Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-4431 State: PUBLISHED Published: 2023-01-16T15:38:11.306Z Last Updated: 2025-04-04T20:27:19.326Z Vendors: Unknown Products: WOOCS Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WOOCS WordPress plugin before 1.3.9.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c7d12fd4-7346-4727-9f6c-7e7e5524a932 - https://wpscan
A ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c7d12fd4-7346-4727-9f6c-7e7e5524a932 - https://wpscan.com/vulnerability/860b882b-983c-44b5-8c09-b6890df8a0da
CVE ID: CVE-2022-4432 State: PUBLISHED Published: 2023-01-05T17:32:37.111Z Last Updated: 2025-04-08T15:29:47.670Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: ThinkPad X13s Problem Types: CWE-126 Description: A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS PersistenceConfigDxe driver that could allow a local attacker with elevated privileges to cause information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-103709
CVE ID: CVE-2022-4433 State: PUBLISHED Published: 2023-01-05T17:32:48.186Z Last Updated: 2025-04-10T14:08:23.719Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: ThinkPad X13s Problem Types: CWE-126 Description: A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoSetupConfigDxe driver that could allow a local attacker with elevated privileges to cause information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-103709
CVE ID: CVE-2022-4434 State: PUBLISHED Published: 2023-01-05T17:32:58.029Z Last Updated: 2025-04-10T14:08:04.421Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: ThinkPad X13s Problem Types: CWE-126 Description: A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS driver that could allow a local attacker with elevated privileges to cause information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-103709
CVE ID: CVE-2022-4435 State: PUBLISHED Published: 2023-01-05T17:33:08.775Z Last Updated: 2025-04-10T14:07:44.677Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: ThinkPad X13s Problem Types: CWE-126 Description: A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoRemoteConfigUpdateDxe driver that could allow a local attacker with elevated privileges to cause information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-103709
CVE ID: CVE-2022-4436 State: PUBLISHED Published: 2022-12-14T00:00:00 Last Updated: 2024-08-03T01:41:44.632Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Blink Media in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop_13.html - https://crbug.com/1383991 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4437 State: PUBLISHED Published: 2022-12-14T00:00:00 Last Updated: 2024-08-03T01:41:44.552Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Mojo IPC in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop_13.html - https://crbug.com/1394692 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4438 State: PUBLISHED Published: 2022-12-14T00:00:00 Last Updated: 2024-08-03T01:41:44.693Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Blink Frames in Google Chrome prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop_13.html - https://crbug.com/1381871 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/g
desktop_13.html - https://crbug.com/1381871 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4439 State: PUBLISHED Published: 2022-12-14T00:00:00 Last Updated: 2024-08-03T01:41:44.400Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Aura in Google Chrome on Windows prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via specific UI interactions. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop_13.html - https://crbug.com/1392661 - https://security.gentoo.org/glsa/202305-10 - https://security.gent
ate-for-desktop_13.html - https://crbug.com/1392661 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4440 State: PUBLISHED Published: 2022-12-14T00:00:00 Last Updated: 2024-08-03T01:41:44.632Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Profiles in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop_13.html - https://crbug.com/1382761 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4441 State: PUBLISHED Published: 2023-01-31T01:42:21.954Z Last Updated: 2025-03-26T20:28:19.016Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Hitachi Products: Hitachi Storage Plug-in for VMware vCenter Problem Types: CWE-266, CWE-287 Description: Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation. This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.9.0 before 04.9.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/
ogram Container: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-103/index.html
CVE ID: CVE-2022-4442 State: PUBLISHED Published: 2023-01-16T15:37:54.312Z Last Updated: 2025-04-04T18:13:20.220Z Vendors: Unknown Products: Custom Post Types and Custom Fields creator Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/12766537-df
lyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/12766537-df59-49d6-815a-4d68265a4c4a
CVE ID: CVE-2022-4443 State: PUBLISHED Published: 2023-01-23T14:31:34.041Z Last Updated: 2025-04-02T15:48:09.841Z Vendors: Unknown Products: BruteBank Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The BruteBank WordPress plugin before 1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1e621d62-13c7-4b2f-96ca-3617a796d037
CVE ID: CVE-2022-4444 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-15T13:05:03.156Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: ipti Products: br.tag Problem Types: CWE-707 Description: A vulnerability was found in ipti br.tag. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.13.0 is able to address this issue. The name of the patch is 7e311be22d3a0a1b53e61cb987ba13d681d85f06. It is recommended to upgrade the affected component. The associated identifier of this vulnerabilit
cb987ba13d681d85f06. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215431. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ipti/br.tag/pull/131 - https://github.com/ipti/br.tag/commit/7e311be22d3a0a1b53e61cb987ba13d681d85f06 - https://vuldb.com/?id.215431
CVE ID: CVE-2022-4445 State: PUBLISHED Published: 2023-02-13T14:32:00.912Z Last Updated: 2025-03-21T14:36:42.620Z Vendors: Unknown Products: FL3R FeelBox Problem Types: CWE-89 SQL Injection Description: The FL3R FeelBox WordPress plugin through 8.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9bb6fde0-1347-496b-be03-3512e6b7e8f8
CVE ID: CVE-2022-4446 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-14T18:00:33.446Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: tsolucio Products: tsolucio/corebos Problem Types: CWE-98 Description: PHP Remote File Inclusion in GitHub repository tsolucio/corebos prior to 8.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/718f1be6-3834-4ef2-8134-907a52009894 - https://github.com/tsolucio/corebos/commit/8035e725ecb397348bd50545e90975b699e4f9f2
CVE ID: CVE-2022-4447 State: PUBLISHED Published: 2023-01-16T15:38:06.991Z Last Updated: 2025-04-08T20:03:03.826Z Vendors: Unknown Products: Fontsy Problem Types: CWE-89 SQL Injection Description: The Fontsy WordPress plugin through 1.8.6 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6939c405-ac62-4144-bd86-944d7b89d0ad
CVE ID: CVE-2022-4448 State: PUBLISHED Published: 2023-02-13T14:32:04.877Z Last Updated: 2025-03-21T14:33:47.047Z Vendors: Unknown Products: GiveWP Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ce467a2e-081e-4a6c-bfa4-29e4447ebd3b
CVE ID: CVE-2022-4449 State: PUBLISHED Published: 2023-01-16T15:37:41.047Z Last Updated: 2025-04-07T18:12:07.084Z Vendors: Unknown Products: Page scroll to id Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Page scroll to id WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a4895f8d-5a4c-49cb-b144-b761ed8
ogram Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a4895f8d-5a4c-49cb-b144-b761ed82923d
CVE ID: CVE-2022-4450 State: PUBLISHED Published: 2023-02-08T19:04:04.874Z Last Updated: 2025-11-04T19:14:13.257Z Vendors: OpenSSL Products: OpenSSL Problem Types: double-free Description: The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will popul
M file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_
tly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20230207.txt - https://git.o
ogram Container: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20230207.txt - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=63bcf189be73a9cc1264059bed6f57974be74a83 - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=bbcf509bd046b34cca19c766bbddc31683d0858b - https://security.gentoo.org/glsa/202402-08
CVE ID: CVE-2022-4451 State: PUBLISHED Published: 2023-01-16T15:38:06.045Z Last Updated: 2025-04-04T17:45:41.897Z Vendors: Unknown Products: Social Sharing Plugin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Social Sharing WordPress plugin before 3.3.45 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a28f52a4-fd57-4f46-8983-f34c7
Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a28f52a4-fd57-4f46-8983-f34c71ec88d5
CVE ID: CVE-2022-4452 State: PUBLISHED Published: 2023-08-25T14:44:44.837Z Last Updated: 2024-08-03T01:41:44.635Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in crosvm in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/chromium/issues/detail?id=1372457 - https://crbug.com/1372457
CVE ID: CVE-2022-4453 State: PUBLISHED Published: 2023-01-16T15:37:44.926Z Last Updated: 2024-10-01T15:49:53.769Z Vendors: Unknown Products: 3D FlipBook Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The 3D FlipBook WordPress plugin through 1.13.2 does not validate or escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against high privilege users like administrators. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/120bdcb3-4288-4101-b738-cc84d02da171
CVE ID: CVE-2022-4454 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-15T13:04:54.441Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: m0ver Products: bible-online Problem Types: CWE-707 Description: A vulnerability, which was classified as critical, has been found in m0ver bible-online. Affected by this issue is the function query of the file src/main/java/custom/application/search.java of the component Search Handler. The manipulation leads to sql injection. The name of the patch is 6ef0aabfb2d4ccd53fcaa9707781303af357410e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215444. A
03af357410e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215444. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/m0ver/bible-online/commit/6ef0aabfb2d4ccd53fcaa9707781303af357410e - https://vuldb.com/?id.215444
CVE ID: CVE-2022-4455 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-15T13:04:45.344Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: sproctor Products: php-calendar Problem Types: CWE-707 Description: A vulnerability, which was classified as problematic, was found in sproctor php-calendar. This affects an unknown part of the file index.php. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is a2941109b42201c19733127ced763e270a357809. It is recommended to apply a patch to fix this issue. The identifier VDB-215445 was assigned to t
3127ced763e270a357809. It is recommended to apply a patch to fix this issue. The identifier VDB-215445 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sproctor/php-calendar/commit/a2941109b42201c19733127ced763e270a357809 - https://vuldb.com/?id.215445
CVE ID: CVE-2022-4456 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-15T13:04:37.024Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: falling-fruit Problem Types: CWE-707 Description: A vulnerability has been found in falling-fruit and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 15adb8e1ea1f1c3e3d152fc266071f621ef0c621. It is recommended to apply a patch to fix this issue. VDB-215446 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Contain
this issue. VDB-215446 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/falling-fruit/falling-fruit/commit/15adb8e1ea1f1c3e3d152fc266071f621ef0c621 - https://vuldb.com/?id.215446
CVE ID: CVE-2022-4457 State: PUBLISHED Published: 2023-01-11T16:32:28.382Z Last Updated: 2025-04-09T13:43:50.264Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: Cloudflare Products: WARP Problem Types: CWE-200 Description: Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive information when installed on the victim's device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/advisories/secur
st Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/advisories/security/advisories/GHSA-35f7-fqrc-4hhj
CVE ID: CVE-2022-4458 State: PUBLISHED Published: 2023-02-13T14:32:11.163Z Last Updated: 2025-03-21T15:45:02.123Z Vendors: Unknown Products: amr shortcode any widget Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The amr shortcode any widget WordPress plugin through 4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c85ceab3-7e79-402d
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c85ceab3-7e79-402d-ad48-a028f1ee070c
CVE ID: CVE-2022-4459 State: PUBLISHED Published: 2023-02-06T19:59:25.734Z Last Updated: 2025-03-26T13:42:43.971Z Vendors: Unknown Products: WP Show Posts Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Show Posts WordPress plugin before 1.1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3ef4783b-4e4a-4691-b858-a7fa8dada4ec
CVE ID: CVE-2022-4460 State: PUBLISHED Published: 2023-01-16T15:38:02.964Z Last Updated: 2025-04-04T17:50:45.561Z Vendors: Unknown Products: Sidebar Widgets by CodeLights Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Sidebar Widgets by CodeLights WordPress plugin through 1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/034c4
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/034c4c75-42a4-4884-b63f-f9d4d2d6aebc