Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b4521959-416e-4ff5-96c0-bc4dbb0187b7?source=cve - https://plugins.trac.wordpress.org/browser/folder-gallery/trunk/foldergallery.php - https://wordpress.org/plugins/folder-gallery/
CVE ID: CVE-2024-11824 State: PUBLISHED Published: 2025-03-20T10:09:08.878Z Last Updated: 2025-03-20T18:57:34.961Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: langgenius Products: langgenius/dify Problem Types: CWE-79 Description: A stored cross-site scripting (XSS) vulnerability exists in langgenius/dify version latest, specifically in the chat log functionality. The vulnerability arises because certain HTML tags like <input> and <form> are not disallowed, allowing an attacker to inject malicious HTML into the log via prompts. When an admin views the log containing the malicious HTML, the attacker could steal the admin's credentials or sensitive informa
admin views the log containing the malicious HTML, the attacker could steal the admin's credentials or sensitive information. This issue is fixed in version 0.12.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/72387deb-6e64-48ed-a8c3-b50d22a0970f - https://github.com/langgenius/dify/commit/55edd5047e6fcbc9bb56a4ea055fcce090f3eb5d
CVE ID: CVE-2024-11825 State: PUBLISHED Published: 2025-01-25T07:24:17.043Z Last Updated: 2025-01-27T14:53:31.183Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: broadstreetads Products: Broadstreet Problem Types: CWE-79 Description: The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘zone’ parameter in all versions up to, and including, 1.50.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes
ect arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aeda43bc-eeee-463d-80b7-dec7975b4d19?source=cve - https://plugins.trac.wordpress.org/browser/broadstreet/tags/1.50.1/Broadstreet/Utility.php#L199 - https://wordpress.org/plugins/broadstreet/#developers
CVE ID: CVE-2024-11826 State: PUBLISHED Published: 2025-01-07T11:11:12.325Z Last Updated: 2025-08-26T19:58:07.722Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mdmag Products: Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress Problem Types: CWE-79 Description: The Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quillforms-popup' shortcode in all versions up to, and including, 3.10.0 d
Stored Cross-Site Scripting via the plugin's 'quillforms-popup' shortcode in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d59a4d69-cf51-44c1-90bf-19be04774c27?source=cve - https://plugins.trac.wordpress.org/changeset/3214019/quillforms/trunk/includes/class-shortcode.php
CVE ID: CVE-2024-11827 State: PUBLISHED Published: 2024-12-13T11:23:43.452Z Last Updated: 2024-12-23T18:09:46.068Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gsarig Products: Out of the Block: OpenStreetMap Problem Types: CWE-79 Description: The Out of the Block: OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ootb_query shortcode in all versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will exe
authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c67c958e-1ab2-498c-b665-73e239d0029b?source=cve - https://plugins.trac.wordpress.org/browser/ootb-openstreetmap/tags/2.8.3/includes/classes/Query.php#L283 - https://wordpress.org/plugins/ootb-openstreetmap/#developers
CVE ID: CVE-2024-11828 State: PUBLISHED Published: 2024-11-26T18:41:19.280Z Last Updated: 2024-11-26T19:53:40.674Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-407 Description: A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API calls. This was a regression of an earlier patch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/443559 - https://hackero
yst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/443559 - https://hackerone.com/reports/2380264
CVE ID: CVE-2024-11829 State: PUBLISHED Published: 2025-02-01T06:41:51.937Z Last Updated: 2025-02-03T16:37:31.974Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: posimyththemes Products: The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce Problem Types: CWE-79 Description: The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Widget's searchable_label parameter in all versions up to, and including, 6.1.8 due to insufficient input sanitization and output escaping. This makes it possible
versions up to, and including, 6.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/edf62f82-448a-4ed8-8d4b-7215223494cb?source=cve - https://plugins.trac.wordpress.org/changeset/3207945/the-plus-addons-for-elementor-page-builder/tags/6.1.2/modules/widgets/tp_table.php?old=3207456&old_path=the-plus-addons-for-elementor-page-builder%2Ftags%2F6.1.1%2Fmodules%2Fwidgets%
widgets/tp_table.php?old=3207456&old_path=the-plus-addons-for-elementor-page-builder%2Ftags%2F6.1.1%2Fmodules%2Fwidgets%2Ftp_table.php - https://plugins.trac.wordpress.org/changeset/3218225/the-plus-addons-for-elementor-page-builder/tags/6.1.4/modules/widgets/tp_table.php?old=3212455&old_path=the-plus-addons-for-elementor-page-builder%2Ftags%2F6.1.3%2Fmodules%2Fwidgets%2Ftp_table.php - https://plugins.trac.wordpress.org/changeset?old_path=/the-plus-addons-for-elementor-page-builder/tags/6.1.8&new_path=/the-plus-addons-for-elementor-page-builder/tags/6.2.0&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11830 State: PUBLISHED Published: 2025-01-08T11:09:25.459Z Last Updated: 2025-01-08T13:50:33.792Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: dearhive Products: Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer Problem Types: CWE-79 Description: The PDF Flipbook, 3D Flipbook—DearFlip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via outline settings in all versions up to 2.3.52 due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will
authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/88391d02-66d9-4c00-a519-17f92f64a17a?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3218103%403d-flipbook-dflip-lite&new=3218103%403d-flipbook-dflip-lite&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3215546%403d-flipbook-dflip-lite&new=3215546%403d-flipbook-dflip-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11831 State: PUBLISHED Published: 2025-02-10T15:27:46.732Z Last Updated: 2025-11-25T11:59:54.993Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat Advanced Cluster Security 4.4, Red Hat Advanced Cluster Security 4.5, Red Hat Ceph Storage 8.1, Red Hat Enterprise Linux 9, RHODF-4.14-RHEL-9, RHODF-4.15-RHEL-9, RHODF-4.16-RHEL-9, RHODF-4.17-RHEL-9, RHODF-4.18-RHEL-9, Red Hat Ceph Storage 8, Red Hat OpenShift Pipelines 1.15, Red Hat OpenShift Pipelines 1.17, Red Hat OpenShift Pipelines 1.19, Cryostat 3, Logging Subsystem for Red Hat OpenShift, Migration Toolkit for Virtualization, .NET 6.0 on Red Hat Enterprise Linux, Ope
Logging Subsystem for Red Hat OpenShift, Migration Toolkit for Virtualization, .NET 6.0 on Red Hat Enterprise Linux, OpenShift Lightspeed, OpenShift Pipelines, OpenShift Serverless, OpenShift Service Mesh 2, Red Hat 3scale API Management Platform 2, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 4, Red Hat Ansible Automation Platform 2, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apicurio Registry 2, Red Hat build of OptaPlanner 8, Red Hat Ceph Storage 7, Red Hat Ceph Storage 9, Red Hat Data Grid 8, Red Hat Developer Hub, Red Hat Discovery 1, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Fuse 7, Red Hat Integration Ca
ub, Red Hat Discovery 1, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Fuse 7, Red Hat Integration Camel K 1, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 3.11, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces, Red Hat OpenShift distributed tracing 3, Red Hat Process Automation 7, Red Hat Quay 3, Red Hat Satellite 6, Red Hat Single Sign-On 7, Red Hat Trusted Profile Analyzer Problem Types: CWE-79 Description: A flaw was found in npm-serialize-javascript. The vulnerability oc
d Profile Analyzer Problem Types: CWE-79 Description: A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHBA-2025:0304
ackage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHBA-2025:0304 - https://access.redhat.com/errata/RHSA-2025:10853 - https://access.redhat.com/errata/RHSA-2025:1334 - https://access.redhat.com/errata/RHSA-2025:1468 - https://access.redhat.com/errata/RHSA-2025:21068 - https://access.redhat.com/errata/RHSA-2025:21203 - https://access.redhat.com/errata/RHSA-2025:4511 - https://access.redhat.com/errata/RHSA-2025:8059 - https://access.redhat.com/errata/RHSA-2025:8078 - https://access.redhat.com/errata/RHSA-2025:8479 - https://access.redhat.com/errata/RHSA-2025:8544 - https://access.redhat.com/errata/RHSA-2025:8551 - https://access.redhat.co
s://access.redhat.com/errata/RHSA-2025:8544 - https://access.redhat.com/errata/RHSA-2025:8551 - https://access.redhat.com/errata/RHSA-2025:9294 - https://access.redhat.com/security/cve/CVE-2024-11831 - https://bugzilla.redhat.com/show_bug.cgi?id=2312579 - https://github.com/yahoo/serialize-javascript/commit/f27d65d3de42affe2aac14607066c293891cec4e - https://github.com/yahoo/serialize-javascript/pull/173
CVE ID: CVE-2024-11832 State: PUBLISHED Published: 2024-12-13T08:24:47.990Z Last Updated: 2024-12-23T20:05:34.695Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: justinbusa Products: Beaver Builder – WordPress Page Builder Problem Types: CWE-79 Description: The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JavaScript row settings in all versions up to, and including, 2.8.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute
nticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1988ff5e-2d3f-4901-8bcc-eb0a7da7566c?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3206556%40beaver-builder-lite-version&new=3206556%40beaver-builder-lite-version&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11833 State: PUBLISHED Published: 2024-12-13T05:49:23.911Z Last Updated: 2024-12-16T18:16:33.548Z Vendors: PlexTrac Products: PlexTrac Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.plextrac.com/plextrac-documentation/master/security-advisories#release-2.11.0
CVE ID: CVE-2024-11834 State: PUBLISHED Published: 2024-12-13T05:49:41.623Z Last Updated: 2024-12-16T17:12:47.266Z Vendors: PlexTrac Products: PlexTrac Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PlexTrac allows arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.plextrac.com/plextrac-documentation/master/security-advisories#release-2.11.0
CVE ID: CVE-2024-11835 State: PUBLISHED Published: 2024-12-13T05:49:58.882Z Last Updated: 2024-12-16T19:04:04.338Z Vendors: PlexTrac Products: PlexTrac Problem Types: CWE-400 Description: Uncontrolled Resource Consumption vulnerability in PlexTrac allows WebSocket DoS.This issue affects PlexTrac: from 1.61.3 before 2.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.plextrac.com/plextrac-documentation/master/security-advisories#release-2.11.0
CVE ID: CVE-2024-11836 State: PUBLISHED Published: 2024-12-13T05:50:35.088Z Last Updated: 2024-12-16T19:04:58.999Z Vendors: PlexTrac Products: PlexTrac Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in PlexTrac allowing requests to internal system resources.This issue affects PlexTrac: from 1.61.3 before 2.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.plextrac.com/plextrac-documentation/master/security-advisories#release-2.11.0
CVE ID: CVE-2024-11837 State: PUBLISHED Published: 2024-12-13T05:50:55.791Z Last Updated: 2024-12-16T19:02:59.324Z Vendors: PlexTrac Products: PlexTrac Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an N1QL Command ('N1QL Injection') vulnerability in PlexTrac allows N1QL Injection.This issue affects PlexTrac: from 1.61.3 before 2.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.plextrac.com/plextrac-documentation/master/security-advisories#release-2.11.0
CVE ID: CVE-2024-11838 State: PUBLISHED Published: 2024-12-13T05:51:12.475Z Last Updated: 2024-12-16T19:01:29.660Z Vendors: PlexTrac Products: PlexTrac Problem Types: CWE-73 Description: External Control of File Name or Path vulnerability in PlexTrac allows Local Code Inclusion through use of an undocumented API endpoint.This issue affects PlexTrac: from 1.61.3 before 2.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.plextrac.com/plextrac-documentation/master/security-advisories#release-2.11.0
CVE ID: CVE-2024-11839 State: PUBLISHED Published: 2024-12-13T05:51:24.351Z Last Updated: 2024-12-23T21:26:24.736Z Vendors: PlexTrac Products: PlexTrac Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in PlexTrac (Runbooks modules) which allows Object Injection and arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.plextrac.com/plextrac-documentation/master/security-advisories#release-2.11.0
CVE ID: CVE-2024-11840 State: PUBLISHED Published: 2024-12-11T10:57:29.880Z Last Updated: 2024-12-11T14:55:29.713Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: shakee93 Products: RapidLoad – Optimize Web Vitals Automatically Problem Types: CWE-862 Description: The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the uucss_data, update_rapidload_settings, wp_ajax_update_htaccess_file, uucss_update_rule, upload_rules, get_all_rules, update_titan_settings, preload_page, and activate_module functions in all versions up to, and including,
get_all_rules, update_titan_settings, preload_page, and activate_module functions in all versions up to, and including, 2.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings or conduct SQL injection attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2c8ff4ec-9b40-4d59-b3b0-382f91042a4a?source=cve - https://plugins.trac.wordpress.org/changeset/3202982/unusedcss
CVE ID: CVE-2024-11841 State: PUBLISHED Published: 2024-12-16T06:00:05.364Z Last Updated: 2024-12-16T16:46:49.173Z Vendors: Unknown Products: Tithe.ly Giving Button Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Tithe.ly Giving Button WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e344c722-c9b3-4527-a50d-50cdf07ebace/
CVE ID: CVE-2024-11842 State: PUBLISHED Published: 2024-12-27T06:00:14.978Z Last Updated: 2024-12-27T18:26:36.767Z Vendors: Unknown Products: DN Shipping by Weight for WooCommerce Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The DN Shipping by Weight for WooCommerce WordPress plugin before 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2545f054-b6ca-4ee5-ac6f-f42193db21b1/
CVE ID: CVE-2024-11843 State: PUBLISHED Published: 2025-05-15T20:06:51.172Z Last Updated: 2025-05-20T19:33:19.083Z Vendors: Unknown Products: Panorama Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Panorama WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0dd41559-d88a-4018-a0f0-c8944b6d6f0a/
CVE ID: CVE-2024-11844 State: PUBLISHED Published: 2024-12-03T08:32:26.285Z Last Updated: 2024-12-03T11:23:41.841Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: northernbeacheswebsites Products: IdeaPush Problem Types: CWE-862 Description: The IdeaPush plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the idea_push_taxonomy_save_routine function in all versions up to, and including, 8.71. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete terms for the "boards" taxonomy. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.w
o delete terms for the "boards" taxonomy. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/34603c3f-834f-4a2a-9b9f-5213155d4317?source=cve - https://plugins.trac.wordpress.org/browser/ideapush/trunk/ideapush.php#L766 - https://plugins.trac.wordpress.org/changeset/3198488/ideapush/trunk/ideapush.php
CVE ID: CVE-2024-11846 State: PUBLISHED Published: 2025-01-01T06:00:08.702Z Last Updated: 2025-01-02T17:11:56.861Z Vendors: Unknown Products: TravelTour Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/eedaf2d8-171c-4785-99cc-ab33113308d1/
CVE ID: CVE-2024-11847 State: PUBLISHED Published: 2025-03-26T06:00:02.270Z Last Updated: 2025-03-26T19:02:33.515Z Vendors: Unknown Products: wp-svg-upload Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f57ecff2-0cff-40c7-b6e4-5b162b847d65/
CVE ID: CVE-2024-11848 State: PUBLISHED Published: 2025-01-15T11:24:35.912Z Last Updated: 2025-01-15T14:34:27.384Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: nitropack Products: NitroPack – Caching & Speed Optimization for Core Web Vitals, Defer CSS & JS, Lazy load Images and CDN Problem Types: CWE-862 Description: The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropack_dismiss_notice_forever' AJAX action in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options to a f