Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ly. The exploit has been disclosed to the public and may be used. The identifier VDB-219601 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.219601 - https://vuldb.com/?ctiid.219601 - https://github.com/linmoren/online-tours-travels-management-system/blob/main/admin_disapprove_user_id.md
CVE ID: CVE-2023-0533 State: PUBLISHED Published: 2023-01-27T10:42:33.834Z Last Updated: 2024-11-25T16:31:31.540Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Tours & Travels Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. Affected by this issue is some unknown functionality of the file admin/expense_report.php. The manipulation of the argument from_date leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-219602 is the identifier assigned
e launched remotely. The exploit has been disclosed to the public and may be used. VDB-219602 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.219602 - https://vuldb.com/?ctiid.219602 - https://github.com/linmoren/online-tours-travels-management-system/blob/main/admin_expense_report_from_date.md
CVE ID: CVE-2023-0534 State: PUBLISHED Published: 2023-01-27T10:42:36.207Z Last Updated: 2024-08-02T05:17:49.387Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Tours & Travels Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of the file admin/expense_report.php. The manipulation of the argument to_date leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-21
The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-219603. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.219603 - https://vuldb.com/?ctiid.219603 - https://github.com/linmoren/online-tours-travels-management-system/blob/main/admin_expense_report_to_date.md
CVE ID: CVE-2023-0535 State: PUBLISHED Published: 2023-02-27T15:24:38.235Z Last Updated: 2025-03-10T18:12:41.061Z Vendors: Unknown Products: Donation Block For PayPal Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Donation Block For PayPal WordPress plugin before 2.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8c50321a-dba8-4379-9b9c-4c349e44b2ed
CVE ID: CVE-2023-0536 State: PUBLISHED Published: 2023-05-08T13:58:16.532Z Last Updated: 2025-05-05T16:08:38.864Z Vendors: Unknown Products: Wp-D3 Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Wp-D3 WordPress plugin through 2.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7b19d792-8083-4c0c-a45e-a99c1f5f0df0
CVE ID: CVE-2023-0537 State: PUBLISHED Published: 2023-05-08T13:58:22.926Z Last Updated: 2025-01-29T15:00:32.971Z Vendors: Unknown Products: Product Slider For WooCommerce Lite Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Product Slider For WooCommerce Lite WordPress plugin through 1.1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d7369f1d-d1a0-4576-a676-c
CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d7369f1d-d1a0-4576-a676-c70525a6c743
CVE ID: CVE-2023-0538 State: PUBLISHED Published: 2023-03-13T16:03:33.950Z Last Updated: 2025-02-27T15:52:38.361Z Vendors: Unknown Products: Campaign URL Builder Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Campaign URL Builder WordPress plugin before 1.8.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4869fdc7-4fc7-4917-bc00-b6ced9ccc871
CVE ID: CVE-2023-0539 State: PUBLISHED Published: 2023-02-27T15:24:35.760Z Last Updated: 2025-03-11T02:53:55.915Z Vendors: Unknown Products: GS Insever Portfolio Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The GS Insever Portfolio WordPress plugin before 1.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a4b6a83a-6394-4dfc-8bb3-4982867dab7d
CVE ID: CVE-2023-0540 State: PUBLISHED Published: 2023-02-21T08:50:58.166Z Last Updated: 2025-03-13T19:47:10.611Z Vendors: Unknown Products: GS Filterable Portfolio Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The GS Filterable Portfolio WordPress plugin before 1.6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b35b3da2-468d-4fe5-bff6-812432197a38
CVE ID: CVE-2023-0541 State: PUBLISHED Published: 2023-02-21T08:50:54.939Z Last Updated: 2025-03-12T20:27:51.775Z Vendors: Unknown Products: GS Books Showcase Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The GS Books Showcase WordPress plugin before 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8453e587-cc8c-491a-af09-fc4ab215134b
CVE ID: CVE-2023-0542 State: PUBLISHED Published: 2023-05-08T13:58:11.670Z Last Updated: 2025-02-04T20:18:24.184Z Vendors: Unknown Products: Custom Post Type List Shortcode Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Custom Post Type List Shortcode WordPress plugin through 1.4.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/17de2f77-3e6c-4c22-9196-6e5577ee
gram Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/17de2f77-3e6c-4c22-9196-6e5577ee7fcf
CVE ID: CVE-2023-0543 State: PUBLISHED Published: 2023-02-27T15:24:34.100Z Last Updated: 2025-03-11T19:20:05.043Z Vendors: Unknown Products: Arigato Autoresponder and Newsletter Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Arigato Autoresponder and Newsletter WordPress plugin before 2.1.7.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e3771938-40b5-4e8b-bb5a-847131a2b4a7
CVE ID: CVE-2023-0544 State: PUBLISHED Published: 2023-05-08T13:58:06.121Z Last Updated: 2025-05-05T16:08:29.845Z Vendors: Unknown Products: WP Login Box Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Login Box WordPress plugin through 2.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8ef9585f-67d7-4651-977a-fcad113882bd
CVE ID: CVE-2023-0545 State: PUBLISHED Published: 2023-06-05T13:38:58.659Z Last Updated: 2025-01-08T17:06:22.275Z Vendors: Unknown Products: Hostel Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Hostel WordPress plugin before 1.1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b604afc8-61d0-4e98-8950-f3d29f9e9ee1
CVE ID: CVE-2023-0546 State: PUBLISHED Published: 2023-04-10T13:18:07.349Z Last Updated: 2025-02-11T21:04:47.802Z Vendors: Unknown Products: Contact Form Plugin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to the form or admins previewing or editing the form. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/078f33
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/078f33cd-0f5c-46fe-b858-2107a09c6b69
CVE ID: CVE-2023-0547 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-10T18:19:55.092Z Vendors: Mozilla Products: Thunderbird Problem Types: Revocation status of S/Mime recipient certificates was not checked Description: OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted. Thunderbird versions from 68 to 102.9.1 were affected by this bug. This vulnerability affects Thunderbird < 102.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2023-15/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1
References: - https://www.mozilla.org/security/advisories/mfsa2023-15/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1811298
CVE ID: CVE-2023-0548 State: PUBLISHED Published: 2023-02-27T15:24:28.364Z Last Updated: 2025-03-10T18:09:34.422Z Vendors: Unknown Products: Namaste! LMS Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b6c1ed7a-5b2d-4985-847d-56586b1aae9b
CVE ID: CVE-2023-0549 State: PUBLISHED Published: 2023-01-27T18:57:56.129Z Last Updated: 2025-03-28T15:36:25.004Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: YAFNET Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in YAFNET up to 3.1.10. This issue affects some unknown processing of the file /forum/PostPrivateMessage of the component Private Message Handler. The manipulation of the argument subject/message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.11 is able to address this issue. The identifier o
een disclosed to the public and may be used. Upgrading to version 3.1.11 is able to address this issue. The identifier of the patch is 2237a9d552e258a43570bb478a92a5505e7c8797. It is recommended to upgrade the affected component. The identifier VDB-219665 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.219665 - https://vuldb.com/?ctiid.219665 - https://drive.google.com/drive/folders/1ct6Tp_cnsYO8L_JSvlBCf_Ae7KW3JAcD?usp=sharing - https://github.com/YAFNET/YAFNET/security/advisories/GHSA-4hwx-678w-9cp5 - https://github.com/YAFNET/YAFNET/commit/2237a9d552e258a43570bb478a92a5505e7c8797 - https://
sories/GHSA-4hwx-678w-9cp5 - https://github.com/YAFNET/YAFNET/commit/2237a9d552e258a43570bb478a92a5505e7c8797 - https://github.com/YAFNET/YAFNET/releases/tag/v3.1.11
CVE ID: CVE-2023-0550 State: PUBLISHED Published: 2023-01-27T20:17:19.283Z Last Updated: 2025-01-13T17:10:34.720Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: alejandropascual Products: Quick Restaurant Menu Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Quick Restaurant Menu plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the fact that during menu item deletion/modification, the plugin does not verify that the post ID provided to the AJAX action is indeed a menu item. This makes it possible for authenticated attackers, with subscriber-le
rovided to the AJAX action is indeed a menu item. This makes it possible for authenticated attackers, with subscriber-level access or higher, to modify or delete arbitrary posts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/faa4fba5-cd19-4b96-aa09-07ed6d52a107 - https://plugins.trac.wordpress.org/browser/quick-restaurant-menu/tags/2.0.2/includes/admin/ajax-functions.php - https://plugins.trac.wordpress.org/changeset/2851871/quick-restaurant-menu/trunk?contextall=1&old=2788636&old_path=%2Fquick-restaurant-menu%2Ftrunk
CVE ID: CVE-2023-0551 State: PUBLISHED Published: 2023-08-16T11:03:30.386Z Last Updated: 2024-10-08T19:13:55.458Z Vendors: Unknown Products: REST API TO MiniProgram Problem Types: CWE-284 Improper Access Control, CWE-352 Cross-Site Request Forgery (CSRF) Description: The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such as subscriber to call and delete arbitrary attachments Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/de162a46-1fdb-47b9-9a61-f12a2c655a7d
CVE ID: CVE-2023-0552 State: PUBLISHED Published: 2023-02-27T15:24:31.331Z Last Updated: 2025-03-18T15:03:46.127Z Vendors: Unknown Products: Registration Forms Problem Types: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') Description: The Registration Forms WordPress plugin before 3.8.2.3 does not properly validate the redirection URL when logging in and login out, leading to an Open Redirect vulnerability Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/832c6155-a413-4641-849c-b98ba55e8551
CVE ID: CVE-2023-0553 State: PUBLISHED Published: 2023-01-27T20:27:30.817Z Last Updated: 2025-01-13T17:10:24.979Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: alejandropascual Products: Quick Restaurant Menu Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Quick Restaurant Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbit
ing. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cfd8a6a4-9159-480f-abe2-71972585217b - https://plugins.trac.wordpress.org/browser/quick-restaurant-menu/tags/2.0.2/includes/admin/settings/settings.php - https://plugins.trac.wordpress.org/changeset/2851871/quick-restaurant-menu/trunk?contextall=1&old=2788636&old_path=%2Fquick-restaurant-menu%2Ftrunk
CVE ID: CVE-2023-0554 State: PUBLISHED Published: 2023-01-27T20:28:40.673Z Last Updated: 2025-01-13T17:10:16.373Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L) Vendors: alejandropascual Products: Quick Restaurant Menu Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Quick Restaurant Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to update menu items, via forged request granted they can trick a site administrator into performing an action such as clicking
e menu items, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bfc7c214-8d76-453c-a05d-682aa425b06e - https://plugins.trac.wordpress.org/browser/quick-restaurant-menu/tags/2.0.2/includes/admin/ajax-functions.php - https://plugins.trac.wordpress.org/changeset/2851871/quick-restaurant-menu/trunk?contextall=1&old=2788636&old_path=%2Fquick-restaurant-menu%2Ftrunk
CVE ID: CVE-2023-0555 State: PUBLISHED Published: 2023-01-27T20:31:13.539Z Last Updated: 2025-01-13T17:10:06.552Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: alejandropascual Products: Quick Restaurant Menu Problem Types: CWE-862 Missing Authorization Description: The Quick Restaurant Menu plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those actions intended for administrator use. Actions include menu item creation, update and deletion and other
invoke those actions intended for administrator use. Actions include menu item creation, update and deletion and other menu management functions. Since the plugin does not verify that a post ID passed to one of its AJAX actions belongs to a menu item, this can lead to arbitrary post deletion/alteration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/97984c7d-d6ff-480c-acfe-20ab0eb04141 - https://plugins.trac.wordpress.org/browser/quick-restaurant-menu/tags/2.0.2/includes/admin/ajax-functions.php - https://plugins.trac.wordpress.org/changeset/2851871/quick-restaurant-menu/trunk?contextall=1&o
min/ajax-functions.php - https://plugins.trac.wordpress.org/changeset/2851871/quick-restaurant-menu/trunk?contextall=1&old=2788636&old_path=%2Fquick-restaurant-menu%2Ftrunk
CVE ID: CVE-2023-0556 State: PUBLISHED Published: 2023-01-27T21:08:16.313Z Last Updated: 2025-01-13T17:09:55.039Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: contentstudio Products: ContentStudio Problem Types: CWE-862 Missing Authorization Description: The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to obtain the blog metadata (via the function cstu_get_metadata) that includes the plugin's contentstudio_token. Knowing this token allows for other interactions with the plugin su
ata) that includes the plugin's contentstudio_token. Knowing this token allows for other interactions with the plugin such as creating posts in versions prior to 1.2.5, which added other requirements to posting and updating. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/52db8d41-859a-4d68-8b83-3d3af8f1bf64 - https://plugins.trac.wordpress.org/browser/contentstudio/tags/1.2.1/contentstudio-plugin.php#L517 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2851006%40contentstudio%2Ftrunk&old=2844028%40contentstudio%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-0557 State: PUBLISHED Published: 2023-01-27T21:09:08.771Z Last Updated: 2025-01-13T17:09:45.990Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: contentstudio Products: ContentStudio Problem Types: CWE-200 Information Exposure Description: The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.5. This could allow unauthenticated attackers to obtain a nonce needed for the creation of posts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/62eb136f-3cb0-40dc-a154-015a7fa1077b - h
chment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/62eb136f-3cb0-40dc-a154-015a7fa1077b - https://plugins.trac.wordpress.org/browser/contentstudio/trunk/contentstudio-plugin.php#L709 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2851006%40contentstudio%2Ftrunk&old=2844028%40contentstudio%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-0558 State: PUBLISHED Published: 2023-01-27T21:09:29.998Z Last Updated: 2024-08-02T05:17:50.001Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: contentstudio Products: ContentStudio Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to an unsecure token check that is susceptible to type juggling in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to execute functions intended for use by users with proper API keys. Additional Analyst Notes: - CVE Program Container: References: - https://ww
ended for use by users with proper API keys. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c31828dc-ef94-4895-8395-a5d52a0a82bd?source=cve - https://plugins.trac.wordpress.org/browser/contentstudio/trunk/contentstudio-plugin.php#L416