Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://takeonme.org/cves/cve-2025-3460 - https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices
CVE ID: CVE-2025-3461 State: PUBLISHED Published: 2025-06-08T21:02:37.521Z Last Updated: 2025-06-09T18:37:14.718Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: ON Semiconductor Products: Quantenna Wi-Fi chipset Problem Types: CWE-306 Description: The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication for Critical Function," and is estimated as a CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though
ersion 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://takeonme.org/cves/cve-2025-3461/ - https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices
CVE ID: CVE-2025-3462 State: PUBLISHED Published: 2025-05-09T05:36:40.230Z Last Updated: 2025-05-19T02:22:49.497Z Vendors: ASUS Products: DriverHub Problem Types: CWE-346 Description: "This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation in ASUS DriverHub may allow unauthorized sources to interact with the software's features via crafted HTTP requests. Refer to the 'Security Update for ASUS DriverHub' section on the ASUS Security Advisory for more information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.asus.com/content/asus-product-security-advisory/
CVE ID: CVE-2025-3463 State: PUBLISHED Published: 2025-05-09T05:37:06.125Z Last Updated: 2025-05-19T02:35:40.756Z Vendors: ASUS Products: DriverHub Problem Types: CWE-295 Description: "This issue is limited to motherboards and does not affect laptops, desktop computers, or other endpoints." An insufficient validation vulnerability in ASUS DriverHub may allow untrusted sources to affect system behavior via crafted HTTP requests. Refer to the 'Security Update for ASUS DriverHub' section on the ASUS Security Advisory for more information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.asus.com/content/asus-product-security-advisory/
CVE ID: CVE-2025-3464 State: PUBLISHED Published: 2025-06-16T09:06:23.221Z Last Updated: 2025-07-10T19:00:28.851Z Vendors: ASUS Products: Armoury Crate Problem Types: CWE-367 Description: A race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issue, potentially leading to authentication bypass. Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.asus.com/content/asus-product-security-advisory/ - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2150
CVE ID: CVE-2025-3465 State: PUBLISHED Published: 2025-10-20T17:52:40.975Z Last Updated: 2025-10-20T20:25:53.371Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: ABB Products: CoreSense™ HM, CoreSense™ M10 Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB CoreSense™ HM, ABB CoreSense™ M10.This issue affects CoreSense™ HM: through 2.3.1; CoreSense™ M10: through 1.4.1.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=3KXG200000R4801&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2025-3466 State: PUBLISHED Published: 2025-07-07T09:55:28.608Z Last Updated: 2025-07-07T14:21:49.892Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: langgenius Products: langgenius/dify Problem Types: CWE-1100 Description: langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full root permissions. The vulnerability arises from the ability to override global functions in JavaScript, such as parseInt, before sandbox security restrictions are imposed. This can lead to unauthorized access to secret keys, internal network servers, and lateral movement within dify.ai.
sed. This can lead to unauthorized access to secret keys, internal network servers, and lateral movement within dify.ai. The issue is resolved in version 1.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/f8dc17a3-5536-4944-a680-24070903cd2d - https://github.com/langgenius/dify/commit/1be0d26c1feb4bcbbdd2b4ae4eeb25874aadaddb
CVE ID: CVE-2025-3467 State: PUBLISHED Published: 2025-07-07T09:56:19.410Z Last Updated: 2025-07-07T12:11:13.310Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: langgenius Products: langgenius/dify Problem Types: CWE-79 Description: An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firefox browsers. This vulnerability allows an attacker to obtain the administrator's token by sending a payload in the published chat. When the administrator views the conversation content through the monitoring/log function using Firefox, the XSS vulnerability is triggered, potentially exposing sensitive token information to the attacker
tion using Firefox, the XSS vulnerability is triggered, potentially exposing sensitive token information to the attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/21723441-7b55-425c-abc4-b1331a713591 - https://github.com/langgenius/dify/commit/72deb3bed0b0d5d98d7cf44b525cc44bb278f6a7
CVE ID: CVE-2025-3468 State: PUBLISHED Published: 2025-05-08T11:13:44.979Z Last Updated: 2025-05-08T13:34:14.166Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: webaways Products: NEX-Forms – Ultimate Forms Plugin for WordPress Problem Types: CWE-79 Description: The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the clean_html and form_fields parameters in all versions up to, and including, 8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level access, to inject arbitrary web scripts in pages
. This makes it possible for authenticated attackers, with Custom-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a33a7ba5-c6f8-4cf4-8011-8312e9c5da8f?source=cve - https://plugins.trac.wordpress.org/browser/nex-forms-express-wp-form-builder/trunk/includes/classes/class.db.php?rev=3226607#L303
CVE ID: CVE-2025-3469 State: PUBLISHED Published: 2025-04-10T18:28:13.370Z Last Updated: 2025-11-03T19:53:59.985Z Vendors: Wikimedia Foundation Products: MediaWiki Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLMultiSelectField.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://phabricator.wikimedia.org/T358689
CVE ID: CVE-2025-3470 State: PUBLISHED Published: 2025-04-15T01:44:34.165Z Last Updated: 2025-04-15T02:49:28.941Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: totalsoft Products: TS Poll – Survey, Versus Poll, Image Poll, Video Poll Problem Types: CWE-89 Description: The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the s parameter in all versions up to, and including, 2.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to a
existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1e2dab05-97ce-4f53-8069-2577c5c25b16?source=cve - https://plugins.trac.wordpress.org/browser/poll-wp/tags/2.4.6/admin/class-ts_poll_list.php#L27
CVE ID: CVE-2025-3471 State: PUBLISHED Published: 2025-04-30T06:00:04.092Z Last Updated: 2025-04-30T17:28:20.699Z Vendors: Unknown Products: SureForms Problem Types: CWE-863 Incorrect Authorization Description: The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributor and above roles to perform such action Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/aa21dd2b-1277-4cf9-b7f6-d4f8a6d518c1/
CVE ID: CVE-2025-3472 State: PUBLISHED Published: 2025-04-22T11:12:21.180Z Last Updated: 2025-04-22T13:23:17.053Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: oceanwp Products: Ocean Extra Problem Types: CWE-94 Description: The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes when WooCommerce is also installed and activated. Additional Analyst Notes: - CISA ADP Vulnr
xecute arbitrary shortcodes when WooCommerce is also installed and activated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/74428e76-1946-408f-8adc-24ab4b7e46c5?source=cve - https://plugins.trac.wordpress.org/browser/ocean-extra/trunk/includes/shortcodes/shortcodes.php#L618 - https://plugins.trac.wordpress.org/changeset/3277977/
CVE ID: CVE-2025-3473 State: PUBLISHED Published: 2025-06-11T14:24:46.027Z Last Updated: 2025-08-24T11:53:33.302Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Security Guardium Problem Types: CWE-277 Description: IBM Security Guardium 12.1 could allow a local privileged user to escalate their privileges to root due to insecure inherited permissions created by the program. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7236356
CVE ID: CVE-2025-3474 State: PUBLISHED Published: 2025-04-09T17:48:17.023Z Last Updated: 2025-04-09T18:32:04.685Z Vendors: Drupal Products: Panels Problem Types: CWE-306 Description: Missing Authentication for Critical Function vulnerability in Drupal Panels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Panels: from 0.0.0 before 4.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-033
CVE ID: CVE-2025-3475 State: PUBLISHED Published: 2025-04-09T17:46:55.726Z Last Updated: 2025-04-09T18:36:41.734Z Vendors: Drupal Products: WEB-T Problem Types: CWE-770, CWE-863 Description: Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This issue affects WEB-T: from 0.0.0 before 1.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-030
CVE ID: CVE-2025-3476 State: PUBLISHED Published: 2025-05-07T18:42:08.134Z Last Updated: 2025-05-07T19:59:12.034Z Vendors: OpenText™ Products: Operations Bridge Manager Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager. The vulnerability could allows privilege escalation by authenticated users.This issue affects Operations Bridge Manager: 2023.05, 23.4, 24.2, 24.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000040406?language=en_US
CVE ID: CVE-2025-3478 State: PUBLISHED Published: 2025-08-25T15:46:27.909Z Last Updated: 2025-08-25T15:59:58.544Z Vendors: OpenText Products: OpenText Enterprise Security Manager Problem Types: CWE-79 Description: A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Enterprise Security Manager. The vulnerability could be remotely exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000042483
CVE ID: CVE-2025-3479 State: PUBLISHED Published: 2025-04-17T11:13:06.397Z Last Updated: 2025-04-17T13:39:51.779Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: wpmudev Products: Forminator Forms – Contact Form, Payment Form & Custom Form Builder Problem Types: CWE-354 Description: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handle_stripe_single' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions
y. This makes it possible for unauthenticated attackers to reuse a single Stripe PaymentIntent for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c873c04e-516e-41ee-a295-b8c5235abc1b?source=cve - https://plugins.trac.wordpress.org/browser/forminator/tags/1.41.2/library/modules/custom-forms/front/front-action.php#L964 - https://plugins.trac.wordpress.org/changeset/3274844/
CVE ID: CVE-2025-3480 State: PUBLISHED Published: 2025-05-22T00:51:28.947Z Last Updated: 2025-05-22T13:37:20.152Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: MedDream Products: WEB DICOM Viewer Problem Types: CWE-522 Description: MedDream WEB DICOM Viewer Cleartext Transmission of Credentials Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of MedDream WEB DICOM Viewer. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Web Portal. The issue results from the lack of encryption when transmitting credentials.
pecific flaw exists within the Web Portal. The issue results from the lack of encryption when transmitting credentials. An attacker can leverage this vulnerability to disclose transmitted credentials, leading to further compromise. Was ZDI-CAN-25842. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-246/
CVE ID: CVE-2025-3481 State: PUBLISHED Published: 2025-05-22T00:51:24.896Z Last Updated: 2025-05-22T13:37:42.522Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MedDream Products: PACS Server Problem Types: CWE-121 Description: MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MedDream PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of DICOM files. The issue results from the lack of proper validation of the length of user-supplied data
hin the parsing of DICOM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-25827. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-245/
CVE ID: CVE-2025-3482 State: PUBLISHED Published: 2025-05-22T00:51:20.681Z Last Updated: 2025-05-22T13:38:35.936Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MedDream Products: PACS Server Problem Types: CWE-121 Description: MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MedDream PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of DICOM files. The issue results from the lack of proper validation of the length of user-supplied data
hin the parsing of DICOM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-25826. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-244/
CVE ID: CVE-2025-3483 State: PUBLISHED Published: 2025-05-22T00:51:15.822Z Last Updated: 2025-05-22T13:38:54.360Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MedDream Products: PACS Server Problem Types: CWE-121 Description: MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MedDream PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of DICOM files. The issue results from the lack of proper validation of the length of user-supplied data
hin the parsing of DICOM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-25825. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-243/
CVE ID: CVE-2025-3484 State: PUBLISHED Published: 2025-05-22T00:51:10.840Z Last Updated: 2025-05-22T13:39:12.451Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MedDream Products: PACS Server Problem Types: CWE-121 Description: MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MedDream PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of DICOM files. The issue results from the lack of proper validation of the length of user-supplied data
hin the parsing of DICOM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-25853. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-242/
CVE ID: CVE-2025-3485 State: PUBLISHED Published: 2025-06-06T18:50:54.173Z Last Updated: 2025-06-09T16:49:21.035Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Allegra Products: Allegra Problem Types: CWE-22 Description: Allegra extractFileFromZip Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the extractFileFromZip method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operatio
method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26524. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-254/ - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-2
CVE ID: CVE-2025-3486 State: PUBLISHED Published: 2025-05-22T00:55:02.404Z Last Updated: 2025-05-22T13:36:56.743Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Allegra Products: Allegra Problem Types: CWE-22 Description: Allegra isZipEntryValide Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the isZipEntryValide method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations.
hod. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-25730. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-255/ - https://alltena.com/en/resources/release-notes/release-notes-for-release-8-1-2
CVE ID: CVE-2025-3487 State: PUBLISHED Published: 2025-04-17T11:13:05.992Z Last Updated: 2025-04-17T13:46:15.950Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpmudev Products: Forminator Forms – Contact Form, Payment Form & Custom Form Builder Problem Types: CWE-79 Description: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘limit’ parameter in all versions up to, and including, 1.42.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary w
ping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5039d63b-377d-435a-be31-4ae81ea30dd3?source=cve - https://plugins.trac.wordpress.org/browser/forminator/tags/1.41.2/assets/js/front/front.multi.js#L1006 - https://plugins.trac.wordpress.org/browser/forminator/tags/1.41.2/assets/js/front/front.loader.js#L320 - https://plugins.trac.wordpress.org/changeset/3274844/