Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-13802 State: PUBLISHED Published: 2025-02-20T09:21:39.841Z Last Updated: 2025-02-20T15:08:07.837Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kwestion505 Products: Bandsintown Events Problem Types: CWE-79 Description: The Bandsintown Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bandsintown_events' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenev
ed attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bab22f2e-0998-4401-ae9f-45bdce658c4f?source=cve - https://plugins.trac.wordpress.org/browser/bandsintown/tags/1.3.1/bandsintown.php#L134
CVE ID: CVE-2024-13803 State: PUBLISHED Published: 2025-02-26T07:01:18.758Z Last Updated: 2025-02-26T15:34:14.704Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates Problem Types: CWE-79 Description: The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-marker’ parameter in all versions up to, and including, 5.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inje
nd output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/efdeca40-e021-478f-af75-c5566ae70735?source=cve - http://localhost:1337/wp-content/plugins/essential-blocks/assets/admin/editor/editor.js - https://plugins.trac.wordpress.org/changeset/3242493/
CVE ID: CVE-2024-13804 State: PUBLISHED Published: 2025-03-30T21:10:54.859Z Last Updated: 2025-03-31T23:35:39.658Z Vendors: Hewlett Packard Enterprise Products: HPE Insight Cluster Management Utility (CMU) Description: Unauthenticated RCE in HPE Insight Cluster Management Utility Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://red.0xbad53c.com/vulnerability-research/rce-in-hpe-insight-cluster-management-utility-cve-2024-13804
CVE ID: CVE-2024-13805 State: PUBLISHED Published: 2025-03-07T09:21:13.618Z Last Updated: 2025-03-07T14:59:29.775Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: saadiqbal Products: Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin Problem Types: CWE-79 Description: The Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.2.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and
t sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0fc6cc1b-7d49-48cd-9bce-d37c6dcfece9?source=cve - https://plugins.trac.wordpress.org/browser/file-manager-advanced/trunk/application/class_fma_connector.php - https://plugins.trac.wordpress.org/changeset/3249482/
CVE ID: CVE-2024-13806 State: PUBLISHED Published: 2025-03-01T07:24:05.886Z Last Updated: 2025-03-03T20:56:34.629Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: wpkube Products: Authors List Problem Types: CWE-94 Description: The The Authors List plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfenc
s to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dbfa20ad-6411-4054-9973-cb12d17c57f6?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3246757%40authors-list&new=3246757%40authors-list&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13807 State: PUBLISHED Published: 2025-08-28T05:24:51.897Z Last Updated: 2025-08-28T14:48:42.308Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: xagio Products: Xagio SEO – AI Powered SEO Problem Types: CWE-200 Description: The Xagio SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.1.0.5 via the backup functionality due to weak filename structure and lack of protection in the directory. This makes it possible for unauthenticated attackers to extract sensitive data from backups which can include the entire database and site's files. Additional Analyst Notes: - CISA ADP Vulnrichmen
ta from backups which can include the entire database and site's files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9d7b7f4b-6acb-4ccb-8f2e-951012996ac7?source=cve - https://plugins.trac.wordpress.org/browser/xagio-seo/tags/7.0.0.19/modules/backups/models/xagio_backups.php#L1882 - https://plugins.trac.wordpress.org/changeset/3292024/
CVE ID: CVE-2024-13808 State: PUBLISHED Published: 2025-04-26T04:22:36.503Z Last Updated: 2025-04-28T21:55:53.986Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: WPXpro Products: Xpro Elementor Addons - Pro Problem Types: CWE-94 Description: The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.9 via the custom PHP widget. This is due to their only being client side controls when determining who can access the widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. Additional Analyst Notes: - CISA ADP Vuln
ckers, with Contributor-level access and above, to execute code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0833e55f-22aa-44c9-aff6-1f3b74016e4c?source=cve - https://elementor.wpxpro.com
CVE ID: CVE-2024-13809 State: PUBLISHED Published: 2025-03-05T09:21:48.298Z Last Updated: 2025-03-05T14:20:29.736Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: heroplugins Products: Hero Slider - WordPress Slider Plugin Problem Types: CWE-89 Description: The Hero Slider - WordPress Slider Plugin plugin for WordPress is vulnerable to SQL Injection via several parameters in all versions up to, and including, 1.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries
makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a692d9c4-66e0-4461-ad13-65e1446106c5?source=cve - https://codecanyon.net/item/hero-slider-wordpress-slider-plugin/13067813
CVE ID: CVE-2024-13810 State: PUBLISHED Published: 2025-03-05T09:21:49.405Z Last Updated: 2025-03-05T14:16:09.608Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: AlThemist Products: Zass - WooCommerce Theme for Handmade Artists and Artisans Problem Types: CWE-862 Description: The Zass - WooCommerce Theme for Handmade Artists and Artisans theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'zass_import_zass' AJAX actions in all versions up to, and including, 3.9.9.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import demo content and overwrite the site. Addition
authenticated attackers, with Subscriber-level access and above, to import demo content and overwrite the site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d85e54c2-dff6-42e6-8123-767438f9c5f1?source=cve - https://themeforest.net/item/zass-wordpress-woocommerce-theme/19614113
CVE ID: CVE-2024-13811 State: PUBLISHED Published: 2025-03-05T09:21:46.444Z Last Updated: 2025-03-05T14:23:45.207Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: AlThemist Products: Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme Problem Types: CWE-862 Description: The Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafka_import_lafka' AJAX actions in all versions up to, and including, 4.5.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import demo data that overrides t
es it possible for authenticated attackers, with Subscriber-level access and above, to import demo data that overrides the site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/50d60e4f-7680-4ec0-9183-bdc8439679db?source=cve - https://themeforest.net/item/lafka-fast-food-restaurant-woocommerce-theme/23969682
CVE ID: CVE-2024-13812 State: PUBLISHED Published: 2025-04-26T08:23:19.926Z Last Updated: 2025-04-28T15:34:29.299Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Anps Products: Anps Theme plugin Problem Types: CWE-94 Description: The The Anps Theme plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.
attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5349096b-4897-4019-9eba-a959a42f03f0?source=cve - https://anpsthemes.com/
CVE ID: CVE-2024-13813 State: PUBLISHED Published: 2025-02-11T15:26:57.315Z Last Updated: 2025-02-11T16:01:48.354Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Ivanti Products: Secure Access Client Problem Types: CWE-732 Description: Insufficient permissions in Ivanti Secure Access Client before version 22.8R1 allows a local authenticated attacker to delete arbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
CVE ID: CVE-2024-13814 State: PUBLISHED Published: 2025-02-12T08:25:43.462Z Last Updated: 2025-02-12T16:08:32.364Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: LCweb Products: Global Gallery - WordPress Responsive Gallery Problem Types: CWE-94 Description: The The Global Gallery - WordPress Responsive Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 9.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arb
do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4b5ba815-ce92-4d7b-aa80-29d6fddd7f63?source=cve - https://codecanyon.net/item/global-gallery-wordpress-responsive-gallery/3310108 - https://lcweb.it/global-gallery-wordpress-photogallery-plugin/changelog/
CVE ID: CVE-2024-13815 State: PUBLISHED Published: 2025-03-05T09:21:49.762Z Last Updated: 2025-03-05T14:15:27.825Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Themographics Products: Listingo Problem Types: CWE-94 Description: The The Listingo theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.2.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.
to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e4595a79-c7d0-4e37-b19b-9ae985c9d713?source=cve - https://themeforest.net/item/listingo-business-listing-wordpress-directory-theme/20617051
CVE ID: CVE-2024-13816 State: PUBLISHED Published: 2025-03-08T08:22:56.377Z Last Updated: 2025-03-10T15:56:48.009Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: CodeRevolution Products: Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit Problem Types: CWE-862 Description: The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability checks on multiple functions in all versions up to, and including, 2.3.6. This makes it possible for authenticated attackers, with Sub
iple functions in all versions up to, and including, 2.3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and delete posts, list and delete batches, list assistant uploaded files, delete personas, delete forms, delete templates, and clear logs. The vulnerability was partially patched in version 2.3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/69de7d93-b255-4d41-8680-9762ff632804?source=cve - https://coderevolution.ro/knowledge-base/faq/full-changelog-aiomatic-automatic-ai-content-writer-editor-gpt-3-gpt-4-chatgpt-chatbot-ai-toolkit/#item-description__change
l-changelog-aiomatic-automatic-ai-content-writer-editor-gpt-3-gpt-4-chatgpt-chatbot-ai-toolkit/#item-description__changelog
CVE ID: CVE-2024-13817 State: REJECTED Published: N/A Last Updated: 2025-01-31T02:46:32.814Z Description: No description available.
CVE ID: CVE-2024-13818 State: PUBLISHED Published: 2025-02-21T03:21:20.724Z Last Updated: 2025-02-21T21:28:18.290Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: genetechproducts Products: Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Problem Types: CWE-532 Description: The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.3.9 through publicly exposed log files. This makes it p
e Information Exposure in all versions up to, and including, 3.8.3.9 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information about users contained in the exposed log files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/768730c1-a70e-432d-a234-4ce2b8aec424?source=cve - https://plugins.trac.wordpress.org/browser/pie-register/trunk/classes/base_variables.php#L68
CVE ID: CVE-2024-13820 State: PUBLISHED Published: 2025-04-08T04:21:29.674Z Last Updated: 2025-04-08T15:59:40.647Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: melhorenvio Products: Melhor Envio Problem Types: CWE-200 Description: The Melhor Envio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.15.9 via the 'run' function, which uses a hardcoded hash. This makes it possible for unauthenticated attackers to extract sensitive data including environment information, plugin tokens, shipping configurations, and limited vendor information. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
shipping configurations, and limited vendor information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a8f093bc-5cd3-41a0-b86b-d00338334d2e?source=cve - https://github.com/melhorenvio/wp-melhorenvio-v2/blob/6e2f5bb01c536df9fc84534eb8a27ec99d9601af/Services/TestService.php - https://plugins.trac.wordpress.org/browser/melhor-envio-cotacao/trunk/Services/TestService.php#L20 - https://plugins.trac.wordpress.org/browser/melhor-envio-cotacao/trunk/Services/TestService.php#L30
CVE ID: CVE-2024-13821 State: PUBLISHED Published: 2025-02-12T07:35:38.339Z Last Updated: 2025-02-18T17:40:48.948Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: wpdevelop Products: WP Booking Calendar Problem Types: CWE-285 Description: The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including, 10.10. This is due to the plugin not properly requiring re-verification after a booking has been made and a change is being attempted. This makes it possible for unauthenticated attackers to manipulate their confirmed bookings, even after they have been approved. Addition
sible for unauthenticated attackers to manipulate their confirmed bookings, even after they have been approved. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8a0b961e-ccc3-4da0-b007-bbafa133a3a8?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3234469%40booking&new=3234469%40booking&sfp_email=&sfph_mail=#file20
CVE ID: CVE-2024-13822 State: PUBLISHED Published: 2025-02-24T06:00:04.117Z Last Updated: 2025-02-24T11:26:57.421Z Vendors: Unknown Products: Photo Contest | Competition | Video Contest Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Photo Contest | Competition | Video Contest WordPress plugin through 2.8.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1f0f1553-1987-428c-9fe3-ffb3f6b0aecc/
CVE ID: CVE-2024-13823 State: PUBLISHED Published: 2025-05-15T20:07:04.734Z Last Updated: 2025-05-20T19:25:59.171Z Vendors: Unknown Products: 360 Product Rotation Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The 360 Product Rotation WordPress plugin through 1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/dcfd8a03-0a04-4fd1-986d-1e816b1fad19/
CVE ID: CVE-2024-13824 State: PUBLISHED Published: 2025-03-14T06:43:18.231Z Last Updated: 2025-03-14T14:54:00.295Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Potenzaglobalsolutions Products: CiyaShop - Multipurpose WooCommerce Theme Problem Types: CWE-502 Description: The CiyaShop - Multipurpose WooCommerce Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.19.0 via deserialization of untrusted input in the 'add_ciyashop_wishlist' and 'ciyashop_get_compare' functions. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software
possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b69c86f4-d81d-4e14-baff-3402008bb9c6?source=cve - https://themeforest.net/item/ciyashop
/threat-intel/vulnerabilities/id/b69c86f4-d81d-4e14-baff-3402008bb9c6?source=cve - https://themeforest.net/item/ciyashop-responsive-multipurpose-woocommerce-wordpress-theme/22055376#item-description__changelog
CVE ID: CVE-2024-13825 State: PUBLISHED Published: 2025-03-08T06:00:05.198Z Last Updated: 2025-03-10T17:21:54.881Z Vendors: Unknown Products: Email Keep Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Email Keep WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/368474a0-550d-49f8-855d-b2010f8b91b5/
CVE ID: CVE-2024-13826 State: PUBLISHED Published: 2025-03-08T06:00:06.915Z Last Updated: 2025-03-10T17:22:53.130Z Vendors: Unknown Products: Email Keep Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Email Keep WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/56b143b6-e5db-4037-ab2a-4e4d0cb7a005/
CVE ID: CVE-2024-13827 State: PUBLISHED Published: 2025-03-05T08:21:56.052Z Last Updated: 2025-03-05T15:00:11.761Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: razorpay Products: Razorpay Subscription Button Elementor Plugin Problem Types: CWE-79 Description: The Razorpay Subscription Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg() and remove_query_arg() functions without appropriate escaping on the URL in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully