Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ists within the HTTP server. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the HTTP server. Was ZDI-CAN-21416. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-807/
CVE ID: CVE-2024-6145 State: PUBLISHED Published: 2024-06-18T23:39:02.468Z Last Updated: 2024-08-01T21:33:04.866Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Actiontec Products: WCB6200Q Problem Types: CWE-134 Description: Actiontec WCB6200Q Cookie Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Actiontec WCB6200Q routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HTTP server. A crafted Cookie header in an HTTP request can trigger the use of a format specifier from a user-supplied string. An
r. A crafted Cookie header in an HTTP request can trigger the use of a format specifier from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the HTTP server. Was ZDI-CAN-21417. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-808/
CVE ID: CVE-2024-6146 State: PUBLISHED Published: 2024-06-18T23:39:06.916Z Last Updated: 2024-08-01T21:33:04.532Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Actiontec Products: WCB6200Q Problem Types: CWE-121 Description: Actiontec WCB6200Q uh_get_postdata_withupload Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Actiontec WCB6200Q routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HTTP server. The issue results from the lack of proper validation of the length of user-supplied
flaw exists within the HTTP server. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the HTTP server. Was ZDI-CAN-21418. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-809/
CVE ID: CVE-2024-6147 State: PUBLISHED Published: 2024-06-20T20:11:52.626Z Last Updated: 2024-08-01T21:33:04.947Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Poly Products: Plantronics Hub Problem Types: CWE-59 Description: Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Poly Plantronics Hub. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Spokes Update Service. By creating a symbolic link, an attacker can abuse th
bility. The specific flaw exists within the Spokes Update Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18271. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-802/
CVE ID: CVE-2024-6148 State: PUBLISHED Published: 2024-07-10T20:40:07.129Z Last Updated: 2025-03-25T16:40:45.148Z Vendors: Citrix Products: Citrix Workspace app for HTML5 Description: Bypass of GACS Policy Configuration settings in Citrix Workspace app for HTML5 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.citrix.com/article/CTX678037
CVE ID: CVE-2024-6149 State: PUBLISHED Published: 2024-07-10T20:42:20.488Z Last Updated: 2024-10-29T20:57:34.884Z Vendors: Citrix Products: Citrix Workspace app for HTML5 Description: Redirection of users to a vulnerable URL in Citrix Workspace app for HTML5 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.citrix.com/article/CTX678037
CVE ID: CVE-2024-6150 State: PUBLISHED Published: 2024-07-10T20:31:26.370Z Last Updated: 2024-10-29T18:21:15.712Z Vendors: Citrix Products: Citrix Provisioning Description: A non-admin user can cause short-term disruption in Target VM availability in Citrix Provisioning Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.citrix.com/article/CTX678025
CVE ID: CVE-2024-6151 State: PUBLISHED Published: 2024-07-10T20:21:25.554Z Last Updated: 2024-08-01T21:33:04.965Z Vendors: Citrix Products: Windows Virtual Delivery Agent Description: Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Virtual Delivery Agent for Windows used by Citrix Virtual Apps and Desktops and Citrix DaaS Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.citrix.com/article/CTX678035
CVE ID: CVE-2024-6152 State: PUBLISHED Published: 2024-07-27T01:51:02.425Z Last Updated: 2024-08-01T21:33:04.965Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wptexture Products: Flipbox Builder Problem Types: CWE-502 Description: The Flipbox Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5 via deserialization of untrusted input in the flipbox_builder_Flipbox_ShortCode function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plug
a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0e9cd38a-b2cd-4801-a06b-4e965fa72e04?source=cve - https://plugins.trac.wordpress.org/browser/flipbox-builder/trunk/template-front/shortcode.php#L30
CVE ID: CVE-2024-6153 State: PUBLISHED Published: 2024-06-20T20:12:35.143Z Last Updated: 2024-08-01T21:33:04.986Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Parallels Products: Desktop Problem Types: CWE-693 Description: Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows local attackers to downgrade Parallels software on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability. The specific flaw exists within the Updater service. The issue results from the lack of prop
exploit this vulnerability. The specific flaw exists within the Updater service. The issue results from the lack of proper validation of version information before performing an update. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-19481. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-803/
CVE ID: CVE-2024-6154 State: PUBLISHED Published: 2024-06-20T20:13:01.326Z Last Updated: 2024-08-01T21:33:05.150Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Parallels Products: Desktop Problem Types: CWE-122 Description: Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of p
exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the current user on the host system. Was ZDI-CAN-20450. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-804/
CVE ID: CVE-2024-6155 State: PUBLISHED Published: 2025-01-09T11:11:05.245Z Last Updated: 2025-01-09T14:25:44.448Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpsoul Products: Greenshift – animation and page builder blocks Problem Types: CWE-862 Description: The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to, and including, 9.0.0 due to a missing capability check in the greenshift_download_file_localy function, along with no SSRF protection and sanitization on uploaded SVG files. This makes it possible for aut
le_localy function, along with no SSRF protection and sanitization on uploaded SVG files. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application that can also be leveraged to download malicious SVG files containing Cross-Site Scripting payloads to the server. On Cloud-based servers, attackers could retrieve the instance metadata. The issue was partially patched in version 8.9.9 and fully patched in version 9.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fe3cfaf4-67c8-47af-bd58-e8ad27a03fae?sourc
ment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fe3cfaf4-67c8-47af-bd58-e8ad27a03fae?source=cve - https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/8.9.8/settings.php#L1385
CVE ID: CVE-2024-6156 State: PUBLISHED Published: 2024-12-05T23:11:04.815Z Last Updated: 2025-03-18T15:58:10.503Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Canonical Ltd. Products: LXD Description: Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/canonical/lxd/security/advisories/GHSA-4c49-9fpc-hc3v - https://www.cve.org/CVERecord?id=CVE-2024-6156
CVE ID: CVE-2024-6157 State: PUBLISHED Published: 2024-10-10T12:21:51.072Z Last Updated: 2024-10-10T13:31:37.953Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ABB Products: RobotWare 6 Problem Types: CWE-476 Description: An attacker who successfully exploited these vulnerabilities could cause the robot to stop. A vulnerability exists in the PROFINET stack included in the RobotWare versions listed below. This vulnerability arises under specific condition when specially crafted message is processed by the system. Below are reported vulnerabilities in the Robot Ware versions. * IRC5- RobotWare 6 < 6.15.06 except 6.10.10, and 6.13.07 Additional Analyst Notes:
bilities in the Robot Ware versions. * IRC5- RobotWare 6 < 6.15.06 except 6.10.10, and 6.13.07 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=SI20337&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2024-6158 State: PUBLISHED Published: 2024-08-09T06:00:04.497Z Last Updated: 2024-08-13T14:25:37.044Z Vendors: Unknown Products: Category Posts Widget, term-and-category-based-posts-widget Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget WordPress plugin before 4.9.13 does not validate and escape some of its "Category Posts" widget settings before outputting them back in a page/post where the Widget is embed, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example
admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8adb219f-f0a6-4e87-8626-db26e300c220/
CVE ID: CVE-2024-6159 State: PUBLISHED Published: 2025-05-15T20:07:06.609Z Last Updated: 2025-05-20T19:25:09.141Z Vendors: Unknown Products: Push Notification for Post and BuddyPress Problem Types: CWE-89 SQL Injection Description: The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/de20ebda-b0bc-489e-a8d3-e9487a2b48e8/
CVE ID: CVE-2024-6160 State: PUBLISHED Published: 2024-06-24T09:52:50.851Z Last Updated: 2024-08-01T21:33:05.087Z Vendors: Jan Syski Products: MegaBIP Problem Types: CWE-89 Description: SQL Injection vulnerability in MegaBIP software allows attacker to disclose the contents of the database, obtain session cookies or modify the content of pages. This issue affects MegaBIP software versions through 5.12.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.pl/en/posts/2024/06/CVE-2024-6160/ - https://cert.pl/posts/2024/06/CVE-2024-6160/ - https://megabip.pl/ - https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpiecze
E-2024-6160/ - https://megabip.pl/ - https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej
CVE ID: CVE-2024-6161 State: PUBLISHED Published: 2024-07-09T07:38:29.100Z Last Updated: 2024-08-01T21:33:05.138Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: pjgalbraith Products: Default Thumbnail Plus Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Default Thumbnail Plus plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'get_cache_image' function in all versions up to, and including, 1.0.2.3. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make rem
with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/046f11b6-7d1a-4bd3-8250-4c5a50fab3ff?source=cve - https://plugins.trac.wordpress.org/browser/default-thumbnail-plus/trunk/default-thumbnail-plus.php?rev=597280#L337
CVE ID: CVE-2024-6162 State: PUBLISHED Published: 2024-06-20T14:33:10.342Z Last Updated: 2025-11-07T20:40:37.694Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: EAP 8.0.1, Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat build of Apache Camel for Spring Boot 3, Red Hat build of Apache Camel - HawtIO 4, Red Hat Build of Keycloak, Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat Integration Camel K 1, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat Process Automation 7, Red Hat Single Si
Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat Process Automation 7, Red Hat Single Sign-On 7 Problem Types: CWE-400 Description: A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due t
ation failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:1194 - https://access.redhat.com/errata/RHSA-2024:4386 - https://access.redhat.com/errata/RHSA-2024:4884 - https://access.redhat.com/security/cve/CVE-2024-6162 - https://bugzilla.redhat.com/show_bug.cgi?id=2293069 - https://issues.redhat.com/browse/JBEAP-26268
CVE ID: CVE-2024-6163 State: PUBLISHED Published: 2024-07-08T13:01:38.306Z Last Updated: 2025-08-27T21:43:05.853Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Checkmk GmbH Products: Checkmk Problem Types: CWE-290 Description: Certain http endpoints of Checkmk in Checkmk < 2.3.0p10 < 2.2.0p31, < 2.1.0p46, <= 2.0.0p39 allows remote attacker to bypass authentication and access data Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/17011
CVE ID: CVE-2024-6164 State: PUBLISHED Published: 2024-07-18T06:00:04.048Z Last Updated: 2024-08-01T21:33:04.599Z Vendors: Unknown Products: Filter & Grids Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Filter & Grids WordPress plugin before 2.8.33 is vulnerable to Local File Inclusion via the post_layout parameter. This makes it possible for an unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/40bd880e-67a1-4180-b197-8dcada
ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/40bd880e-67a1-4180-b197-8dcadaa0ace4/
CVE ID: CVE-2024-6165 State: PUBLISHED Published: 2024-07-31T06:00:02.242Z Last Updated: 2024-07-31T13:58:59.116Z Vendors: Unknown Products: WANotifier Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WANotifier WordPress plugin before 2.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b9e6648a-9d19-4e73-ad6c-f727802d8dd5/
CVE ID: CVE-2024-6166 State: PUBLISHED Published: 2024-07-09T04:32:54.363Z Last Updated: 2024-08-01T21:33:05.075Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: unitecms Products: Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘addons_order’ parameter in all versions up to, and including, 1.5.112 due to insufficient escaping on the user supplied parameter and lack of sufficient prep
ns up to, and including, 1.5.112 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above and granted plugin setting edit permissions by an administrator, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9826c91c-0f6e-4d3b-bc14-4af6b60ef246?source=cve - https://plugins.trac.wordpress.org/browser/unlimited-eleme
bilities/id/9826c91c-0f6e-4d3b-bc14-4af6b60ef246?source=cve - https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_addons.class.php#L79 - https://plugins.trac.wordpress.org/changeset/3112307/
CVE ID: CVE-2024-6167 State: PUBLISHED Published: 2024-07-09T08:33:02.369Z Last Updated: 2024-08-01T21:33:04.581Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: aprokopenko Products: Just Custom Fields Problem Types: CWE-862 Missing Authorization Description: The Just Custom Fields plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several AJAX functions in all versions up to, and including, 3.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke this functionality intended for admin users. This enables subscribers to manage field groups, change
nd above, to invoke this functionality intended for admin users. This enables subscribers to manage field groups, change visibility of items among other things. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/14d71220-be60-498d-92ca-055f1c237060?source=cve - https://wordpress.org/plugins/just-custom-fields
CVE ID: CVE-2024-6168 State: PUBLISHED Published: 2024-07-09T08:33:09.117Z Last Updated: 2024-08-01T21:33:05.088Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: aprokopenko Products: Just Custom Fields Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Just Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.2. This is due to missing or incorrect nonce validation on several AJAX function. This makes it possible for unauthenticated attackers to invoke this functionality intended for admin users via a forged request granted they can trick a site administrator into perf
e this functionality intended for admin users via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This enables subscribers to manage field groups, change visibility of items among other things. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9d98946e-864f-434e-8f45-85d663bbefee?source=cve - https://wordpress.org/plugins/just-custom-fields