Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12848 State: PUBLISHED Published: 2025-01-09T11:11:01.778Z Last Updated: 2025-01-09T14:44:08.598Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: sonalsinha21 Products: SKT Page Builder Problem Types: CWE-862 Description: The SKT Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the 'addLibraryByArchive' function in all versions up to, and including, 4.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files that make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
files that make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/89e3cef3-c1aa-4df7-a9f9-1ca5837643e1?source=cve - https://plugins.trac.wordpress.org/browser/skt-builder/trunk/sktbuilder.php#L960 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3213786%40skt-builder&new=3213786%40skt-builder&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3218995%40skt-builder&new=3218995%40skt-builder&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12849 State: PUBLISHED Published: 2025-01-07T05:23:53.756Z Last Updated: 2025-01-07T16:16:17.325Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: wpguruin Products: Error Log Viewer By WP Guru Problem Types: CWE-22 Description: The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_elvwp_log_download AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfe
h can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/57888e36-3a61-4452-b4ea-9db9e422dc2d?source=cve - https://plugins.trac.wordpress.org/browser/error-log-viewer-wp/tags/1.0.1.3/error-log-viewer-wp.php#L295 - https://plugins.trac.wordpress.org/browser/error-log-viewer-wp/tags/1.0.1.3/error-log-viewer-wp.php#L479 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3215563%40error-log-viewer-wp&new=3215563%40error-log-viewer-wp&sfp_email=&sfph_mail=#file10
CVE ID: CVE-2024-12850 State: PUBLISHED Published: 2024-12-24T09:21:50.959Z Last Updated: 2024-12-24T15:10:15.661Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: sminozzi Products: Database Backup and check Tables Automated With Scheduler 2024 Problem Types: CWE-22 Description: The Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.32 via the database_backup_ajax_download() function. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain
rs, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b972626c-6374-4084-a0e1-1ea4a3062228?source=cve - http://plugins.svn.wordpress.org/database-backup/tags/2.32/functions/download.php - https://plugins.trac.wordpress.org/changeset/3212315/database-backup/trunk/functions/download.php
CVE ID: CVE-2024-12851 State: PUBLISHED Published: 2025-01-08T06:41:37.636Z Last Updated: 2025-01-08T14:37:46.606Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bdthemes Products: Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) Problem Types: CWE-79 Description: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom_attributes parameter of the Cookie Consent Widget in all versions up to, and including, 5.10.14 due to insufficient input sanitization and output escapi
ie Consent Widget in all versions up to, and including, 5.10.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/39b0af74-f773-4a56-b169-2ee11e923813?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3212890%40bdthemes-element-pack-lite&new=3212890%40bdthemes-element-pack-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12852 State: PUBLISHED Published: 2025-01-08T06:41:38.203Z Last Updated: 2025-01-08T14:37:15.895Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: thehappymonster Products: Happy Addons for Elementor Problem Types: CWE-79 Description: The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_cmc_text' parameter of the Happy Mouse Cursor in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whe
cated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e60d4528-2ec5-4a4b-be77-0fc012c13720?source=cve - https://plugins.trac.wordpress.org/changeset/3212495/happy-elementor-addons/tags/3.15.2/assets/js/custom-mouse-cursor.js
CVE ID: CVE-2024-12853 State: PUBLISHED Published: 2025-01-08T09:18:36.690Z Last Updated: 2025-01-08T13:55:46.858Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpchill Products: Modula Image Gallery Problem Types: CWE-434 Description: The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 2.11.10. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP V
iles on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ef86b1f2-d5aa-4e83-a792-5fa35734b3d3?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3218127%40modula-best-grid-gallery&new=3218127%40modula-best-grid-gallery&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12854 State: PUBLISHED Published: 2025-01-08T09:18:36.303Z Last Updated: 2025-01-08T13:56:37.871Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ggnomes Products: Garden Gnome Package Problem Types: CWE-434 Description: The Garden Gnome Package plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the functionality that automatically extracts 'ggpkg' files that have been uploaded in all versions up to, and including, 2.3.0. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execu
Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6bcfc8f1-e962-4ad7-8a9d-89ce5c9022b6?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3215986%40garden-gnome-package&new=3215986%40garden-gnome-package&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12855 State: PUBLISHED Published: 2025-01-08T08:18:17.853Z Last Updated: 2025-01-08T14:04:04.386Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: scriptsbundle Products: AdForest Problem Types: CWE-862 Description: The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions like 'sb_remove_ad' in all versions up to, and including, 5.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete posts, attachments and deactivate a license. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wor
, attachments and deactivate a license. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/db7f5553-758b-47ab-8319-a549b73f4cfa?source=cve - https://themeforest.net/item/adforest-classified-wordpress-theme/19481695
CVE ID: CVE-2024-12856 State: PUBLISHED Published: 2024-12-27T16:03:04.567Z Last Updated: 2025-11-22T12:22:39.876Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Four-Faith Products: F3x24, F3x36 Problem Types: CWE-78, CWE-1392 Description: The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system time via apply.cgi. Additionally, this firmware version has default credentials which, if not changed, would effectively change this vulnerability into an unauthentic
e version has default credentials which, if not changed, would effectively change this vulnerability into an unauthenticated and remote OS command execution issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vulncheck.com/blog/four-faith-cve-2024-12856 - https://vulncheck.com/advisories/four-faith-time - https://ducklingstudio.blog.fc2.com/blog-entry-392.html
CVE ID: CVE-2024-12857 State: PUBLISHED Published: 2025-01-22T07:03:52.415Z Last Updated: 2025-02-12T19:14:31.820Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: scriptsbundle Products: AdForest Problem Types: CWE-288 Description: The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.8. This is due to the plugin not properly verifying a user's identity prior to logging them in as that user. This makes it possible for unauthenticated attackers to authenticate as any user as long as they have configured OTP login by phone number. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
as they have configured OTP login by phone number. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4ff3b4f1-dd36-43d0-b472-55a940907437?source=cve - https://themeforest.net/item/adforest-classified-wordpress-theme/19481695
CVE ID: CVE-2024-12858 State: REJECTED Published: 2025-03-13T16:47:43.636Z Last Updated: 2025-04-02T15:02:50.433Z Description: No description available.
CVE ID: CVE-2024-12859 State: PUBLISHED Published: 2025-02-03T19:22:49.632Z Last Updated: 2025-02-03T20:19:08.408Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PX-lab Products: BoomBox Theme Extensions Problem Types: CWE-98 Description: The BoomBox Theme Extensions plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8.0 via the 'boombox_listing' shortcode 'type' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access c
rbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c3a647b6-ed9e-402d-9424-2937f7aa8960?source=cve - https://documentation.px-lab.com/boombox/changelog/
CVE ID: CVE-2024-12860 State: PUBLISHED Published: 2025-02-18T08:21:43.498Z Last Updated: 2025-02-18T14:33:14.791Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: scriptsbundle Products: CarSpot – Dealership Wordpress Classified Theme Problem Types: CWE-620 Description: The CarSpot – Dealership Wordpress Classified Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.4.3. This is due to the plugin not properly validating a token prior to updating a user's password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and l
is makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d1043dce-628f-485b-bc1c-b78938c2a6f5?source=cve - https://themeforest.net/item/carspot-automotive-car-dealer-wordpress-classified-theme/20195539
CVE ID: CVE-2024-12861 State: PUBLISHED Published: 2025-01-30T13:42:04.266Z Last Updated: 2025-01-30T14:46:29.447Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: villatheme Products: W2S – Migrate WooCommerce to Shopify Problem Types: CWE-73 Description: The W2S – Migrate WooCommerce to Shopify plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.2.1 via the 'viw2s_view_log' AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vuln
nts of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8a8eeae9-572c-420a-be7d-a240c54e96ae?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3227799%40w2s-migrate-woo-to-shopify&new=3227799%40w2s-migrate-woo-to-shopify&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12862 State: PUBLISHED Published: 2025-04-21T14:22:59.811Z Last Updated: 2025-04-21T15:15:07.571Z Vendors: OpenText Products: Content Server Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in the OpenText Content Server REST API on Windows, Linux allows users without the appropriate permissions to remove external collaborators.This issue affects Content Server: 20.2-24.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0839115
CVE ID: CVE-2024-12863 State: PUBLISHED Published: 2025-04-21T15:13:04.555Z Last Updated: 2025-04-21T15:24:29.951Z Vendors: OpenText Products: OpenText Content Management Problem Types: CWE-79 Description: Stored XSS in Discussions in OpenText Content Management CE 20.2 to 25.1 on Windows and Linux allows authenticated malicious users to inject code into the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0839121
CVE ID: CVE-2024-12864 State: PUBLISHED Published: 2025-03-20T10:10:47.575Z Last Updated: 2025-03-20T18:16:36.810Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: netease-youdao Products: netease-youdao/qanything Problem Types: CWE-400 Description: A Denial of Service (DoS) vulnerability was discovered in the file upload feature of netease-youdao/qanything version v2.0.0. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this vulnerability by sending a large filename, causing the server to become overwhelmed and unavailable for legitimate users. This attack does not require auth
lename, causing the server to become overwhelmed and unavailable for legitimate users. This attack does not require authentication, making it highly scalable and increasing the risk of exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/365c3b9a-180c-4bb5-98d8-dbd78d93fcb7
CVE ID: CVE-2024-12866 State: PUBLISHED Published: 2025-03-20T10:11:31.785Z Last Updated: 2025-03-20T14:12:15.592Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: netease-youdao Products: netease-youdao/qanything Problem Types: CWE-22 Description: A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0. This vulnerability allows an attacker to read arbitrary files on the file system, which can lead to remote code execution by retrieving private SSH keys, reading private files, source code, and configuration files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/c23da7c7-a226-40a2-83db-6
s. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/c23da7c7-a226-40a2-83db-6a8ab1b2ef64
CVE ID: CVE-2024-12867 State: PUBLISHED Published: 2024-12-20T19:19:43.985Z Last Updated: 2024-12-24T16:59:02.357Z Vendors: Arctic Security Products: Arctic Hub Problem Types: CWE-918 Description: Server-Side Request Forgery in URL Mapper in Arctic Security's Arctic Hub versions 3.0.1764-5.6.1877 allows an unauthenticated remote attacker to exfiltrate and modify configurations and data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.arcticsecurity.com/security/vulnerability-note-2024-12-20
CVE ID: CVE-2024-12868 State: REJECTED Published: 2025-03-20T10:10:22.627Z Last Updated: 2025-04-15T15:56:09.879Z Description: No description available.
CVE ID: CVE-2024-12869 State: PUBLISHED Published: 2025-03-20T10:11:19.807Z Last Updated: 2025-10-15T12:49:32.208Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: infiniflow Products: infiniflow/ragflow Problem Types: CWE-306 Description: In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead to a privacy breach where users' personal or private information, such as email addresses or usernames in the invite list, could be exposed without their consent. This data leakage can facilitate further attacks, such as phishing or spam, and result in loss of trust an
heir consent. This data leakage can facilitate further attacks, such as phishing or spam, and result in loss of trust and potential regulatory issues. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/768b1a56-1e79-416a-8445-65953568b04a
CVE ID: CVE-2024-12870 State: PUBLISHED Published: 2025-03-20T10:10:45.160Z Last Updated: 2025-03-20T18:17:16.328Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: infiniflow Products: infiniflow/ragflow Problem Types: CWE-79 Description: A stored cross-site scripting (XSS) vulnerability exists in infiniflow/ragflow, affecting the latest commit on the main branch (cec2080). The vulnerability allows an attacker to upload HTML/XML files that can host arbitrary JavaScript payloads. These files are served with the 'application/xml' content type, which is automatically rendered by browsers. This can lead to the execution of arbitrary JavaScript in the context of t
which is automatically rendered by browsers. This can lead to the execution of arbitrary JavaScript in the context of the user's browser, potentially allowing attackers to steal cookies and gain unauthorized access to user files and resources. The vulnerability does not require authentication, making it accessible to anyone with network access to the instance. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/d6b497d2-5c95-4abc-8033-04b8068fed65
CVE ID: CVE-2024-12871 State: PUBLISHED Published: 2025-03-20T10:11:07.129Z Last Updated: 2025-03-20T13:35:32.904Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: infiniflow Products: infiniflow/ragflow Problem Types: CWE-79 Description: An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowledge base. When the file is viewed within Ragflow, the payload is executed in the context of the user's browser. This can lead to session hijacking, data exfiltration, or unauthorized actions performed on behalf of the victim, compromising sensitive user data and affecting the integrity of the entire applic
ons performed on behalf of the victim, compromising sensitive user data and affecting the integrity of the entire application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/7903945c-2839-4dd5-9d40-9ef47fe53118
CVE ID: CVE-2024-12872 State: PUBLISHED Published: 2025-01-31T06:00:09.835Z Last Updated: 2025-01-31T16:27:50.673Z Vendors: Unknown Products: Zalomení Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Zalomení WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a8a706c6-7f0f-4148-9f6f-40c0ca95dd9a/
CVE ID: CVE-2024-12873 State: PUBLISHED Published: 2025-05-15T20:06:57.883Z Last Updated: 2025-05-20T18:56:17.652Z Vendors: Unknown Products: Custom Field Manager Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3e82d45f-7b8f-424e-a8d7-be64f5acf65e/
CVE ID: CVE-2024-12874 State: PUBLISHED Published: 2025-05-15T20:06:58.092Z Last Updated: 2025-05-20T19:29:37.922Z Vendors: Unknown Products: Top Comments Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Top Comments WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7cc14a87-4605-49f6-9d51-0b9eb57e6c9d/