Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12567 State: PUBLISHED Published: 2025-01-13T06:00:10.180Z Last Updated: 2025-01-13T14:54:34.691Z Vendors: Unknown Products: Email Subscribers by Icegram Express Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/82051ccc-c528-4ff3-900a-3b8e8ad34145/
CVE ID: CVE-2024-12568 State: PUBLISHED Published: 2025-01-13T06:00:10.651Z Last Updated: 2025-01-13T14:53:33.334Z Vendors: Unknown Products: Email Subscribers by Icegram Express Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Workflow settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0ce9075a-754b-474e-9620-17da8ee29b56/
CVE ID: CVE-2024-12569 State: PUBLISHED Published: 2024-12-19T08:41:33.342Z Last Updated: 2025-08-28T14:41:37.061Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Milestone Systems Products: XProtect VMS Problem Types: CWE-532 Description: Disclosure of sensitive information in a Milestone XProtect Device Pack driver’s log file for third-party cameras, allows an attacker to read camera credentials stored in the Recording Server under specific conditions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://supportcommunity.milestonesys.com/KBRedir?art=000067740&lang=en_US
CVE ID: CVE-2024-12570 State: PUBLISHED Published: 2024-12-12T11:30:44.818Z Last Updated: 2024-12-17T04:56:08.962Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-270 Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.4.6, from 17.5 prior to 17.5.4, and from 17.6 prior to 17.6.2. It may have been possible for an attacker with a victim's `CI_JOB_TOKEN` to obtain a GitLab session token belonging to the victim. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/494694 - https://hackerone.com/reports/
SA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/494694 - https://hackerone.com/reports/2724948
CVE ID: CVE-2024-12571 State: PUBLISHED Published: 2024-12-20T06:59:06.242Z Last Updated: 2024-12-20T16:03:56.627Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: moaluko Products: Store Locator for WordPress with Google Maps – LotsOfLocales Problem Types: CWE-98 Description: The Store Locator for WordPress with Google Maps – LotsOfLocales plugin for WordPress is vulnerable to Local File Inclusion in version 3.98.9 via the 'sl_engine' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain s
the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4ea89a6e-e089-4e8d-afd8-2a217f6910a6?source=cve - https://plugins.trac.wordpress.org/browser/store-locator/trunk/sl-functions.php#L1919
CVE ID: CVE-2024-12572 State: PUBLISHED Published: 2024-12-13T03:24:34.553Z Last Updated: 2024-12-16T20:08:40.698Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: stathisg Products: Hello In All Languages Problem Types: CWE-352 Description: The Hello In All Languages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a li
ipts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/85501fc0-5d51-492b-b208-4b84f371ee77?source=cve - https://plugins.trac.wordpress.org/browser/hello-in-all-languages/trunk/hello-in-all-languages.php#L398
CVE ID: CVE-2024-12573 State: REJECTED Published: N/A Last Updated: 2025-08-15T14:26:52.372Z Description: No description available.
CVE ID: CVE-2024-12574 State: PUBLISHED Published: 2024-12-13T04:23:26.120Z Last Updated: 2024-12-16T20:08:16.577Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: amrendesign Products: SVG Shortcode Problem Types: CWE-79 Description: The SVG Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3b378256-2d9b-4aad-abfe-fecfc76f0bb4?source=cve - https://wordpress.org/plugins/svg-shortcode/#developers
CVE ID: CVE-2024-12575 State: PUBLISHED Published: 2025-08-16T02:24:33.478Z Last Updated: 2025-08-18T13:59:35.350Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ays-pro Products: Poll Maker – Versus Polls, Anonymous Polls, Image Polls Problem Types: CWE-200 Description: The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 5.8.9 via the 'ays_finish_poll' AJAX action. This makes it possible for unauthenticated attackers to retrieve admin email information which is exposed in the poll response. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
admin email information which is exposed in the poll response. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3674cfb8-6372-4309-a9de-e6ef7c0b3836?source=cve - https://plugins.trac.wordpress.org/changeset/3320686/poll-maker/tags/5.9.0/public/class-poll-maker-ays-public.php?old=3317469&old_path=poll-maker%2Ftags%2F5.8.9%2Fpublic%2Fclass-poll-maker-ays-public.php
CVE ID: CVE-2024-12576 State: PUBLISHED Published: 2025-03-07T07:36:21.228Z Last Updated: 2025-03-07T19:34:51.249Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-822 Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger a crash of the FW running on the GPU freezing graphics output. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2024-12577 State: PUBLISHED Published: 2025-02-22T14:58:33.780Z Last Updated: 2025-03-18T19:42:29.421Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-823 Description: Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2024-12578 State: PUBLISHED Published: 2024-12-14T04:23:39.780Z Last Updated: 2025-01-17T16:27:12.789Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: tickera Products: Tickera – WordPress Event Ticketing Problem Types: CWE-200 Description: The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.5.4.8 via the 'tickera_tickets_info' endpoint. This makes it possible for unauthenticated attackers to extract sensitive data from bookings like full names, email addresses, check-in/out timestamps and more. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
s, email addresses, check-in/out timestamps and more. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2db29c12-bf8a-4d5a-b12a-6c74b816d5f0?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3201476%40tickera-event-ticketing-system&new=3201476%40tickera-event-ticketing-system&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12579 State: PUBLISHED Published: 2024-12-13T04:23:26.470Z Last Updated: 2024-12-16T16:42:12.138Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: teckel Products: Minify HTML Problem Types: CWE-400 Description: The Minify HTML plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 2.1.10. This is due to processing user-supplied input as a regular expression. This makes it possible for unauthenticated attackers to create comments that can cause catastrophic backtracking and break pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/t
cktracking and break pages. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/80334e81-c33d-464c-9409-f49c34681890?source=cve - https://plugins.trac.wordpress.org/changeset/3203890/minify-html-markup
CVE ID: CVE-2024-12580 State: PUBLISHED Published: 2025-03-20T10:09:16.971Z Last Updated: 2025-03-20T18:56:54.526Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: danny-avila Products: danny-avila/librechat Problem Types: CWE-117 Description: A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, and file_id in the /code/download/:sessionId/:fileId and /download/:userId/:file_id APIs are not validated or filtered, leading to potential log injection attacks. This can cause distortion of monitoring and investigation information, evade detection from security systems, and create
This can cause distortion of monitoring and investigation information, evade detection from security systems, and create difficulties in maintenance and operation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/6e477667-dcd4-42c2-b342-a6ce09ffdeeb - https://github.com/danny-avila/librechat/commit/95d6bd2c2db4a09b308be2b96e3d5fd522c7b72a
CVE ID: CVE-2024-12581 State: PUBLISHED Published: 2024-12-13T05:24:48.943Z Last Updated: 2024-12-16T20:07:55.248Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: britner Products: Gutenberg Blocks with AI by Kadence WP – Page Builder Features Problem Types: CWE-79 Description: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.53 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web script
it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/406f3eaf-44a7-4e32-a620-8799eb74742a?source=cve - https://wpscan.com/vulnerability/df688dcc-9617-4f58-a310-891bfaea3695/ - https://research.cleantalk.org/cve-2024-10637/
CVE ID: CVE-2024-12582 State: PUBLISHED Published: 2024-12-24T03:31:24.896Z Last Updated: 2025-11-20T07:12:30.483Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H) Vendors: Red Hat Products: Service Interconnect 1 for RHEL 9 Problem Types: CWE-305 Description: A flaw was found in the skupper console, a read-only interface that renders cluster network, traffic details, and metrics for a network application that a user sets up across a hybrid multi-cloud environment. When the default authentication method is used, a random password is generated for the "admin" user and is persisted in either a Kubernetes secret or a podman volume in a plaintext file. This authentication m
admin" user and is persisted in either a Kubernetes secret or a podman volume in a plaintext file. This authentication method can be manipulated by an attacker, leading to the reading of any user-readable file in the container filesystem, directly impacting data confidentiality. Additionally, the attacker may induce skupper to read extremely large files into memory, resulting in resource exhaustion and a denial of service attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:1413 - https://access.redhat.com/security/cve/CVE-2024-12582 - https://bugzilla.redhat.com/show_bug.cgi?id=2333540
CVE ID: CVE-2024-12583 State: PUBLISHED Published: 2025-01-04T08:22:51.633Z Last Updated: 2025-01-06T16:34:41.066Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: alexacrm Products: Dynamics 365 Integration Problem Types: CWE-1336 Description: The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. Additional Analy
le for authenticated attackers, with Contributor-level access and above, to execute code on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7f3dac5a-9ff8-4e8c-8c73-422123e121d8?source=cve - https://plugins.trac.wordpress.org/browser/integration-dynamics/trunk/src/Shortcode/Twig.php#L53 - https://plugins.trac.wordpress.org/changeset/3210927/
CVE ID: CVE-2024-12584 State: PUBLISHED Published: 2025-01-08T06:41:38.596Z Last Updated: 2025-01-08T14:36:36.202Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: xpro Products: 140+ Widgets | Xpro Addons For Elementor – FREE Problem Types: CWE-200 Description: The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6.2 via the 'duplicate' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract potentially sensitive data from draft, scheduled (future), private, and password protected posts. Addit
bove, to extract potentially sensitive data from draft, scheduled (future), private, and password protected posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fa085bc0-af0b-4797-a10f-4d41b4988c02?source=cve - https://plugins.trac.wordpress.org/changeset/3212531/xpro-elementor-addons
CVE ID: CVE-2024-12585 State: PUBLISHED Published: 2025-01-08T06:00:14.363Z Last Updated: 2025-01-08T15:38:18.357Z Vendors: Unknown Products: Property Hive Problem Types: CWE-287 Improper Authentication, CWE-79 Cross-Site Scripting (XSS) Description: The Property Hive WordPress plugin before 2.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/afecf367-d298-4f4c-8f47-4e19b3937d3e/
CVE ID: CVE-2024-12586 State: PUBLISHED Published: 2025-02-13T06:00:05.017Z Last Updated: 2025-03-25T13:20:56.601Z Vendors: Unknown Products: Chalet-Montagne.com Tools Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Chalet-Montagne.com Tools WordPress plugin through 2.7.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2ce05a44-762b-4aaf-b88a-92c830fd8ec4/
CVE ID: CVE-2024-12587 State: PUBLISHED Published: 2025-01-11T06:00:02.900Z Last Updated: 2025-01-13T19:28:24.270Z Vendors: Unknown Products: Contact Form Master Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Contact Form Master WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7cb040f5-d154-48ea-a54e-80451054bad8/
CVE ID: CVE-2024-12588 State: PUBLISHED Published: 2024-12-21T08:23:59.519Z Last Updated: 2024-12-28T00:49:43.478Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: averta Products: Shortcodes and extra features for Phlox theme Problem Types: CWE-79 Description: The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Staff widget in all versions up to, and including, 2.16.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts i
akes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/766cb6d0-1839-4d8c-819c-4e5dab408f6c?source=cve - https://plugins.trac.wordpress.org/browser/auxin-elements/trunk/includes/elements/staff.php
CVE ID: CVE-2024-12589 State: PUBLISHED Published: 2025-03-12T07:00:22.816Z Last Updated: 2025-03-12T13:11:36.581Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: djeet Products: Finale Lite – Sales Countdown Timer & Discount for WooCommerce Problem Types: CWE-79 Description: The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the countdown timer in all versions up to, and including, 2.19.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web
g. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ae0a001b-0792-4a32-8f49-5d4b1550f4be?source=cve - https://plugins.trac.wordpress.org/changeset/3247611/finale-woocommerce-sales-countdown-timer-discount
CVE ID: CVE-2024-12590 State: PUBLISHED Published: 2025-01-07T03:21:52.546Z Last Updated: 2025-01-07T16:31:31.480Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: india-web-developer Products: WP Youtube Gallery Problem Types: CWE-79 Description: The WP Youtube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional
above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0b9e6f21-4c26-4ff8-9d0f-c66cd537fdcc?source=cve - https://plugins.trac.wordpress.org/browser/wp-youtube-gallery/trunk/wpyg-class.php#L87 - https://wordpress.org/plugins/wp-youtube-gallery/#developers
CVE ID: CVE-2024-12591 State: PUBLISHED Published: 2024-12-21T09:23:56.620Z Last Updated: 2024-12-28T00:48:46.018Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wbolt Products: MagicPost – WordPress文章管理功能增强插件 Problem Types: CWE-79 Description: The MagicPost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wb_share_social shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a us
ckers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f81355fa-5b12-4b03-bd3d-f9e2cb734390?source=cve - https://wordpress.org/plugins/magicpost/#developers - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3209000%40magicpost&new=3209000%40magicpost&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12592 State: PUBLISHED Published: 2025-01-07T03:21:57.562Z Last Updated: 2025-01-07T16:27:57.910Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sellsy Products: Sellsy Problem Types: CWE-79 Description: The Sellsy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'testSellsy' shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9fd3610c-cce4-420c-85c1-0b71679df650?source=cve - https://wordpress.org/plugins/sellsy/