Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-13852 State: PUBLISHED Published: 2025-02-18T04:21:15.377Z Last Updated: 2025-02-18T15:12:41.931Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: backie Products: Option Editor Problem Types: CWE-352 Description: The Option Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the plugin_page() function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default r
a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/50adbe1d-9d79-4015-9e09-2166f97efc47?source=cve - https://plugins.trac.wordpress.org/browser/option-editor/trunk/option-editor.php#L70 - https://wordpress.org/plugins/option-editor/#developers
CVE ID: CVE-2024-13853 State: PUBLISHED Published: 2025-03-11T06:00:11.237Z Last Updated: 2025-03-11T13:15:20.635Z Vendors: Unknown Products: SEO Tools Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The SEO Tools WordPress plugin through 4.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/52991dd9-41f7-4cf8-b8c9-56dd4e62bf0c/
CVE ID: CVE-2024-13854 State: PUBLISHED Published: 2025-02-19T07:32:08.945Z Last Updated: 2025-02-19T14:38:38.912Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: nicheaddons Products: Education Addon for Elementor Problem Types: CWE-284 Description: The Education Addon for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.1 via the naedu_elementor_template shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract information from posts that are not public, including drafts, passw
with Contributor-level access and above, to extract information from posts that are not public, including drafts, password protected, and restricted posts. This applies to posts created with Elementor only. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/50e8811c-07b1-4325-92a4-dc1c91afbe9e?source=cve - https://wordpress.org/plugins/education-addon/#developers
CVE ID: CVE-2024-13855 State: PUBLISHED Published: 2025-02-20T09:21:39.419Z Last Updated: 2025-02-20T15:14:41.070Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: rabmalin Products: Prime Addons for Elementor Problem Types: CWE-284 Description: The Prime Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.1 via the pae_global_block shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract information from posts that are not public, including drafts, private, password prot
-level access and above, to extract information from posts that are not public, including drafts, private, password protected, and restricted posts. This applies to posts created with Elementor only. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ac5012f2-3518-41c0-befe-597008f22152?source=cve - https://wordpress.org/plugins/prime-addons-for-elementor/#developers
CVE ID: CVE-2024-13856 State: PUBLISHED Published: 2025-03-22T06:41:12.548Z Last Updated: 2025-03-24T13:18:26.831Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: thethemefoundry Products: Your Friendly Drag and Drop Page Builder — Make Builder Problem Types: CWE-918 Description: The Your Friendly Drag and Drop Page Builder — Make Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.10 via the make_builder_ajax_subscribe() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web appli
kers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7ffcb74b-230b-4629-b22d-5db96ac5fa06?source=cve - https://wordpress.org/plugins/make-builder/#developers - https://plugins.trac.wordpress.org/browser/make-builder/trunk/plugins-screen.php#L83 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3259333%40make-builder%2Ftrunk&old=2235851%40make-builder%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13857 State: PUBLISHED Published: 2025-03-07T09:21:14.921Z Last Updated: 2025-03-07T13:36:06.585Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: davidanderson Products: WPGet API – Connect to any external REST API Problem Types: CWE-918 Description: The WPGet API – Connect to any external REST API plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from intern
o arbitrary locations originating from the web application which can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cd2a8e7b-6fca-49f3-ba6d-bdaa418f611a?source=cve - https://wordpress.org/plugins/wpgetapi/#developers - https://plugins.trac.wordpress.org/changeset/3251647/
CVE ID: CVE-2024-13858 State: PUBLISHED Published: 2025-05-02T06:41:50.012Z Last Updated: 2025-05-22T19:19:20.584Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Boss Media Products: BuddyBoss Theme, BuddyBoss Platform Problem Types: CWE-79 Description: The BuddyBoss Platform plugin and BuddyBoss Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘invitee_name’ parameter in all versions up to, and including, 2.8.50 and 2.8.41, respectively, due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that
ible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in the BuddyBoss Platform plugin in version 2.8.41. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5f50e293-aebd-44dd-a692-64dea8f6622f?source=cve - https://www.buddyboss.com/platform/ - https://www.buddyboss.com/resources/buddyboss-platform-releases/2-8-51/ - https://www.buddyboss.com/resources/buddyboss-theme-releases/2-8-50/
CVE ID: CVE-2024-13859 State: PUBLISHED Published: 2025-05-02T06:41:51.037Z Last Updated: 2025-05-09T17:54:46.231Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Boss Media Products: Buddyboss Platform Problem Types: CWE-79 Description: The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bp_nouveau_ajax_media_save’ function in all versions up to, and including, 2.8.50 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected
level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 2.8.41. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d77c8096-40b1-4ac7-881f-6aed98da6752?source=cve - https://www.buddyboss.com/platform/ - https://www.buddyboss.com/resources/buddyboss-platform-releases/2-8-51/
CVE ID: CVE-2024-13860 State: PUBLISHED Published: 2025-05-02T06:41:50.634Z Last Updated: 2025-05-09T17:54:14.103Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Boss Media Products: Buddyboss Platform Problem Types: CWE-79 Description: The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘bbp_topic_title’ parameter in all versions up to, and including, 2.8.50 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The
ss and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 2.8.41. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a0ac8a41-553e-473b-82a7-226de17e472d?source=cve - https://www.buddyboss.com/platform/ - https://www.buddyboss.com/resources/buddyboss-platform-releases/2-8-51/
CVE ID: CVE-2024-13861 State: PUBLISHED Published: 2025-04-11T12:41:45.182Z Last Updated: 2025-04-17T03:55:29.877Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Sophos Products: Taegis Endpoint Agent (Linux) Problem Types: CWE-732 Description: A code injection vulnerability in the Debian package component of Taegis Endpoint Agent (Linux) versions older than 1.3.10 allows local users arbitrary code execution as root. Redhat-based systems using RPM packages are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20250411-taegis-agent-lpe
CVE ID: CVE-2024-13862 State: PUBLISHED Published: 2025-03-11T06:00:11.819Z Last Updated: 2025-03-11T14:32:16.696Z Vendors: Unknown Products: S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality) Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality) WordPress plugin through 8.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7692b768-a33f-45a2-90f1-1f4258493979/
CVE ID: CVE-2024-13863 State: PUBLISHED Published: 2025-03-25T06:00:13.705Z Last Updated: 2025-03-25T14:16:20.110Z Vendors: Unknown Products: Stylish Google Sheet Reader 4.0 Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Stylish Google Sheet Reader 4.0 WordPress plugin before 4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a6161595-0934-4baa-9da6-73792f4b87fd/
CVE ID: CVE-2024-13864 State: PUBLISHED Published: 2025-03-11T06:00:12.171Z Last Updated: 2025-03-11T14:08:28.208Z Vendors: Unknown Products: Countdown Timer Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Countdown Timer WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b95b32b6-218a-4d02-b294-ab13458006b2/
CVE ID: CVE-2024-13865 State: PUBLISHED Published: 2025-05-15T20:07:05.242Z Last Updated: 2025-05-20T19:25:38.130Z Vendors: Unknown Products: S3Player Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The S3Player WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9cc7c5cb-983f-4593-abc5-7e224b275a23/
CVE ID: CVE-2024-13866 State: PUBLISHED Published: 2025-03-05T08:21:57.003Z Last Updated: 2025-03-05T14:51:33.455Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: appsbd Products: Simple Notification Problem Types: CWE-79 Description: The Simple Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and insta
pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e814f798-5ebc-4bea-838f-d0a803f9bdbc?source=cve - https://wordpress.org/plugins/simple-notification/#developers
CVE ID: CVE-2024-13867 State: PUBLISHED Published: 2025-02-13T09:21:46.566Z Last Updated: 2025-02-25T19:19:01.650Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: TangibleWP Products: Listivo - Classified Ads WordPress Theme Problem Types: CWE-79 Description: The Listivo - Classified Ads WordPress Theme theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 2.3.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an ac
ackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/705c2322-bb52-4337-b0dd-6bf04bd1b0e0?source=cve - https://themeforest.net/item/listivo-classified-ads-wordpress-theme/34032749
CVE ID: CVE-2024-13868 State: PUBLISHED Published: 2025-03-06T06:00:03.753Z Last Updated: 2025-03-06T14:23:32.180Z Vendors: Unknown Products: URL Shortener | Conversion Tracking | AB Testing | WooCommerce Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0bff1645-dd53-4416-a90f-7cf4a6b33c1a/
CVE ID: CVE-2024-13869 State: PUBLISHED Published: 2025-02-22T12:39:20.843Z Last Updated: 2025-02-26T17:55:01.223Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: wpvividplugins Products: Migration, Backup, Staging – WPvivid Backup & Migration Problem Types: CWE-434 Description: The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_files' function in all versions up to, and including, 0.9.112. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server wh
ticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0082e46d-fdbe-4ab7-bba3-0681a25d4495?source=cve - https://plugins.trac.wordpress.org/changeset/3242904/wpvivid-backuprestore - https://github.com/d0n601/CVE-2024-13869 - https://ryankozak.com/posts/cve-2024-13869/
CVE ID: CVE-2024-13870 State: PUBLISHED Published: 2025-03-12T11:48:35.528Z Last Updated: 2025-03-12T14:01:55.166Z Vendors: Bitdefender Products: BOX v1 Problem Types: CWE-1328 Description: An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, potentially vulnerable version of a Bitdefender-signed firmware. The attack requires Bitdefender BOX to be booted in Recovery Mode and that the attacker be present within the WiFi range of the BOX unit. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bitdefender.com/support/security-advi
BOX unit. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bitdefender.com/support/security-advisories/unauthenticated-firmware-downgrade-in-bitdefender-box-v1
CVE ID: CVE-2024-13871 State: PUBLISHED Published: 2025-03-12T11:48:20.890Z Last Updated: 2025-03-12T14:03:01.498Z Vendors: Bitdefender Products: BOX v1 Problem Types: CWE-77 Description: A command injection vulnerability exists in the /check_image_and_trigger_recovery API endpoint of Bitdefender Box 1 (firmware version 1.3.11.490). This flaw allows an unauthenticated, network-adjacent attacker to execute arbitrary commands on the device, potentially leading to full remote code execution (RCE). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bitdefender.com/support/security-advisories/unauthenticated-command-injection-in-bitdefender-box-v1
CVE ID: CVE-2024-13872 State: PUBLISHED Published: 2025-03-12T11:47:46.419Z Last Updated: 2025-03-12T14:09:37.026Z Vendors: Bitdefender Products: BOX v1 Problem Types: CWE-319 Description: Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and detection rules on the devices. Updates can be remotely triggered through the /set_temp_token API method. Then, an unauthenticated and network-adjacent attacker can use man-in-the-middle (MITM) techniques to return malicious responses. Restarted daemons that use malicious assets can then be exploited for remote code execution on the device. Addition
ses. Restarted daemons that use malicious assets can then be exploited for remote code execution on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bitdefender.com/support/security-advisories/insecure-update-mechanism-vulnerability-in-libboxhermes-so-in-bitdefender-box-v1
CVE ID: CVE-2024-13873 State: PUBLISHED Published: 2025-02-22T03:20:59.210Z Last Updated: 2025-02-22T15:30:45.782Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpjobportal Products: WP Job Portal – A Complete Recruitment System for Company or Job Board website Problem Types: CWE-639 Description: The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.8 via the deleteUserPhoto() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access
g validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to remove profile photos from users accounts. Please note that this does not officially delete the file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5fdba3c5-382e-4d2b-83d8-0e0cebf2e63c?source=cve - https://plugins.trac.wordpress.org/changeset/3242653/wp-job-portal/tags/2.2.9/includes/classes/uploads.php?old=3238353&old_path=wp-job-portal%2Ftags%2F2.2.8%2Fincludes%2Fclasses%2Fuploads.php
CVE ID: CVE-2024-13874 State: PUBLISHED Published: 2025-04-10T06:00:05.480Z Last Updated: 2025-04-10T18:19:07.234Z Vendors: Unknown Products: Feedify Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Feedify WordPress plugin before 2.4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c808e7cf-3285-402b-ab4f-a40ab822b12e/
CVE ID: CVE-2024-13875 State: PUBLISHED Published: 2025-03-20T06:00:02.741Z Last Updated: 2025-03-20T19:12:27.612Z Vendors: Unknown Products: WP-PManager Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP-PManager WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/82c54fb5-f1d9-4bae-a3de-d4335809b81c/
CVE ID: CVE-2024-13876 State: PUBLISHED Published: 2025-03-20T06:00:05.661Z Last Updated: 2025-03-20T19:09:54.407Z Vendors: Unknown Products: mEintopf Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The mEintopf WordPress plugin through 0.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d80cd18a-065f-443b-b548-d780b785d68e/
CVE ID: CVE-2024-13877 State: PUBLISHED Published: 2025-03-20T06:00:06.305Z Last Updated: 2025-03-20T19:08:49.162Z Vendors: Unknown Products: Passbeemedia Web Push Notification Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Passbeemedia Web Push Notification WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0e8ce3cf-1598-4c5d-b119-99d5f676e619/