Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-1752 State: PUBLISHED Published: 2024-04-08T05:00:02.250Z Last Updated: 2024-10-27T22:32:56.025Z Vendors: Unknown Products: Font Farsi Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Font Farsi WordPress plugin through 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/7c87fcd2-6ffd-4285-bbf5-36efea70b620/
CVE ID: CVE-2024-1753 State: PUBLISHED Published: 2024-03-18T14:23:44.213Z Last Updated: 2025-11-20T07:11:54.063Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat Enterprise Linux 7, Red Hat OpenShif
enShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 3.11 Problem Types: CWE-59 Description: A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time. Additional Analyst Notes:
ve read-write access to the host filesystem, allowing for full container escape at build time. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:2049 - https://access.redhat.com/errata/RHSA-2024:2055 - https://access.redhat.com/errata/RHSA-2024:2064 - https://access.redhat.com/errata/RHSA-2024:2066 - https://access.redhat.com/errata/RHSA-2024:2077 - https://access.redhat.com/errata/RHSA-2024:2084 - https://access.redhat.com/errata/RHSA-2024:2089 - https://access.redhat.com/errata/RHSA-2024:2090 - https://access.redhat.com/errata/RHSA-2024:2097 - https://access.redhat.com/errata/RHSA-2024:2098 - https://access.
90 - https://access.redhat.com/errata/RHSA-2024:2097 - https://access.redhat.com/errata/RHSA-2024:2098 - https://access.redhat.com/errata/RHSA-2024:2548 - https://access.redhat.com/errata/RHSA-2024:2645 - https://access.redhat.com/errata/RHSA-2024:2669 - https://access.redhat.com/errata/RHSA-2024:2672 - https://access.redhat.com/errata/RHSA-2024:2784 - https://access.redhat.com/errata/RHSA-2024:2877 - https://access.redhat.com/errata/RHSA-2024:3254 - https://access.redhat.com/security/cve/CVE-2024-1753 - https://bugzilla.redhat.com/show_bug.cgi?id=2265513 - https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf - https://github.com/containers/podman/security/advisories
om/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf - https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3 - https://pkg.go.dev/vuln/GO-2024-2658
CVE ID: CVE-2024-1754 State: PUBLISHED Published: 2024-04-15T05:00:04.656Z Last Updated: 2024-12-02T15:08:41.443Z Vendors: Unknown Products: NPS computy Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The NPS computy WordPress plugin through 2.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/c061e792-e37a-4cf6-b46b-ff111c5a5c84/
CVE ID: CVE-2024-1755 State: PUBLISHED Published: 2024-04-15T05:00:04.951Z Last Updated: 2024-08-01T18:48:21.954Z Vendors: Unknown Products: NPS computy Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The NPS computy WordPress plugin through 2.7.5 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/481a376b-55be-4afa-94f5-c3cf8a88b8d1/
CVE ID: CVE-2024-1756 State: PUBLISHED Published: 2024-04-24T05:00:02.329Z Last Updated: 2025-03-20T19:17:32.442Z Vendors: Unknown Products: WooCommerce Customers Manager Problem Types: CWE-200 Information Exposure, CWE-352 Cross-Site Request Forgery (CSRF) Description: The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along with their id, first name and last name Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/0baedd8d-2bbe-4091-bec4-f9
ISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/0baedd8d-2bbe-4091-bec4-f99e25d7290d/
CVE ID: CVE-2024-1758 State: PUBLISHED Published: 2024-02-24T08:38:25.192Z Last Updated: 2024-08-01T18:48:22.016Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: superfaktura Products: SuperFaktura WooCommerce Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The SuperFaktura WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.40.3 via the wc_sf_url_check function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify in
to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/520598d7-863f-4bf3-ba74-fa9b2cc32767?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-superfaktura/trunk/class-wc-superfaktura.php#L3418 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040372%40woocommerce-superfaktura&new=3040372%40woocommerce-superfaktura&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1759 State: PUBLISHED Published: 2024-05-02T16:52:44.047Z Last Updated: 2024-08-01T18:48:22.014Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: alimir Products: WP ULike – Most Advanced WordPress Marketing Toolkit Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP ULike – Most Advanced WordPress Marketing Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name in all versions up to, and including, 4.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subs
ue to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d844ca83-84e5-4b6c-ae26-f300c7328d78?source=cve - https://plugins.trac.wordpress.org/changeset/3052611/wp-ulike/trunk/admin/classes/class-wp-ulike-widget.php
CVE ID: CVE-2024-1760 State: PUBLISHED Published: 2024-03-06T05:33:23.300Z Last Updated: 2024-08-01T18:48:22.006Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: croixhaug Products: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.6.20. This is due to missing or incorrect nonce validation on the ssa_factory_reset() function. This makes it possible for unauthenticated attackers to r
ncorrect nonce validation on the ssa_factory_reset() function. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0eec9744-6dbd-42bd-b9c5-c9d792cecf4b?source=cve - https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/class-support.php#L527 - https://plugins.trac.wordpress.org/changeset/3042890/simply-schedule-appointments/trunk/includes/class-support.php
CVE ID: CVE-2024-1761 State: PUBLISHED Published: 2024-03-07T04:31:35.678Z Last Updated: 2024-08-01T18:48:22.053Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ninjateam Products: WP Chat App Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Chat App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget/block in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on user supplied attributes such as 'buttonColor' and 'phoneNumber'. This makes it possible for authenticated attackers with contributor-
attributes such as 'buttonColor' and 'phoneNumber'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/85a94f32-e1e5-48ea-822e-c54d0592da28?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3044368%40wp-whatsapp%2Ftrunk&old=3029885%40wp-whatsapp%2Ftrunk&sfp_email=&sfph_mail=#file4
CVE ID: CVE-2024-1762 State: PUBLISHED Published: 2024-05-22T06:50:34.682Z Last Updated: 2024-08-01T18:48:21.867Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nextscripts Products: NextScripts: Social Networks Auto-Poster Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP_USER_AGENT header in all versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we
ient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the victim to select view "All Cron Events" in order for the injection to fire. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8063a545-4792-4ab7-b188-0e51a0fcfed4?source=cve - https://plugins.trac.wordpress.org/browser/social-networks-auto-poster-facebook-twitter-g/trunk/NextScripts_SNAP.php#L74 - https://plugins.trac.wordpress.org/browser/social-networks-auto-poster-facebook-twitt
g/trunk/NextScripts_SNAP.php#L74 - https://plugins.trac.wordpress.org/browser/social-networks-auto-poster-facebook-twitter-g/trunk/inc/nxs_functions_engine.php#L117 - https://plugins.trac.wordpress.org/browser/social-networks-auto-poster-facebook-twitter-g/trunk/inc/nxs_functions_engine.php#L125 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3084635%40social-networks-auto-poster-facebook-twitter-g%2Ftrunk&old=3004433%40social-networks-auto-poster-facebook-twitter-g%2Ftrunk&sfp_email=&sfph_mail=#file17
CVE ID: CVE-2024-1763 State: PUBLISHED Published: 2024-03-13T15:26:48.783Z Last Updated: 2024-08-08T18:40:26.695Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: xpeedstudio Products: Wp Social Login and Register Social Counter Problem Types: CWE-862 Missing Authorization Description: The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp_social/v1/ REST API endpoint in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to enable and disable certain providers for the social share and login features. Additio
e for unauthenticated attackers to enable and disable certain providers for the social share and login features. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4f145c85-f3c6-46a7-b8ae-d486dd23087d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3042283%40wp-social&new=3042283%40wp-social&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1764 State: PUBLISHED Published: 2024-03-05T21:35:52.233Z Last Updated: 2024-12-04T15:42:58.365Z Vendors: Devolutions Products: Server Problem Types: CWE-269 Description: Improper privilege management in Just-in-time (JIT) elevation module in Devolutions Server 2023.3.14.0 and earlier allows a user to continue using the elevated privilege even after the expiration under specific circumstances Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2024-0002
CVE ID: CVE-2024-1765 State: PUBLISHED Published: 2024-03-12T18:04:54.915Z Last Updated: 2024-08-01T18:48:22.108Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Cloudflare Products: quiche Problem Types: CWE-400, CWE-770 Description: Cloudflare Quiche (through version 0.19.1/0.20.0) was affected by an unlimited resource allocation vulnerability causing rapid increase of memory usage of the system running quiche server or client. A remote attacker could take advantage of this vulnerability by repeatedly sending an unlimited number of 1-RTT CRYPTO frames after previously completing the QUIC handshake. Exploitation was possible for the duration of the connecti
CRYPTO frames after previously completing the QUIC handshake. Exploitation was possible for the duration of the connection which could be extended by the attacker. quiche 0.19.2 and 0.20.1 are the earliest versions containing the fix for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/cloudflare/quiche/security/advisories/GHSA-78wx-jg4j-5j6g
CVE ID: CVE-2024-1766 State: PUBLISHED Published: 2024-06-12T11:05:08.210Z Last Updated: 2024-08-01T18:48:21.851Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: codename065 Products: Download Manager Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.2.86 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in
kes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires social engineering to successfully exploit, and the impact would be very limited due to the attacker requiring a user to login as the user with the injected payload for execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9774c999-acb6-4c5f-ad6c-10979660b164?source=cve - https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/User/views/dashboard/edit-profile.php
source=cve - https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/User/views/dashboard/edit-profile.php#L16
CVE ID: CVE-2024-1767 State: PUBLISHED Published: 2024-03-09T07:01:10.997Z Last Updated: 2024-08-01T18:48:21.962Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: creativethemeshq Products: Blocksy Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 2.0.26 due to insufficient input sanitization and output escaping on user supplied attributes like 'className' and 'radius'. This makes it possible for authenticated attackers with contributor-level and above p
tes like 'className' and 'radius'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fdeab668-9094-485f-aa01-13ba5c10ea89?source=cve - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=219324%40blocksy&new=219324%40blocksy&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1768 State: PUBLISHED Published: 2024-06-07T02:39:27.561Z Last Updated: 2024-08-01T18:48:22.048Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: nayrathemes Products: Clever Fox Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Clever Fox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's info box block in all versions up to, and including, 25.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject
ed attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/16af8724-595c-4daa-80bd-8125a32cc502?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3096085%40clever-fox&new=3096085%40clever-fox&sfp_email=&sfph_mail=#file1
CVE ID: CVE-2024-1769 State: PUBLISHED Published: 2024-03-05T01:56:03.244Z Last Updated: 2025-04-16T15:56:53.437Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: jmlapam Products: JM Twitter Cards Problem Types: CWE-200 Information Exposure Description: The JM Twitter Cards plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 12 via the meta description data. This makes it possible for unauthenticated attackers to view password protected post content when viewing the page source. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerab
t Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b48e5973-6923-47cc-a660-ecc989f540f8?source=cve - https://wordpress.org/plugins/jm-twitter-cards/
CVE ID: CVE-2024-1770 State: PUBLISHED Published: 2024-03-28T02:04:09.638Z Last Updated: 2024-08-09T19:56:36.675Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: netweblogic Products: Meta Tag Manager Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Meta Tag Manager plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.2 via deserialization of untrusted input in the get_post_data function. This makes it possible for authenticated attackers, with contributor access or higher, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additiona
er, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9ec1aed2-d299-4fa9-add6-10b63ed6aa30?source=cve - https://plugins.trac.wordpress.org/changeset/3054910/meta-tag-manager/trunk/meta-tag-manager.php
CVE ID: CVE-2024-1771 State: PUBLISHED Published: 2024-03-06T05:33:23.906Z Last Updated: 2024-08-01T18:48:22.141Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: hashthemes Products: Total Problem Types: CWE-862 Missing Authorization Description: The Total theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the total_order_sections() function in all versions up to, and including, 2.1.59. This makes it possible for authenticated attackers, with subscriber-level access and above, to repeat sections on the homepage. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - h
at sections on the homepage. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/26b64ae3-5839-47d5-9c65-7c595bb18e6c?source=cve - https://themes.trac.wordpress.org/browser/total/2.1.59/inc/customizer/customizer-functions.php#L112 - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=219020%40total%2F2.1.60&old=216973%40total%2F2.1.59
CVE ID: CVE-2024-1772 State: PUBLISHED Published: 2024-03-13T15:27:01.811Z Last Updated: 2025-04-15T15:21:30.464Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: hammadh Products: Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.4 via deserialization of untrusted input from the play_podcast_data post meta. This makes it possible for authenticated attackers, with contributor-level access and above, to in