Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ctory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/bp-better-messages directory which can contain file attachments included in chat messages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/997918b9-2ccd-413e-9df2-d24bc3820ba1?source=cve - https://plugins.trac.wordpress.org/browser/bp-better-messages/trunk/addons/files.php - https://plugins.trac.wordpress.org/changeset/3228957/
CVE ID: CVE-2024-13612 State: PUBLISHED Published: 2025-02-01T12:21:30.754Z Last Updated: 2025-02-03T16:36:36.715Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wordplus Products: Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss Problem Types: CWE-79 Description: The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'better_messages_live_chat_button' shortcode in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping on user supplied attributes. This
p to, and including, 2.6.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/169a857f-1ae0-40f6-8a34-10c573af59c5?source=cve - https://plugins.trac.wordpress.org/browser/bp-better-messages/trunk/inc/shortcodes.php#L84 - https://plugins.trac.wordpress.org/browser/bp-better-messages/trunk/inc/shortcodes.php#L125 - https://plugins.trac.wordpress
s://plugins.trac.wordpress.org/browser/bp-better-messages/trunk/inc/shortcodes.php#L125 - https://plugins.trac.wordpress.org/browser/bp-better-messages/trunk/inc/shortcodes.php#L127 - https://plugins.trac.wordpress.org/changeset/3228965/
CVE ID: CVE-2024-13613 State: PUBLISHED Published: 2025-05-17T11:17:17.487Z Last Updated: 2025-05-19T14:53:22.619Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: marcinlawrowski Products: Wise Chat Problem Types: CWE-200 Description: The Wise Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.3 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory which can contain file attachments included in chat messages. The vulnerability was partially patched in version 3.3.3. Additional Analyst Note
attachments included in chat messages. The vulnerability was partially patched in version 3.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f70dabb4-3ae6-43cf-86e2-62ac1454b697?source=cve - https://plugins.trac.wordpress.org/browser/wise-chat/trunk/src/services/WiseChatAttachmentsService.php - https://plugins.trac.wordpress.org/changeset/3268074/ - https://plugins.trac.wordpress.org/changeset/3288680/
CVE ID: CVE-2024-13614 State: PUBLISHED Published: 2025-02-06T16:13:08.173Z Last Updated: 2025-02-12T19:51:09.532Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Kaspersky Products: Kaspersky Anti-Virus SDK for Windows, Kaspersky Security for Virtualization Light Agent, Kaspersky Endpoint Security for Windows, Kaspersky Small Office Security, Kaspersky for Windows (Standard, Plus, Premium), Kaspersky Free, Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Security Cloud, Kaspersky Safe Kids, Kaspersky Anti-Ransomware Tool Problem Types: CWE-190 Description: Kaspersky has fixed a security issue in Kaspersky Anti-Virus SDK for Windows, Kaspersky Se
m Types: CWE-190 Description: Kaspersky has fixed a security issue in Kaspersky Anti-Virus SDK for Windows, Kaspersky Security for Virtualization Light Agent, Kaspersky Endpoint Security for Windows, Kaspersky Small Office Security, Kaspersky for Windows (Standard, Plus, Premium), Kaspersky Free, Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Security Cloud, Kaspersky Safe Kids, Kaspersky Anti-Ransomware Tool that could allow an authenticated attacker to write data to a limited area outside the allocated kernel memory buffer. The fix was installed automatically for all Kaspersky Endpoint products. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.
y for all Kaspersky Endpoint products. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.kaspersky.com/vulnerability/list-of-advisories/12430#060225
CVE ID: CVE-2024-13615 State: PUBLISHED Published: 2025-03-11T06:00:10.079Z Last Updated: 2025-03-11T14:41:05.301Z Vendors: Unknown Products: Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap WordPress plugin through 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - C
s even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e8401973-f4c2-4ccf-a6ad-507dde8d2259/
CVE ID: CVE-2024-13616 State: PUBLISHED Published: 2025-05-15T20:07:03.403Z Last Updated: 2025-05-20T19:26:48.419Z Vendors: Unknown Products: VikBooking Hotel Booking Engine & PMS Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/44b3a2d9-a2e1-43dd-b27a-1ad9d6015c9b/
CVE ID: CVE-2024-13617 State: PUBLISHED Published: 2025-03-25T06:00:13.131Z Last Updated: 2025-03-25T14:18:36.010Z Vendors: Unknown Products: aoa-downloadable Problem Types: CWE-552 Files or Directories Accessible to External Parties Description: The aoa-downloadable WordPress plugin through 0.1.0 doesn't validate a parameter in its download function, allowing unauthenticated attackers to download arbitrary files from the server Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8d6dd979-21ef-4d14-9c42-bbd1d7b65c53/
CVE ID: CVE-2024-13618 State: PUBLISHED Published: 2025-03-25T06:00:13.473Z Last Updated: 2025-03-25T14:17:37.850Z Vendors: Unknown Products: aoa-downloadable Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The aoa-downloadable WordPress plugin through 0.1.0 lacks authorization and authentication for requests to its download.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d6a78233-3f23-4da4-9bc0-1439cde20a30/
CVE ID: CVE-2024-13619 State: PUBLISHED Published: 2025-05-15T20:07:03.625Z Last Updated: 2025-05-20T19:26:42.078Z Vendors: Unknown Products: LifterLMS Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/97a7e1a6-0fb3-49e9-86fc-ebb1d426fcca/
CVE ID: CVE-2024-13621 State: PUBLISHED Published: 2025-05-15T20:07:03.846Z Last Updated: 2025-05-20T19:26:36.547Z Vendors: Unknown Products: The GDPR Framework By Data443 Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The GDPR Framework By Data443 WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5b48ecbb-c459-4c39-825d-61744d36f2fe/
CVE ID: CVE-2024-13622 State: PUBLISHED Published: 2025-02-18T04:21:19.028Z Last Updated: 2025-02-18T15:40:21.426Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: imagisol Products: File Uploads Addon for WooCommerce Problem Types: CWE-200 Description: The File Uploads Addon for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory which can contain file attachments uploaded by customers. Additional Analyst Notes: - CISA ADP Vulnr
t/uploads directory which can contain file attachments uploaded by customers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9f86bb77-7194-4a8d-b862-6f04d850017b?source=cve - https://plugins.trac.wordpress.org/browser/woo-addon-uploads/trunk/woocommerce-addon-uploads.php#L80 - https://plugins.trac.wordpress.org/browser/woo-addon-uploads/trunk/includes/class-wau-front-end.php#L81
CVE ID: CVE-2024-13623 State: PUBLISHED Published: 2025-01-31T06:40:18.223Z Last Updated: 2025-01-31T19:35:38.286Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: webfactory Products: Order Export for WooCommerce Problem Types: CWE-200 Description: The Order Export for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.24 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory which can contain exported order information. The plugin is only vulnerable when 'Order data storage' is set
directory which can contain exported order information. The plugin is only vulnerable when 'Order data storage' is set to 'WordPress posts storage (legacy)', and cannot be exploited when the default option of 'High-performance order storage' is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/18d6dffd-8df3-4611-ad94-6d806aa7328a?source=cve - https://plugins.trac.wordpress.org/browser/order-export-and-more-for-woocommerce/trunk/inc/JEMEXP_Order.php - https://plugins.trac.wordpress.org/changeset/3230283/
CVE ID: CVE-2024-13624 State: PUBLISHED Published: 2025-02-26T06:00:08.816Z Last Updated: 2025-02-26T15:45:44.910Z Vendors: Unknown Products: WPMovieLibrary Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WPMovieLibrary WordPress plugin through 2.1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c19b56cc-634f-420f-b6a0-9a10ad159049/
CVE ID: CVE-2024-13625 State: PUBLISHED Published: 2025-02-17T06:00:06.365Z Last Updated: 2025-02-19T21:40:05.778Z Vendors: Unknown Products: Tube Video Ads Lite Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Tube Video Ads Lite WordPress plugin through 1.5.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6bfabf1d-86f2-4d29-bc55-d618d757dcc6/
CVE ID: CVE-2024-13626 State: PUBLISHED Published: 2025-02-17T06:00:07.573Z Last Updated: 2025-02-19T21:41:07.614Z Vendors: Unknown Products: VR-Frases (collect & share quotes) Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The VR-Frases (collect & share quotes) WordPress plugin through 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/511c6e7a-087f-41ef-9009-2525f332f8c6/
CVE ID: CVE-2024-13627 State: PUBLISHED Published: 2025-02-17T06:00:09.408Z Last Updated: 2025-02-19T18:44:27.688Z Vendors: Unknown Products: OWL Carousel Slider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The OWL Carousel Slider WordPress plugin through 2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f7e425a1-ae49-4ea6-abe4-42ba2713af8f/
CVE ID: CVE-2024-13628 State: PUBLISHED Published: 2025-02-26T06:00:09.177Z Last Updated: 2025-02-26T14:47:21.322Z Vendors: Unknown Products: WP Pricing Table Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Pricing Table WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/34d6c8a2-e70d-485c-a217-4a569c16b079/
CVE ID: CVE-2024-13629 State: PUBLISHED Published: 2025-02-26T06:00:09.634Z Last Updated: 2025-02-26T14:30:07.676Z Vendors: Unknown Products: pushBIZ Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The pushBIZ WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5ffb548c-14f1-499d-8bbf-6ecc632cbb8c/
CVE ID: CVE-2024-13630 State: PUBLISHED Published: 2025-02-26T06:00:09.964Z Last Updated: 2025-02-26T14:27:01.164Z Vendors: Unknown Products: NewsTicker Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The NewsTicker WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/15eed487-01ac-4c1e-88f8-26cfa036fb54/
CVE ID: CVE-2024-13631 State: PUBLISHED Published: 2025-02-26T06:00:10.203Z Last Updated: 2025-02-26T15:45:31.825Z Vendors: Unknown Products: Om Stripe Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Om Stripe WordPress plugin through 02.00.00 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c991fdd0-cb9d-43ea-bafa-df3b2e806013/
CVE ID: CVE-2024-13632 State: PUBLISHED Published: 2025-02-26T06:00:10.420Z Last Updated: 2025-02-26T15:11:59.818Z Vendors: Unknown Products: WP Extra Fields Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Extra Fields WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/85c5b465-afce-4c68-b5e3-214ec4b5c9f2/
CVE ID: CVE-2024-13633 State: PUBLISHED Published: 2025-02-26T06:00:10.752Z Last Updated: 2025-02-26T15:06:33.338Z Vendors: Unknown Products: Simple catalogue Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple catalogue WordPress plugin through 1.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4291d5eb-c006-42b0-accf-90f09f26b6a0/
CVE ID: CVE-2024-13634 State: PUBLISHED Published: 2025-02-26T06:00:11.004Z Last Updated: 2025-02-26T14:28:12.515Z Vendors: Unknown Products: Post Sync Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Post Sync WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0e60bf74-19fb-441c-85a8-005def36af9a/
CVE ID: CVE-2024-13635 State: PUBLISHED Published: 2025-03-07T09:21:14.540Z Last Updated: 2025-03-07T14:13:27.572Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: vektor-inc Products: VK Blocks Problem Types: CWE-284 Description: The VK Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.94.2.2 via the page content block. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the content of private posts and pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulne
and pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cc03b3f4-2edb-463b-812b-6a187a7a893c?source=cve - https://plugins.trac.wordpress.org/browser/vk-blocks/trunk/inc/vk-blocks/build/blocks/page-content/index.php - https://plugins.trac.wordpress.org/changeset/3233455/vk-blocks/trunk/inc/vk-blocks/build/blocks/page-content/index.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3233455%40vk-blocks%2Ftrunk&old=3227170%40vk-blocks%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13636 State: REJECTED Published: 2025-02-18T11:10:18.901Z Last Updated: 2025-02-24T22:11:30.549Z Description: No description available.
CVE ID: CVE-2024-13637 State: PUBLISHED Published: 2025-04-02T09:21:44.774Z Last Updated: 2025-04-02T14:41:10.536Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: romik84 Products: Demo Awesome Problem Types: CWE-862 Description: The Demo Awesome plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the install_plugin function in all versions up to, and including, 1.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate arbitrary plugins.. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-int
rbitrary plugins.. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9a552f81-b222-46f0-b318-702e09d249c1?source=cve - https://plugins.trac.wordpress.org/browser/demo-awesome/trunk/inc/admin/js/admin.js#L1684 - https://wordpress.org/plugins/demo-awesome/#developers - https://plugins.trac.wordpress.org/browser/demo-awesome/trunk/inc/admin/class-demo-awesome-admin.php#L407
CVE ID: CVE-2024-13638 State: PUBLISHED Published: 2025-02-28T08:23:17.430Z Last Updated: 2025-03-12T19:51:03.735Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: sldesignpl Products: Order Attachments for WooCommerce Problem Types: CWE-200 Description: The Order Attachments for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.1 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory which can contain file attachments added to orders. Additional Analyst Notes: - CISA ADP Vulnrichm
ent/uploads directory which can contain file attachments added to orders. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7e98b1ef-70dd-408d-8644-08933bca1cdd?source=cve - https://plugins.trac.wordpress.org/browser/order-attachments-for-woocommerce/trunk/src/WCOA/Utils/Ajax.php#L61 - https://plugins.trac.wordpress.org/browser/order-attachments-for-woocommerce/trunk/src/WCOA/Attachments/Attachment.php#L87
CVE ID: CVE-2024-13639 State: PUBLISHED Published: 2025-02-13T08:21:24.056Z Last Updated: 2025-02-13T14:37:16.807Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: edmonparker Products: Read More & Accordion Problem Types: CWE-862 Description: The Read More & Accordion plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the expmDeleteData() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary 'read more' posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
above, to delete arbitrary 'read more' posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/65849267-8bb5-48fd-b95e-e89a1e744fe0?source=cve - https://plugins.trac.wordpress.org/browser/expand-maker/trunk/files/ReadMoreAdminPost.php#L98 - https://plugins.trac.wordpress.org/browser/expand-maker/trunk/files/ReadMoreAdminPost.php#L9 - https://wordpress.org/plugins/expand-maker/ - https://plugins.trac.wordpress.org/changeset/3239533/
CVE ID: CVE-2024-13640 State: PUBLISHED Published: 2025-03-08T04:21:03.752Z Last Updated: 2025-05-12T15:32:14.691Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: tychesoftwares Products: Print Invoice & Delivery Notes for WooCommerce Problem Types: CWE-200 Description: The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.4.1 via the 'wcdn/invoice' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/wcdn/invoice directory which can contain invoice files if an email attach
a stored insecurely in the /wp-content/uploads/wcdn/invoice directory which can contain invoice files if an email attachment setting is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/12ab3e54-a0b9-4420-ac90-f16e23688cca?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-delivery-notes/trunk/includes/class-wcdn-theme.php#L56 - https://plugins.trac.wordpress.org/changeset/3250195/