T20:37:46.146Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: clevelandwebdeveloper Products: Hide My Site Problem Types: CWE-200 Description: The Hide My Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 due to the plugin not restricting access to the REST API when password protection is enabled. This makes it possible for unauthenticated attackers to gain unauthorized access to the site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vul
to the site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/31d2ccd2-d38b-4bdf-a905-a2b54ca80a58?source=cve - https://wordpress.org/plugins/hide-my-site/
CVE ID: CVE-2024-5881 State: PUBLISHED Published: 2024-07-09T07:38:45.782Z Last Updated: 2024-08-01T21:25:02.974Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: tranbinhcse Products: Webico Slider Flatsome Addons Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Webico Slider Flatsome Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wbc_image shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contri
ization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/71eeddf4-5693-41bc-93ad-3c93dafdd3bc?source=cve - https://plugins.trac.wordpress.org/browser/webico-slider-flatsome-addons/trunk/shortcodes/wbc_slider.php#L4
CVE ID: CVE-2024-5882 State: PUBLISHED Published: 2024-07-29T06:00:06.284Z Last Updated: 2024-08-01T21:25:02.969Z Vendors: Unknown Products: Ultimate Classified Listings Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the `ucl_page` and `layout` parameters allowing unauthenticated users to access PHP files on the server from the listings page Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/5e8d7808-8f3e-4fc9-a1e7-e108da031ca7/
CVE ID: CVE-2024-5883 State: PUBLISHED Published: 2024-07-29T06:00:07.364Z Last Updated: 2024-08-01T21:25:03.165Z Vendors: Unknown Products: Ultimate Classified Listings Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ultimate Classified Listings WordPress plugin before 1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/a1894884-c739-4ef4-8d9c-392171ab3d68/
CVE ID: CVE-2024-5884 State: PUBLISHED Published: 2024-09-13T15:10:41.915Z Last Updated: 2024-09-13T15:32:41.164Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: allprices Products: Beauty Problem Types: CWE-79 Description: The Beauty theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tpl_featured_cat_id’ parameter in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: -
arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c1089958-a481-47b1-9dc6-799a1a7930c8?source=cve - https://themes.trac.wordpress.org/browser/beauty/1.1.4/functions.php#L46
CVE ID: CVE-2024-5885 State: PUBLISHED Published: 2024-06-27T18:45:19.519Z Last Updated: 2024-08-01T21:25:03.160Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: stangirard Products: stangirard/quivr Problem Types: CWE-918 Description: stangirard/quivr version 0.0.236 contains a Server-Side Request Forgery (SSRF) vulnerability. The application does not provide sufficient controls when crawling a website, allowing an attacker to access applications on the local network. This vulnerability could allow a malicious user to gain access to internal servers, the AWS metadata endpoint, and capture Supabase data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
servers, the AWS metadata endpoint, and capture Supabase data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/c178bf48-1d4a-4743-87ca-4cc8e475d274
CVE ID: CVE-2024-5886 State: REJECTED Published: N/A Last Updated: 2024-06-20T10:14:07.575Z Description: No description available.
CVE ID: CVE-2024-5887 State: REJECTED Published: 2024-07-03T17:45:47.751Z Last Updated: 2024-07-17T11:11:39.228Z Description: No description available.
CVE ID: CVE-2024-5888 State: PUBLISHED Published: 2025-03-03T19:36:56.864Z Last Updated: 2025-04-10T19:22:18.895Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Esri Products: ArcGIS Server Problem Types: CWE-79 Description: There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no imp
are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/arcgis-server-security-2025-update-1-patch/
CVE ID: CVE-2024-5889 State: PUBLISHED Published: 2024-06-29T04:33:28.929Z Last Updated: 2024-08-01T21:25:03.088Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: netweblogic Products: Events Manager – Calendar, Bookings, Tickets, and more! Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘country’ parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated at
cluding, 6.4.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/73cbb65e-b4e3-4374-9916-9a3d1be5a014?source=cve - https://plugins.trac.wordpress.org/changeset/3106809/
CVE ID: CVE-2024-5890 State: PUBLISHED Published: 2024-12-02T18:24:55.797Z Last Updated: 2024-12-02T19:21:08.073Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ServiceNow Products: Now Platform Problem Types: CWE-79 Description: ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website. ServiceNow released updates to customers that addressed this vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible. Additional A
t done so already, we recommend applying security patches relevant to your instance(s) as soon as possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1710511
CVE ID: CVE-2024-5891 State: PUBLISHED Published: 2024-06-12T13:16:54.443Z Last Updated: 2024-08-02T16:17:31.664Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat Quay 3 Problem Types: CWE-1390 Description: A vulnerability was found in Quay. If an attacker can obtain the client ID for an application, they can use an OAuth token to authenticate despite not having access to the organization from which the application was created. This issue is limited to authentication and not authorization. However, in configurations where endpoints rely only on authentication, a user may authenticate to applications they otherwise have no access to.
where endpoints rely only on authentication, a user may authenticate to applications they otherwise have no access to. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-5891 - https://bugzilla.redhat.com/show_bug.cgi?id=2283879
CVE ID: CVE-2024-5892 State: PUBLISHED Published: 2024-06-12T05:34:02.862Z Last Updated: 2024-08-01T21:25:03.030Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: badhonrocks Products: Divi Torque Lite – Divi Theme and Extra Theme Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Divi Torque Lite – Divi Theme and Extra Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘support_unfiltered_files_upload’ function in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated atta
cluding, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/78dae5be-a71b-45bc-8814-7cc86233ae90?source=cve - https://plugins.trac.wordpress.org/browser/addons-for-divi/tags/3.6.6/includes/extensions/unfiltered-file-uploads/ext-unfiltered-file-uploads.php#L16 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3088
-unfiltered-file-uploads.php#L16 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3088441%40addons-for-divi%2Ftags%2F4.0.0&old=3001416%40addons-for-divi%2Ftrunk
CVE ID: CVE-2024-5893 State: PUBLISHED Published: 2024-06-12T14:31:04.493Z Last Updated: 2024-08-01T21:25:03.148Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Cab Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Cab Management System 1.0. This affects an unknown part of the file /cms/classes/Users.php?f=delete_client. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-268137 was assigned to this vulnerability. Additional Analyst Notes: - CIS
he public and may be used. The identifier VDB-268137 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268137 - https://vuldb.com/?ctiid.268137 - https://vuldb.com/?submit.354910 - https://github.com/Hefei-Coffee/cve/blob/main/sql9.md
CVE ID: CVE-2024-5894 State: PUBLISHED Published: 2024-06-12T15:00:04.965Z Last Updated: 2024-08-01T21:25:02.995Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Eyewear Shop Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. This vulnerability affects unknown code of the file manage_product.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-268138 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pro
DB-268138 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268138 - https://vuldb.com/?ctiid.268138 - https://vuldb.com/?submit.354912 - https://github.com/Hefei-Coffee/cve/blob/main/sql10.md
CVE ID: CVE-2024-5895 State: PUBLISHED Published: 2024-06-12T15:00:06.534Z Last Updated: 2024-08-01T21:25:03.194Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Employee and Visitor Gate Pass Logging System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. This issue affects the function delete_users of the file /classes/Users.php?f=delete. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vuln
initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268139. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268139 - https://vuldb.com/?ctiid.268139 - https://vuldb.com/?submit.354915 - https://github.com/Hefei-Coffee/cve/blob/main/sql11.md
CVE ID: CVE-2024-5896 State: PUBLISHED Published: 2024-06-12T15:31:03.691Z Last Updated: 2024-08-01T21:25:03.162Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Employee and Visitor Gate Pass Logging System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. Affected is the function save_users of the file /classes/Users.php?f=save. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-26
k remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268140. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268140 - https://vuldb.com/?ctiid.268140 - https://vuldb.com/?submit.354925 - https://github.com/Hefei-Coffee/cve/blob/main/sql12.md
CVE ID: CVE-2024-5897 State: PUBLISHED Published: 2024-06-12T16:00:05.697Z Last Updated: 2024-08-01T21:25:03.071Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: SourceCodester Products: Employee and Visitor Gate Pass Logging System Problem Types: CWE-79 Description: A vulnerability has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=log_visitor. The manipulation of the argument name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VD
ng. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-268141 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268141 - https://vuldb.com/?ctiid.268141 - https://vuldb.com/?submit.354923 - https://github.com/Hefei-Coffee/cve/blob/main/xss.md
CVE ID: CVE-2024-5898 State: PUBLISHED Published: 2024-06-12T16:31:03.876Z Last Updated: 2024-08-01T21:25:03.038Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: itsourcecode Products: Payroll Management System Problem Types: CWE-89 Description: A vulnerability was found in itsourcecode Payroll Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file print_payroll.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-268142 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP
blic and may be used. VDB-268142 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.268142 - https://vuldb.com/?ctiid.268142 - https://vuldb.com/?submit.354926 - https://github.com/guiyxli/cve/issues/1
CVE ID: CVE-2024-5899 State: PUBLISHED Published: 2024-06-18T08:12:52.772Z Last Updated: 2025-09-11T14:15:40.191Z Vendors: BazelBuild Products: intellij plugin Problem Types: CWE-862 Description: When Bazel Plugin in intellij imports a project (either using "import project" or "Auto import") the dialog for trusting the project is not displayed. This comes from the fact that both call the method ProjectBuilder.createProject which then calls ProjectManager.getInstance().createProject. This method, as its name suggests is intended to create a new project, not to import an existing one. We recommend upgrading to version 2024.06.04.0.2 or beyond for the IntelliJ, CLion and Android Studio Bazel pl
ting one. We recommend upgrading to version 2024.06.04.0.2 or beyond for the IntelliJ, CLion and Android Studio Bazel plugins. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/bazelbuild/intellij/security/advisories/GHSA-hh9f-wmhw-46vg - https://github.com/bazelbuild/intellij/releases/tag/v2024.06.04-aswb-stable
CVE ID: CVE-2024-5900 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:33.956Z Description: No description available.
CVE ID: CVE-2024-5901 State: PUBLISHED Published: 2024-07-30T20:30:04.912Z Last Updated: 2024-08-01T21:25:03.115Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gpriday Products: SiteOrigin Widgets Bundle Problem Types: CWE-79 Description: The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid widget in all versions up to, and including, 1.62.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user ac
, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0045c5a4-0807-4e89-8639-0802e54ce6ab?source=cve - https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.62.0/widgets/image-grid/tpl/default.php#L28 - https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.62.0/widgets/image-grid/image-grid.php#L282
CVE ID: CVE-2024-5902 State: PUBLISHED Published: 2024-07-12T21:30:46.029Z Last Updated: 2024-08-01T21:25:03.173Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: smub Products: User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the name parameter in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. Thi