Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-5204 State: PUBLISHED Published: 2023-10-19T05:34:11.125Z Last Updated: 2025-02-13T17:19:57.801Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: quantumcloud Products: AI ChatBot Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The ChatBot plugin for WordPress is vulnerable to SQL Injection via the $strid parameter in versions up to, and including, 4.8.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into alread
he existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5ad12146-200b-48e5-82de-7572541edcc4?source=cve - https://plugins.trac.wordpress.org/browser/chatbot/trunk/qcld-wpwbot-search.php?rev=2957286#L177 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2977505%40chatbot%2Ftrunk&old=2967435%40chatbot%2Ftrunk&sfp_email=&sfph_mail= - http://packetstormsecurity.com/files/175371/WordPress-AI-Ch
Ftrunk&old=2967435%40chatbot%2Ftrunk&sfp_email=&sfph_mail= - http://packetstormsecurity.com/files/175371/WordPress-AI-ChatBot-4.8.9-SQL-Injection-Traversal-File-Deletion.html
CVE ID: CVE-2023-5205 State: PUBLISHED Published: 2023-10-21T07:33:24.194Z Last Updated: 2025-02-05T18:59:36.554Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: anilankola Products: Add Custom Body Class Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Add Custom Body Class plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_custom_body_class' value in versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrar
scaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9841b57b-b869-4282-8781-60538f6f269f?source=cve - https://plugins.trac.wordpress.org/browser/add-custom-body-class/trunk/add-custom-body-class.php#L32
CVE ID: CVE-2023-5207 State: PUBLISHED Published: 2023-09-30T08:30:30.788Z Last Updated: 2025-11-20T04:10:28.256Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-250 Description: A vulnerability was discovered in GitLab CE and EE affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. An authenticated attacker could perform arbitrary pipeline execution under the context of another user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/425604 - https://gitlab.com/gitlab-org/gitlab/-/issue
ainer: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/425604 - https://gitlab.com/gitlab-org/gitlab/-/issues/425857 - https://hackerone.com/reports/2174141
CVE ID: CVE-2023-5209 State: PUBLISHED Published: 2023-11-27T16:21:59.004Z Last Updated: 2024-08-02T07:52:07.824Z Vendors: Unknown Products: WordPress Online Booking and Scheduling Plugin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/dea6077a-81ee-451f-b049-3749a2252
Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/dea6077a-81ee-451f-b049-3749a2252c88
CVE ID: CVE-2023-5210 State: PUBLISHED Published: 2023-12-04T21:28:59.242Z Last Updated: 2024-08-02T07:52:07.831Z Vendors: Unknown Products: AMP+ Plus Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The AMP+ Plus WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1c3ff47a-12a5-49c1-a166-2c57e5c0d0aa
CVE ID: CVE-2023-5211 State: PUBLISHED Published: 2023-10-31T13:54:45.520Z Last Updated: 2025-04-22T20:01:54.732Z Vendors: Unknown Products: Fattura24 Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Fattura24 WordPress plugin before 6.2.8 does not sanitize or escape the 'id' parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/aa868380-cda7-4ec6-8a3f-d9fa692908f2
CVE ID: CVE-2023-5212 State: PUBLISHED Published: 2023-10-19T05:34:11.570Z Last Updated: 2025-02-13T17:19:58.986Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) Vendors: quantumcloud Products: AI ChatBot Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The AI ChatBot plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 4.8.9 as well as version 4.9.2. This makes it possible for authenticated attackers with subscriber privileges to delete arbitrary files on the server, which makes it possible to take over affected sites as well as others sharing the same hosti
itrary files on the server, which makes it possible to take over affected sites as well as others sharing the same hosting account. Version 4.9.1 originally addressed the issue, but it was reintroduced in 4.9.2 and fixed again in 4.9.3. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5b3f4ccb-fcc6-42ec-8e9e-03d69ae7acf2?source=cve - https://plugins.trac.wordpress.org/browser/chatbot/trunk/includes/openai/qcld-bot-openai.php?rev=2957286#L576 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2977505%40chatbot%2Ftrunk&old=2967435%40chatbot%2Ftrunk&sfp_email=&sfph_mail= - http://packetstor
ph_mail=&reponame=&new=2977505%40chatbot%2Ftrunk&old=2967435%40chatbot%2Ftrunk&sfp_email=&sfph_mail= - http://packetstormsecurity.com/files/175371/WordPress-AI-ChatBot-4.8.9-SQL-Injection-Traversal-File-Deletion.html
CVE ID: CVE-2023-5214 State: PUBLISHED Published: 2023-10-06T17:22:49.431Z Last Updated: 2024-09-19T14:37:03.576Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N) Vendors: Puppet Products: Bolt Problem Types: CWE-269 Description: In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.puppet.com/security/cve/cve-2023-5214-privilege-escalation-puppet-bolt
CVE ID: CVE-2023-5215 State: PUBLISHED Published: 2023-09-28T13:55:32.462Z Last Updated: 2025-11-08T08:55:24.112Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8 Advanced Virtualization Problem Types: CWE-241 Description: A flaw was found in libnbd. A server can reply with a block size larger than 2^63 (the NBD spec states the size is a 64-bit unsigned value). This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbd_get_size() function correctly. Additional Analyst Notes: - CVE P
clients that doesn't treat the return value of the nbd_get_size() function correctly. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:2204 - https://access.redhat.com/security/cve/CVE-2023-5215 - https://bugzilla.redhat.com/show_bug.cgi?id=2241041 - https://listman.redhat.com/archives/libguestfs/2023-September/032635.html
CVE ID: CVE-2023-5217 State: PUBLISHED Published: 2023-09-28T15:23:18.340Z Last Updated: 2025-10-21T23:05:36.191Z Vendors: Google Products: Chrome, libvpx Problem Types: Heap buffer overflow Description: Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html - https://crbug.com/1486441 - http://www.openwall.com/lists/oss-security/2023/09/28/5 -
annel-update-for-desktop_27.html - https://crbug.com/1486441 - http://www.openwall.com/lists/oss-security/2023/09/28/5 - http://www.openwall.com/lists/oss-security/2023/09/28/6 - http://www.openwall.com/lists/oss-security/2023/09/29/1 - http://www.openwall.com/lists/oss-security/2023/09/29/2 - http://www.openwall.com/lists/oss-security/2023/09/29/7 - http://www.openwall.com/lists/oss-security/2023/09/29/9 - https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/ - https://security-tracker.debian.org/tracker/CVE-2023-5217 - https://bugzilla.redhat.com/show_bug.cgi?id=2241191 - https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/ - https://www.openwall.com/li
2241191 - https://stackdiary.com/google-discloses-a-webm-vp8-bug-tracked-as-cve-2023-5217/ - https://www.openwall.com/lists/oss-security/2023/09/28/5 - https://pastebin.com/TdkC4pDv - https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590 - https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282 - https://github.com/webmproject/libvpx/tags - http://www.openwall.com/lists/oss-security/2023/09/29/11 - http://www.openwall.com/lists/oss-security/2023/09/29/12 - http://www.openwall.com/lists/oss-security/2023/09/29/14 - https://www.debian.org/security/2023/dsa-5510 - https://www.debian.org/security/2023/dsa-5509 - https://www.debian.org
- https://www.debian.org/security/2023/dsa-5510 - https://www.debian.org/security/2023/dsa-5509 - https://www.debian.org/security/2023/dsa-5508 - http://www.openwall.com/lists/oss-security/2023/09/30/1 - https://lists.debian.org/debian-lts-announce/2023/09/msg00038.html - https://twitter.com/maddiestone/status/1707163313711497266 - https://arstechnica.com/security/2023/09/new-0-day-in-chrome-and-firefox-is-likely-to-plague-other-software/ - https://github.com/webmproject/libvpx/releases/tag/v1.13.1 - http://www.openwall.com/lists/oss-security/2023/09/30/3 - http://www.openwall.com/lists/oss-security/2023/09/30/2 - http://www.openwall.com/lists/oss-security/2023/09/30/4 - http://www.openwall.
all.com/lists/oss-security/2023/09/30/2 - http://www.openwall.com/lists/oss-security/2023/09/30/4 - http://www.openwall.com/lists/oss-security/2023/09/30/5 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BCVSHVX2RFBU3RMCUFSATVQEJUFD4Q63/ - http://www.openwall.com/lists/oss-security/2023/10/01/2 - http://www.openwall.com/lists/oss-security/2023/10/01/1 - http://www.openwall.com/lists/oss-security/2023/10/01/5 - https://lists.debian.org/debian-lts-announce/2023/10/msg00001.html - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ - https://lists.fedoraproject.org/archi
ckage-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55YVCZNAVY3Y5E4DWPWMX2SPKZ2E5SOV/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MFWDFJSSIFKWKNOCTQCFUNZWAXUCSS4/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CWEJYS5NC7KVFYU3OAMPKQDYN6JQGVK6/ - http://www.openwall.com/lists/oss-security/2023/10/02/6 - http://www.openwall.com/lists/oss-security/2023/10/03/11 - https://security.gentoo.org/glsa/202310-04 - https://support.apple.com/kb/HT213961 - https://lists.fedorapr
3/10/03/11 - https://security.gentoo.org/glsa/202310-04 - https://support.apple.com/kb/HT213961 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AY642Z6JZODQJE7Z62CFREVUHEGCXGPD/ - http://seclists.org/fulldisclosure/2023/Oct/12 - https://lists.debian.org/debian-lts-announce/2023/10/msg00015.html - https://support.apple.com/kb/HT213972 - http://seclists.org/fulldisclosure/2023/Oct/16 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE7F54W5O5RS4ZMAAC7YK3CZWQXIDSKB/ - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-5218 State: PUBLISHED Published: 2023-10-11T22:28:51.637Z Last Updated: 2025-04-30T20:35:47.186Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Site Isolation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_10.html - https://crbug.com/1487110 - https://www.debian.org/security/2023/dsa-5526 - https://lists.fedoraproject.org/archives/list/packag
crbug.com/1487110 - https://www.debian.org/security/2023/dsa-5526 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F5QCMP6KKWPDZZLFU7YXSZDHEKOE7BXO/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M4GHJ3FK5NPHDRUR4OJOI4UU6FKSOOGG/ - https://security.gentoo.org/glsa/202311-11 - https://security.gentoo.org/glsa/202312-07 - https://security.gentoo.org/glsa/202401-34
CVE ID: CVE-2023-5221 State: PUBLISHED Published: 2023-09-27T13:31:05.111Z Last Updated: 2024-09-24T13:51:43.716Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: ForU Products: CMS Problem Types: CWE-94 Description: A vulnerability classified as critical has been found in ForU CMS. This affects an unknown part of the file /install/index.php. The manipulation of the argument db_name leads to code injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability i
hy information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-240363. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.240363 - https://vuldb.com/?ctiid.240363 - https://github.com/Fovker8/cve/blob/main/rce.md
CVE ID: CVE-2023-5222 State: PUBLISHED Published: 2023-09-27T13:31:06.216Z Last Updated: 2024-08-02T07:52:08.454Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Viessmann Products: Vitogate 300 Problem Types: CWE-259 Description: A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0. This vulnerability affects the function isValidUser of the file /cgi-bin/vitogate.cgi of the component Web Management Interface. The manipulation leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240364. NOTE: The vendor was contacted early about this
ic and may be used. The identifier of this vulnerability is VDB-240364. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.240364 - https://vuldb.com/?ctiid.240364 - https://github.com/Push3AX/vul/blob/main/viessmann/Vitogate300_HardcodedPassword.md
CVE ID: CVE-2023-5223 State: PUBLISHED Published: 2023-09-27T14:00:06.947Z Last Updated: 2024-09-24T14:13:43.792Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: HimitZH Products: HOJ Problem Types: CWE-265 Description: A vulnerability, which was classified as critical, has been found in HimitZH HOJ up to 4.6-9a65e3f. This issue affects some unknown processing of the component Topic Handler. The manipulation leads to sandbox issue. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240365 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
ssigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.240365 - https://vuldb.com/?ctiid.240365 - https://github.com/payI0ad/cves/issues/1
CVE ID: CVE-2023-5226 State: PUBLISHED Published: 2023-12-01T07:01:43.131Z Last Updated: 2025-11-20T04:10:33.281Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-94 Description: An issue has been discovered in GitLab affecting all versions before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. Under certain circumstances, a malicious actor bypass prohibited branch checks using a specially crafted branch name to manipulate repository content in the UI. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/42
he UI. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/426400 - https://hackerone.com/reports/2173053
CVE ID: CVE-2023-5227 State: PUBLISHED Published: 2023-09-30T00:00:15.175Z Last Updated: 2024-09-23T16:12:25.814Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/a335c013-db75-4120-872c-42059c7100e8 - https://github.com/thorsten/phpmyfaq/commit/abf52487422ce47195c8a80bd904a7af39f60297
CVE ID: CVE-2023-5228 State: PUBLISHED Published: 2023-11-06T20:40:45.628Z Last Updated: 2025-02-26T21:19:45.998Z Vendors: Unknown Products: User Registration Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/50ae7008-46f0-4f89-ae98-65dcabe4ef09
CVE ID: CVE-2023-5229 State: PUBLISHED Published: 2023-10-31T13:54:41.760Z Last Updated: 2025-04-23T16:10:44.761Z Vendors: Unknown Products: E2Pdf Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fb6ce636-9e0d-4c5c-bb95-dde1d2581245
CVE ID: CVE-2023-5230 State: PUBLISHED Published: 2023-09-28T04:31:35.287Z Last Updated: 2025-02-05T19:18:13.055Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: templatemonster-2002 Products: TM WooCommerce Compare & Wishlist Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The TM WooCommerce Compare & Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tm_woo_wishlist_table' shortcode in versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker
nt input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/771ecb8c-feb1-40ea-b47b-a2ae033b3c87?source=cve - https://plugins.trac.wordpress.org/browser/tm-woocommerce-compare-wishlist/tags/1.1.7/includes/wishlist/wishlist.php#L339
CVE ID: CVE-2023-5231 State: PUBLISHED Published: 2023-10-20T07:29:32.612Z Last Updated: 2025-02-05T19:03:55.645Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pogidude Products: Magic Action Box Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Magic Action Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.17.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary w
s. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ce9b908b-1388-41fb-915c-e4e29eaf57ed?source=cve - https://plugins.trac.wordpress.org/browser/magic-action-box/tags/2.17.2/lib/functions.php#L287
CVE ID: CVE-2023-5232 State: PUBLISHED Published: 2023-09-28T04:31:34.717Z Last Updated: 2025-02-05T19:18:22.833Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jr00ck Products: Font Awesome More Icons Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Font Awesome More Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' shortcode in versions up to, and including, 3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inj
plied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/15947764-a070-4715-bd44-cb79b62ed59d?source=cve - https://plugins.trac.wordpress.org/browser/font-awesome-more-icons/tags/3.5/plugin.php#L82