Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-13405 State: PUBLISHED Published: 2025-02-19T07:32:15.148Z Last Updated: 2025-02-19T15:08:08.123Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: apptivo Products: Apptivo Business Site CRM Problem Types: CWE-352 Description: The Apptivo Business Site CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3. This is due to missing or incorrect nonce validation on the 'awp_ip_deny' page. This makes it possible for unauthenticated attackers to block IP addresses via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional
ed request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f8225e3c-5413-4406-a31b-80829b6b330a?source=cve - https://wordpress.org/plugins/apptivo-business-site/
CVE ID: CVE-2024-13406 State: PUBLISHED Published: 2025-01-22T07:03:51.822Z Last Updated: 2025-02-12T20:41:22.420Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: icopydoc Products: XML for Google Merchant Center Problem Types: CWE-79 Description: The XML for Google Merchant Center plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'feed_id' parameter in all versions up to, and including, 3.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as cl
t arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/070f66ae-65aa-4670-8b69-103070a000a4?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3226403%40xml-for-google-merchant-center&new=3226403%40xml-for-google-merchant-center&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13407 State: PUBLISHED Published: 2025-03-14T07:23:21.314Z Last Updated: 2025-03-14T13:17:54.738Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: omnipressteam Products: Omnipress Problem Types: CWE-639 Description: The Omnipress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.5.4 via the megamenu block due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to. Additional Analyst Notes: - CISA
from password protected, private, or draft posts that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fa17f78a-5e4a-441e-bbbb-d13bad648c39?source=cve - https://plugins.trac.wordpress.org/changeset/3254484/omnipress/trunk/includes/Blocks/BlockTypes/Megamenu.php
CVE ID: CVE-2024-13408 State: PUBLISHED Published: 2025-01-24T11:07:33.334Z Last Updated: 2025-01-27T14:55:13.516Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpwax Products: Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget Problem Types: CWE-98 Description: The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' attribute of the `pgcu` shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execu
tcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php files can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ff346465-62c2-4a2b-8a4a-c88558d7cabd?source=cve - https://plugins.trac.wordpress.org/changeset/3227281/post-grid-carousel-ultimate/tags/1.7/includes/classes/shortcode.php
CVE ID: CVE-2024-13409 State: PUBLISHED Published: 2025-01-24T11:07:30.708Z Last Updated: 2025-01-27T14:56:00.346Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpwax Products: Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget Problem Types: CWE-22 Description: The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' parameter of the post_type_ajax_handler() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to
jax_handler() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/38672a45-b7a7-445f-9e77-7050df6920fa?source=cve - https://plugins.trac.wordpress.org/browser/post-grid-carousel-ultimate/tags/1.6.10/includes/classes/ajax.php - https://ja.wordpr
plugins.trac.wordpress.org/browser/post-grid-carousel-ultimate/tags/1.6.10/includes/classes/ajax.php - https://ja.wordpress.org/plugins/post-grid-carousel-ultimate/ - https://plugins.trac.wordpress.org/changeset/3227281/post-grid-carousel-ultimate/tags/1.7/includes/classes/ajax.php
CVE ID: CVE-2024-13410 State: PUBLISHED Published: 2025-03-19T06:57:41.231Z Last Updated: 2025-03-19T14:31:27.855Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: LoftOcean Products: CozyStay - Hotel Booking WordPress Theme, TinySalt - Personal Food Blog WordPress Theme Problem Types: CWE-502 Description: The CozyStay and TinySalt plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.7.0, and in all versions up to, and including 3.9.0, respectively, via deserialization of untrusted input in the 'ajax_handler' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP ch
he 'ajax_handler' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/61080df6-836f-4365-964a-fa2517e8be5a?source=cv
: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/61080df6-836f-4365-964a-fa2517e8be5a?source=cve - https://themeforest.net/item/cozystay-hotel-booking-wordpress-theme/47383367#item-description__changelog - https://themeforest.net/item/tinysalt-personal-food-blog-wordpress-theme/26294668#item-description__changelog
CVE ID: CVE-2024-13411 State: PUBLISHED Published: 2025-03-26T11:22:10.207Z Last Updated: 2025-03-26T13:26:51.768Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: zapier Products: Zapier for WordPress Problem Types: CWE-918 Description: The Zapier for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5.1 via the updated_user() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services. Additional Ana
nating from the web application which can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/701dc461-88e7-40bf-a4fb-f92723b6e05e?source=cve - https://plugins.trac.wordpress.org/browser/zapier/trunk/zapier.php#L114 - https://plugins.trac.wordpress.org/browser/zapier/trunk/zapier.php#L210 - https://plugins.trac.wordpress.org/browser/zapier/trunk/zapier.php#L284 - https://wordpress.org/plugins/zapier/#developers - https://plugins.trac.wordpress.org/changeset/3257975/
CVE ID: CVE-2024-13412 State: PUBLISHED Published: 2025-03-19T06:57:41.845Z Last Updated: 2025-03-19T14:29:22.170Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: LoftOcean Products: CozyStay - Hotel Booking WordPress Theme Problem Types: CWE-862 Description: The CozyStay theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handler function in all versions up to, and including, 1.7.0. This makes it possible for unauthenticated attackers to execute arbitrary actions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/67965a51-3
alyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/67965a51-39d3-4d14-adf5-d91d4c775baf?source=cve - https://themeforest.net/item/cozystay-hotel-booking-wordpress-theme/47383367#item-description__changelog
CVE ID: CVE-2024-13413 State: PUBLISHED Published: 2025-03-11T04:21:46.530Z Last Updated: 2025-03-11T14:55:29.890Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: frazahmed Products: ProductDyno Problem Types: CWE-79 Description: The ProductDyno plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘res’ parameter in all versions up to, and including, 1.0.24 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This vulnerability is
xecute if they can successfully trick a user into performing an action such as clicking on a link. This vulnerability is potentially a duplicate of CVE-2025-22320. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc1289a-abd1-43db-89b7-3e81878a0f9a?source=cve - https://plugins.trac.wordpress.org/browser/productdyno/trunk/admin/partials/productdyno-admin-display.php#L81 - https://wordpress.org/plugins/productdyno/#developers - https://plugins.trac.wordpress.org/changeset/3251678/
CVE ID: CVE-2024-13415 State: PUBLISHED Published: 2025-01-31T05:22:34.909Z Last Updated: 2025-01-31T19:35:57.008Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: techlabpro1 Products: Food Menu – Restaurant Menu & Online Ordering for WooCommerce Problem Types: CWE-862 Description: The Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the response() function in all versions up to, and including, 5.1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's settings. Additional Analyst Notes: -
ticated attackers, with Subscriber-level access and above, to modify the plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ab6dd645-8831-49bc-b6b1-bb153ef79204?source=cve - https://plugins.svn.wordpress.org/tlp-food-menu/tags/5.1.4/app/Controllers/Admin/Ajax/Settings.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3231030%40tlp-food-menu&new=3231030%40tlp-food-menu&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13416 State: PUBLISHED Published: 2025-02-06T19:09:06.798Z Last Updated: 2025-02-21T12:12:46.226Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: 2N Products: 2N OS Problem Types: CWE-532 Description: Using API in the 2N OS device, authorized user can enable logging, which discloses valid authentication tokens in system log. 2N has released an updated version 2.46 of 2N OS, where this vulnerability is mitigated. It is recommended that all customers update their devices to the latest 2N OS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.2n.com/en-GB/download/cve_2024_1341x_2nos_2_46_v1pdf
CVE ID: CVE-2024-13417 State: PUBLISHED Published: 2025-02-06T19:09:38.176Z Last Updated: 2025-02-21T12:13:34.224Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: 2N Products: 2N OS Problem Types: CWE-248 Description: Specifically crafted payloads sent to the RFID reader could cause DoS of RFID reader. After the device is restarted, it gets back to fully working state. 2N has released an updated version 2.46 of 2N OS, where this vulnerability is mitigated. It is recommended that all customers update their devices to the latest 2N OS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.2n.com/en-GB/download/cve_2024_1341x_2nos_2_46_v1
onal Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.2n.com/en-GB/download/cve_2024_1341x_2nos_2_46_v1pdf
CVE ID: CVE-2024-13418 State: PUBLISHED Published: 2025-05-02T03:21:20.383Z Last Updated: 2025-05-02T14:47:00.176Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: G5Theme Products: Benaa Framework, April Framework, Beyot Framework, Auteur Framework Problem Types: CWE-434 Description: Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files that can make remote code execution possible. This issue was escalated to Envato over two
ve, to upload arbitrary files that can make remote code execution possible. This issue was escalated to Envato over two months from the date of this disclosure and the issue, while partially patched, is still vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bced4547-3264-43dc-8bb1-89a06f74ccbd?source=cve - https://themeforest.net/item/beyot-wordpress-real-estate-theme/19514964
CVE ID: CVE-2024-13419 State: PUBLISHED Published: 2025-05-02T03:21:17.035Z Last Updated: 2025-05-02T15:00:22.379Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: G5Theme Products: Benaa Framework, April Framework, Beyot Framework, Auteur Framework Problem Types: CWE-862 Description: Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveOptions() and importThemeOptions() functions in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings which includes custom JavaScript
ted attackers, with Subscriber-level access and above, to update the plugin's settings which includes custom JavaScript that is enabled site-wide. This issue was escalated to Envato over two months from the date of this disclosure and the issue is still vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/07729c28-a73a-46f4-853e-116792d612f5?source=cve - https://themeforest.net/item/beyot-wordpress-real-estate-theme/19514964
CVE ID: CVE-2024-13420 State: PUBLISHED Published: 2025-05-02T03:21:19.589Z Last Updated: 2025-05-02T14:52:43.113Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: G5Theme Products: Benaa Framework, April Framework, Beyot Framework, Auteur Framework Problem Types: CWE-94 Description: Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_section_options', 'gsf_reset_section_options', 'gsf_create_preset_options' and more in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset and modify some of
This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset and modify some of the plugin/theme settings. This issue was escalated to Envato over two months from the date of this disclosure and the issues, while partially patched, are still vulnerable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6d484422-4adf-4370-b228-61496d5ad78a?source=cve - https://themeforest.net/item/beyot-wordpress-real-estate-theme/19514964
CVE ID: CVE-2024-13421 State: PUBLISHED Published: 2025-02-12T04:22:15.326Z Last Updated: 2025-02-12T16:09:23.340Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: contempoinc Products: Real Estate 7 WordPress Problem Types: CWE-266 Description: The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1. This is due to the plugin not properly restricting the roles allowed to be selected during registration. This makes it possible for unauthenticated attackers to register a new administrative user account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfe
r a new administrative user account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a50b3304-d55b-487a-8137-d5083c704cf4?source=cve - https://themeforest.net/item/wp-pro-real-estate-7-responsive-real-estate-wordpress-theme/12473778 - https://contempothemes.com/changelog/
CVE ID: CVE-2024-13422 State: PUBLISHED Published: 2025-01-23T11:13:28.888Z Last Updated: 2025-01-23T14:38:14.775Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: suhas93 Products: SEO Blogger to WordPress Migration using 301 Redirection Problem Types: CWE-79 Description: The SEO Blogger to WordPress Migration using 301 Redirection plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 0.4.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully tri
ossible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a3e095b5-9c0b-45ac-a78d-e50feda348cb?source=cve - https://plugins.trac.wordpress.org/browser/seo-blogger-to-wordpress-301-redirector/trunk/seo-blogger-to-wordpress.php#L356
CVE ID: CVE-2024-13423 State: PUBLISHED Published: 2025-03-05T11:22:09.022Z Last Updated: 2025-03-05T14:20:29.214Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: silkalns Products: Sparkling Problem Types: CWE-862 Description: The Sparkling theme for WordPress is vulnerable to unauthorized plugin activation/deactivation due to a missing capability check on the 'sparkling_activate_plugin' and 'sparkling_deactivate_plugin' functions in versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to activate/deactivate arbitrary plugins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/thr
tivate arbitrary plugins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1fa8dba0-0227-428d-a6de-c4247c40e481?source=cve - https://themes.trac.wordpress.org/browser/sparkling/2.4.9/inc/welcome-screen/class-sparkling-welcome.php#L69 - https://themes.trac.wordpress.org/browser/sparkling/2.4.9/inc/welcome-screen/class-sparkling-welcome.php#L82
CVE ID: CVE-2024-13424 State: PUBLISHED Published: 2025-01-31T05:22:35.263Z Last Updated: 2025-01-31T19:35:47.561Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: anzia Products: Ni Sales Commission For WooCommerce Problem Types: CWE-862 Description: The Ni Sales Commission For WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'niwoosc_ajax' AJAX endpoint in all versions up to, and including, 1.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins settings and modify commission amounts. Additional Analyst Notes: - CISA ADP Vulnrichmen
nd above, to update the plugins settings and modify commission amounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ac4a026b-ed1c-4864-8900-1d70d95af6f4?source=cve - https://wordpress.org/plugins/ni-woo-sales-commission/
CVE ID: CVE-2024-13425 State: PUBLISHED Published: 2025-02-01T07:21:38.797Z Last Updated: 2025-02-03T16:37:09.745Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpjobportal Products: WP Job Portal – A Complete Recruitment System for Company or Job Board website Problem Types: CWE-639 Description: The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.6 via the enforcedelete() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Employer-level access and
validation on a user controlled key. This makes it possible for authenticated attackers, with Employer-level access and above, to delete other users companies. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a14e110f-0850-44f4-8de3-95a654096ae8?source=cve - https://plugins.trac.wordpress.org/changeset/3229608/wp-job-portal/tags/2.2.7/modules/company/controller.php?old=3216415&old_path=wp-job-portal%2Ftags%2F2.2.6%2Fmodules%2Fcompany%2Fcontroller.php
CVE ID: CVE-2024-13426 State: PUBLISHED Published: 2025-01-22T02:20:24.893Z Last Updated: 2025-01-22T14:32:33.387Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: gamerz Products: WP-Polls Problem Types: CWE-89 Description: The WP-Polls plugin for WordPress is vulnerable to SQL Injection via COOKIE in all versions up to, and including, 2.77.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries. Those queries are stored and results are not displayed to the attacker, which mean