Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-4688 State: PUBLISHED Published: 2024-05-09T21:31:04.552Z Last Updated: 2024-08-01T20:47:41.395Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Complete Web-Based School Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in Campcodes Complete Web-Based School Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /view/conversation_history_admin.php. The manipulation of the argument conversation_id leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263629
ttack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263629 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263629 - https://vuldb.com/?ctiid.263629 - https://vuldb.com/?submit.331778 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2035.pdf
CVE ID: CVE-2024-4689 State: PUBLISHED Published: 2024-05-10T08:23:21.600Z Last Updated: 2024-08-01T20:47:41.563Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ShortPixel Products: ShortPixel Adaptive Images Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ShortPixel ShortPixel Adaptive Images.This issue affects ShortPixel Adaptive Images: from n/a through 3.8.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/shortpixel-adaptive-images/wordpress-shortpixel-adaptive-images-plugin-3-8-3-cross-site-request-forgery-csrf-vulnerability?_
tpixel-adaptive-images/wordpress-shortpixel-adaptive-images-plugin-3-8-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-4690 State: PUBLISHED Published: 2024-10-16T16:41:22.265Z Last Updated: 2024-10-16T18:53:09.645Z Vendors: OpenText Products: OpenText Application Automation Tools Problem Types: CWE-611 Description: Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000033548?language=en_US
CVE ID: CVE-2024-4692 State: PUBLISHED Published: 2024-10-16T16:41:23.529Z Last Updated: 2024-10-16T18:13:23.127Z Vendors: OpenText Products: OpenText Application Automation Tools Problem Types: CWE-280 Description: Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels. Multiple missing permission checks - Service Virtualization config has been discovered in in OpenText Application Automation Tools. The vulnerability could allow users with Overall/Read permission to enumerate Service Virtualization server names. This issue affects OpenText Application Automatio
rall/Read permission to enumerate Service Virtualization server names. This issue affects OpenText Application Automation Tools: 24.1.0 and below. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000033546?language=en_US
CVE ID: CVE-2024-4693 State: PUBLISHED Published: 2024-05-10T12:57:41.445Z Last Updated: 2025-11-08T07:13:46.427Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8 Advanced Virtualization, Red Hat Enterprise Linux 9 Problem Types: CWE-672 Description: A flaw was found in the QEMU Virtio PCI Bindings (hw/virtio/virtio-pci.c). An improper release and use of the irqfd for vector 0 during the boot process leads to a guest triggerable crash via vhost_net_stop(). This flaw allows a malicious guest to crash the QEMU process on the host. Add
st triggerable crash via vhost_net_stop(). This flaw allows a malicious guest to crash the QEMU process on the host. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-4693 - https://bugzilla.redhat.com/show_bug.cgi?id=2279965
CVE ID: CVE-2024-4695 State: PUBLISHED Published: 2024-05-21T09:31:50.298Z Last Updated: 2024-08-01T20:47:41.587Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: moveaddons Products: Move Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Move Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and ab
ng on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/72662a59-f41c-4df7-aa04-7243ff43c48d?source=cve - https://plugins.trac.wordpress.org/browser/move-addons/trunk/includes/widgets/data-table/widget.php#L836 - https://plugins.trac.wordpress.org/browser/move-addons/trunk/includes/widgets/team-member/widget.php#L1464 - https://plugins.trac.wordpress.org/browser/move-addons/trun
addons/trunk/includes/widgets/team-member/widget.php#L1464 - https://plugins.trac.wordpress.org/browser/move-addons/trunk/includes/widgets/event-calendar/widget.php#L932 - https://plugins.trac.wordpress.org/browser/move-addons/trunk/includes/widgets/mailchimp/widget.php#L728 - https://plugins.trac.wordpress.org/browser/move-addons/trunk/includes/widgets/user-login/widget.php#L1146 - https://plugins.trac.wordpress.org/browser/move-addons/trunk/includes/widgets/shop-product-grid/widget.php#L1203 - https://plugins.trac.wordpress.org/changeset/3088859/
CVE ID: CVE-2024-4696 State: PUBLISHED Published: 2024-06-13T20:01:18.145Z Last Updated: 2024-08-01T20:47:41.519Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Service Bridge Problem Types: CWE-78 Description: A privilege escalation vulnerability was reported in Lenovo Service Bridge prior to version 5.0.2.17 that could allow operating system commands to be executed if a specially crafted link is visited. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-163429
CVE ID: CVE-2024-4697 State: PUBLISHED Published: 2024-06-04T05:32:16.195Z Last Updated: 2024-08-01T20:47:41.605Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: codelessthemes Products: Cowidgets – Elementor Addons Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘heading_tag’ parameter in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to
ion and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/beb28e9e-bf6a-4eed-afbc-ca85ec489df7?source=cve - https://plugins.trac.wordpress.org/browser/cowidgets-elementor-addons/trunk/inc/widgets-manager/widgets/header/class-page-title.php#L418 - https://plugins.trac.wordpress.org/browser/cowidgets-elementor-addons/trunk/inc/widgets-manager/widgets/header/class-site-title.php#L423
CVE ID: CVE-2024-4698 State: PUBLISHED Published: 2024-05-18T07:38:34.164Z Last Updated: 2024-08-01T20:47:41.652Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: uapp Products: Testimonial Carousel For Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'show_line_text ' and 'slide_button_hover_animation' parameters in versions up to, and including, 10.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with
1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4542b0f8-c9ee-4992-b737-e5f727c7b5b0?source=cve - https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/trunk/widgets/testimonials-carousel/class-testimonialscarousel-bottom.php#L1478 - https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/trunk/
estimonialscarousel-bottom.php#L1478 - https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/trunk/widgets/testimonials-carousel/class-testimonialscarousel-centered.php#L1619 - https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/trunk/widgets/testimonials-carousel/class-testimonialscarousel-gallery-coverflow.php#L1876 - https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/trunk/widgets/testimonials-carousel/class-testimonialscarousel-logo.php#L1715 - https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/trunk/widgets/testimonials-carousel/class-testimonialscarousel.php#L1847 - https://plugins.trac.wordpres
ousel-elementor/trunk/widgets/testimonials-carousel/class-testimonialscarousel.php#L1847 - https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/trunk/widgets/testimonials-carousel/class-testimonialscarousel-blog.php#L1076 - https://plugins.trac.wordpress.org/changeset/3087862/
CVE ID: CVE-2024-4699 State: PUBLISHED Published: 2024-05-10T00:31:04.335Z Last Updated: 2024-08-06T18:41:34.128Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: D-Link Products: DAR-8000-10 Problem Types: CWE-502 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-8000-10 up to 20230922. This issue affects some unknown processing of the file /importhtml.php. The manipulation of the argument sql leads to deserialization. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-263747. NOTE: This vulnerability only affects products that are no longer supported by the maint
is vulnerability is VDB-263747. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.263747 - https://vuldb.com/?ctiid.263747 - https://vuldb.com/?submit.331311 - https://github.com/I-Schnee-I/cev/blob/main/D-LINK-DAR-8000-10_rce_importhtml.md - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10354
CVE ID: CVE-2024-4700 State: PUBLISHED Published: 2024-05-21T09:31:49.711Z Last Updated: 2024-08-01T20:47:41.654Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wptb Products: WP Table Builder – WordPress Table Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Table Builder – WordPress Table Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button element in all versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in p
anitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure WP Table Builder can be extended to contributors. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/20cd08ac-826f-40dd-804a-546b0c334b66?source=cve - https://plugins.trac.wordpress.org/browser/wp-table-builder/trunk/inc/admin/element-classes/elements/button-element.php#L343 - https://plugins.trac.wordpress.org/changeset
-builder/trunk/inc/admin/element-classes/elements/button-element.php#L343 - https://plugins.trac.wordpress.org/changeset/3088612/ - https://wordpress.org/plugins/wp-table-builder/#developers
CVE ID: CVE-2024-4701 State: PUBLISHED Published: 2024-05-10T18:37:21.582Z Last Updated: 2024-08-01T20:47:41.600Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: Netflix Products: Genie Problem Types: CWE-22 Description: A path traversal issue potentially leading to remote code execution in Genie for all versions prior to 4.3.18 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2024-001.md
CVE ID: CVE-2024-4702 State: PUBLISHED Published: 2024-05-15T11:33:08.241Z Last Updated: 2024-08-01T20:47:41.685Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kraftplugins Products: Mega Elements – Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Mega Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level ac
tput escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3808ca2a-e78e-4118-890b-c22a71f8e855?source=cve - https://plugins.trac.wordpress.org/changeset/3085457/mega-elements-addons-for-elementor
CVE ID: CVE-2024-4703 State: PUBLISHED Published: 2024-06-07T07:35:27.988Z Last Updated: 2024-08-01T20:47:41.666Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: horearadu Products: One Page Express Companion Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The One Page Express Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's one_page_express_contact_form shortcode in all versions up to, and including, 1.6.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers
t input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a00a5c41-b211-45e4-acf8-01fd8e64b1c0?source=cve - https://plugins.trac.wordpress.org/changeset/3097699/one-page-express-companion
CVE ID: CVE-2024-4704 State: PUBLISHED Published: 2024-06-27T06:00:04.176Z Last Updated: 2024-08-01T20:47:41.750Z Vendors: Unknown Products: Contact Form 7 Problem Types: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') Description: The Contact Form 7 WordPress plugin before 5.9.5 has an open redirect that allows an attacker to utilize a false URL and redirect to the URL of their choosing. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/8bdcdb5a-9026-4157-8592-345df8fb1a17/
CVE ID: CVE-2024-4705 State: PUBLISHED Published: 2024-06-06T02:03:03.594Z Last Updated: 2024-08-01T20:47:41.670Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: j0hnsmith Products: Testimonials Widget Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Testimonials Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonials shortcode in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access
escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ef4603b2-bd41-4f65-ba2a-8d06e32e67c1?source=cve - https://plugins.trac.wordpress.org/browser/testimonials-widget/trunk/includes/class-testimonials-widget-premium.php#L2198
CVE ID: CVE-2024-4706 State: PUBLISHED Published: 2024-05-23T07:31:25.706Z Last Updated: 2024-08-01T20:47:41.704Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpo365 Products: WordPress + Microsoft Office 365 / Azure AD | LOGIN Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pintra' shortcode in all versions up to, and including, 27.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for
27.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/602a8030-087b-459f-b649-b4116404cf3e?source=cve - https://plugins.trac.wordpress.org/changeset/3090428/wpo365-login
CVE ID: CVE-2024-4707 State: PUBLISHED Published: 2024-06-06T03:32:52.771Z Last Updated: 2024-08-01T20:47:41.607Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: horearadu Products: Materialis Companion Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Materialis Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's materialis_contact_form shortcode in all versions up to, and including, 1.3.41 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor
on and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6ca4dff0-ca3a-44cf-a30b-36b31d2848ab?source=cve - https://plugins.trac.wordpress.org/browser/materialis-companion/trunk/theme-data/materialis/functions.php#L90 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3097691%40materialis-companion&new=3097691%40materialis-compan
rdpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3097691%40materialis-companion&new=3097691%40materialis-companion&sfp_email=&sfph_mail=
CVE ID: CVE-2024-4708 State: PUBLISHED Published: 2024-07-02T23:06:21.045Z Last Updated: 2024-08-01T20:47:41.657Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: mySCADA Products: myPRO Problem Types: CWE-259 Description: mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-184-02 - https://www.myscada.org/mypro/
CVE ID: CVE-2024-4709 State: PUBLISHED Published: 2024-05-18T07:38:34.748Z Last Updated: 2024-08-01T20:47:41.645Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: techjewel Products: Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘subject’ parameter in versions up to, and including, 5.1.16 due to insufficient input sanitization and output escap
the ‘subject’ parameter in versions up to, and including, 5.1.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, and access granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5fe317a6-a391-441a-aac8-c8fa57e73169?source=cve - https://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Services/FormBuilder/Notifications/EmailNotification.php#L106 - https://p
rac.wordpress.org/browser/fluentform/trunk/app/Services/FormBuilder/Notifications/EmailNotification.php#L106 - https://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Services/FormBuilder/Notifications/EmailNotification.php#L164 - https://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Services/FormBuilder/Notifications/EmailNotification.php#L194 - https://plugins.trac.wordpress.org/changeset/3088078/