Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-52122 State: PUBLISHED Published: 2024-01-05T09:11:40.845Z Last Updated: 2025-06-09T17:15:40.774Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: PressTigers Products: Simple Job Board Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board.This issue affects Simple Job Board: from n/a through 2.10.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/simple-job-board/wordpress-simple-job-board-plugin-2-10-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-52123 State: PUBLISHED Published: 2024-01-05T09:05:12.905Z Last Updated: 2025-05-23T16:03:38.041Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WPChill Products: Strong Testimonials Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WPChill Strong Testimonials.This issue affects Strong Testimonials: from n/a through 3.1.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/strong-testimonials/wordpress-strong-testimonials-plugin-3-1-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-52124 State: PUBLISHED Published: 2024-01-05T11:17:08.785Z Last Updated: 2025-06-17T20:29:13.059Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: ShapedPlugin LLC Products: WP Tabs – Responsive Tabs Plugin for WordPress Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC WP Tabs – Responsive Tabs Plugin for WordPress allows Stored XSS.This issue affects WP Tabs – Responsive Tabs Plugin for WordPress: from n/a through 2.2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/databa
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-expand-tabs-free/wordpress-wp-tabs-responsive-tabs-plugin-for-wordpress-plugin-2-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-52125 State: PUBLISHED Published: 2024-01-05T11:13:47.565Z Last Updated: 2025-05-23T16:03:00.689Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: webvitaly Products: iframe Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly iframe allows Stored XSS.This issue affects iframe: from n/a through 4.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/iframe/wordpress-iframe-plugin-4-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-52126 State: PUBLISHED Published: 2024-01-05T11:11:02.792Z Last Updated: 2025-05-23T16:03:09.885Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Suman Bhattarai Products: Send Users Email Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Suman Bhattarai Send Users Email.This issue affects Send Users Email: from n/a through 1.4.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/send-users-email/wordpress-send-users-email-plugin-1-4-3-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2023-52127 State: PUBLISHED Published: 2024-01-05T08:52:47.172Z Last Updated: 2024-09-04T19:54:52.383Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WPClever Products: WPC Product Bundles for WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Product Bundles for WooCommerce.This issue affects WPC Product Bundles for WooCommerce: from n/a through 7.3.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woo-product-bundle/wordpress-wpc-product-bundles-for-woocommerce-plugin-7-3-1-cross-site-request-for
abase/vulnerability/woo-product-bundle/wordpress-wpc-product-bundles-for-woocommerce-plugin-7-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-52128 State: PUBLISHED Published: 2024-01-05T08:49:17.332Z Last Updated: 2025-05-23T16:03:43.848Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WhiteWP Products: White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WhiteWP White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard.This issue affects White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard: from n/a through 2.9.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com
2.9.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/white-label/wordpress-white-label-plugin-2-9-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-52129 State: PUBLISHED Published: 2024-01-05T08:42:41.239Z Last Updated: 2025-06-16T18:12:14.565Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Michael Winkler Products: teachPress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/teachpress/wordpress-teachpress-plugin-9-0-4-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-52130 State: PUBLISHED Published: 2024-01-05T08:38:41.278Z Last Updated: 2025-04-17T18:15:45.552Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: wp.insider, wpaffiliatemgr Products: Affiliates Manager Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects Affiliates Manager: from n/a through 2.9.31. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/affiliates-manager/wordpress-affiliates-manager-plugin-2-9-31-cross-site-request-forgery-csrf-vulnerability?_s_id=
ility/affiliates-manager/wordpress-affiliates-manager-plugin-2-9-31-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-52131 State: PUBLISHED Published: 2023-12-31T17:43:59.167Z Last Updated: 2024-11-20T16:51:22.151Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: WP Zinc Products: Page Generator Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Zinc Page Generator.This issue affects Page Generator: from n/a through 1.7.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/page-generator/wordpress-page-generator-plugin-1-7-1-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-52132 State: PUBLISHED Published: 2023-12-31T17:35:42.423Z Last Updated: 2024-08-02T22:48:12.474Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Jewel Theme Products: WP Adminify Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jewel Theme WP Adminify.This issue affects WP Adminify: from n/a through 3.1.6. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/adminify/wordpress-wp-adminify-plugin-3-1-6-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-52133 State: PUBLISHED Published: 2023-12-31T17:33:00.945Z Last Updated: 2024-08-02T22:48:12.541Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: WhileTrue Products: Most And Least Read Posts Widget Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WhileTrue Most And Least Read Posts Widget.This issue affects Most And Least Read Posts Widget: from n/a through 2.5.16. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/most-and-least-read-posts-widget/wordpress-most-and-least-read-posts-widget-plugin-
atchstack.com/database/vulnerability/most-and-least-read-posts-widget/wordpress-most-and-least-read-posts-widget-plugin-2-5-16-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-52134 State: PUBLISHED Published: 2023-12-31T16:53:51.476Z Last Updated: 2024-08-02T22:48:12.508Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Eyal Fitoussi Products: GEO my WordPress Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eyal Fitoussi GEO my WordPress.This issue affects GEO my WordPress: from n/a through 4.0.2. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/geo-my-wp/wordpress-geo-my-wordpress-plugin-4-0-2-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-52135 State: PUBLISHED Published: 2023-12-29T10:09:42.451Z Last Updated: 2024-08-02T22:48:12.530Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: WS Form Products: WS Form LITE – Drag & Drop Contact Form Builder for WordPress Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WS Form WS Form LITE – Drag & Drop Contact Form Builder for WordPress.This issue affects WS Form LITE – Drag & Drop Contact Form Builder for WordPress: from n/a through 1.9.170. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability
1.9.170. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ws-form/wordpress-ws-form-lite-drag-drop-contact-form-builder-for-wordpress-plugin-1-9-170-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-52136 State: PUBLISHED Published: 2024-01-05T08:33:28.346Z Last Updated: 2025-06-17T20:29:13.214Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Smash Balloon Products: Custom Twitter Feeds – A Tweets Widget or X Feed Widget Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feeds – A Tweets Widget or X Feed Widget: from n/a through 2.1.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/custom-twitter-feeds/wordpress
ner: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/custom-twitter-feeds/wordpress-custom-twitter-feeds-tweets-widget-plugin-2-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-52137 State: PUBLISHED Published: 2023-12-29T17:08:49.356Z Last Updated: 2024-08-02T22:48:12.570Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L) Vendors: tj-actions Products: verify-changed-files Problem Types: CWE-20 Description: The [`tj-actions/verify-changed-files`](https://github.com/tj-actions/verify-changed-files) action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. The [`verify-changed-files`](https://github.com/tj-actions/verify-changed-files) workflow returns the list of files changed within a workflow execution. This could potentially allow filenames that cont
workflow returns the list of files changed within a workflow execution. This could potentially allow filenames that contain special characters such as `;` which can be used by an attacker to take over the [GitHub Runner](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners) if the output value is used in a raw fashion (thus being directly replaced before execution) inside a `run` block. By running custom commands, an attacker may be able to steal secrets such as `GITHUB_TOKEN` if triggered on other events than `pull_request`. This has been patched in versions [17](https://github.com/tj-actions/verify-changed-files/releases/tag/v17) and [17.0.0](https://g
een patched in versions [17](https://github.com/tj-actions/verify-changed-files/releases/tag/v17) and [17.0.0](https://github.com/tj-actions/verify-changed-files/releases/tag/v17.0.0) by enabling `safe_output` by default and returning filename paths escaping special characters for bash environments. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tj-actions/verify-changed-files/security/advisories/GHSA-ghm2-rq8q-wrhc - https://github.com/tj-actions/verify-changed-files/commit/498d3f316f501aa72485060e8c96fde7b2014f12 - https://github.com/tj-actions/verify-changed-files/commit/592e305da041c09a009afa4a43c97d889bed65c3
CVE ID: CVE-2023-52138 State: PUBLISHED Published: 2024-02-05T14:51:09.967Z Last Updated: 2025-06-17T14:37:12.964Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N) Vendors: mate-desktop Products: engrampa Problem Types: CWE-25 Description: Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal vulnerability that can be leveraged to achieve full Remote Command Execution (RCE) on the target. While handling CPIO archives, the Engrampa Archive manager follows symlink, cpio by default will follow stored symlinks while extracting and the Archiver will not check the symlink location, which leads to arbitrary file writes
ed symlinks while extracting and the Archiver will not check the symlink location, which leads to arbitrary file writes to unintended locations. When the victim extracts the archive, the attacker can craft a malicious cpio or ISO archive to achieve RCE on the target system. This vulnerability was fixed in commit 63d5dfa. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mate-desktop/engrampa/security/advisories/GHSA-c98h-v39w-3r7v - https://github.com/mate-desktop/engrampa/commit/63d5dfa9005c6b16d0f0ccd888cc859fca78f970 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4IOJ3QWXTZGCXFEHP7
f970 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4IOJ3QWXTZGCXFEHP72ELY22PZ4AX2CB/ - https://lists.debian.org/debian-lts-announce/2024/02/msg00011.html
CVE ID: CVE-2023-52139 State: PUBLISHED Published: 2023-12-29T17:21:01.898Z Last Updated: 2024-08-02T22:48:12.569Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: misskey-dev Products: misskey Problem Types: CWE-285 Description: Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as [kind](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L811) or [secure](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/
L811) or [secure](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L805) without the user's permission and perform operations such as reading or adding non-public content. As a result, if the user who authenticated the application is an administrator, confidential information such as object storage secret keys and SMTP server passwords will be leaked, and general users can also create invitation codes without permission and leak non-public user information. This is patched in version [2023.12.1](https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64). Additional Analyst Notes: - C
](https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/misskey-dev/misskey/security/advisories/GHSA-7pxq-6xx9-xpgm - https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64
CVE ID: CVE-2023-52140 State: REJECTED Published: N/A Last Updated: 2024-01-03T21:22:04.168Z Description: No description available.
CVE ID: CVE-2023-52141 State: REJECTED Published: N/A Last Updated: 2024-01-03T21:22:48.111Z Description: No description available.
CVE ID: CVE-2023-52142 State: PUBLISHED Published: 2024-01-08T20:56:10.776Z Last Updated: 2025-06-17T20:39:13.214Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Cool Plugins Products: Events Shortcodes For The Events Calendar Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cool Plugins Events Shortcodes For The Events Calendar.This issue affects Events Shortcodes For The Events Calendar: from n/a through 2.3.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/template-events-calendar/w
ntainer: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/template-events-calendar/wordpress-events-shortcodes-for-the-events-calendar-plugin-2-3-1-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-52143 State: PUBLISHED Published: 2024-01-05T11:08:23.418Z Last Updated: 2024-08-26T20:16:12.349Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Naa986 Products: WP Stripe Checkout Problem Types: CWE-532 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Naa986 WP Stripe Checkout.This issue affects WP Stripe Checkout: from n/a through 1.2.2.37. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-stripe-checkout/wordpress-wp-stripe-checkout-plugin-1-2-2-37-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE ID: CVE-2023-52144 State: PUBLISHED Published: 2024-04-15T07:11:33.429Z Last Updated: 2024-08-02T22:48:12.542Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: RexTheme Products: Product Feed Manager Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RexTheme Product Feed Manager.This issue affects Product Feed Manager: from n/a through 7.3.15. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/best-woocommerce-feed/wordpress-product-feed-manager-plugin-7-3-15-directory-traversal-vulnerability
abase/vulnerability/best-woocommerce-feed/wordpress-product-feed-manager-plugin-7-3-15-directory-traversal-vulnerability?_s_id=cve
CVE ID: CVE-2023-52145 State: PUBLISHED Published: 2024-01-05T08:17:41.771Z Last Updated: 2024-08-26T18:42:07.484Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Marios Alexandrou Products: Republish Old Posts Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Republish Old Posts.This issue affects Republish Old Posts: from n/a through 1.21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/republish-old-posts/wordpress-republish-old-posts-plugin-1-21-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-52146 State: PUBLISHED Published: 2024-01-05T11:05:45.212Z Last Updated: 2025-06-17T20:29:13.342Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Aaron J Products: 404 Solution Problem Types: CWE-532 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aaron J 404 Solution.This issue affects 404 Solution: from n/a through 2.33.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/404-solution/wordpress-404-solution-plugin-2-33-0-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE ID: CVE-2023-52147 State: PUBLISHED Published: 2024-06-04T12:38:45.579Z Last Updated: 2024-08-14T16:27:57.531Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: All In One WP Security & Firewall Team Products: All In One WP Security & Firewall Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects All In One WP Security & Firewall: from n/a through 5.2.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
from n/a through 5.2.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/all-in-one-wp-security-and-firewall/wordpress-all-in-one-security-aios-plugin-5-2-4-secret-login-page-location-disclosure-on-multisites-vulnerability?_s_id=cve
CVE ID: CVE-2023-52148 State: PUBLISHED Published: 2024-01-05T11:02:10.635Z Last Updated: 2024-11-14T18:17:24.926Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: wp.insider, wpaffiliatemgr Products: Affiliates Manager Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects Affiliates Manager: from n/a through 2.9.30. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/affiliates-manager/wordpress-affiliates-manager-plugin-2-9-30-sensitive-data-exposure-via
ack.com/database/vulnerability/affiliates-manager/wordpress-affiliates-manager-plugin-2-9-30-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE ID: CVE-2023-52149 State: PUBLISHED Published: 2024-01-05T08:10:08.508Z Last Updated: 2025-06-17T20:29:13.508Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Wow-Company Products: Floating Button Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Floating Button.This issue affects Floating Button: from n/a through 6.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/floating-button/wordpress-floating-button-plugin-6-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-52150 State: PUBLISHED Published: 2024-01-05T08:07:22.836Z Last Updated: 2025-06-17T20:29:13.677Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ovation S.r.l. Products: Dynamic Content for Elementor Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Ovation S.R.L. Dynamic Content for Elementor.This issue affects Dynamic Content for Elementor: from n/a before 2.12.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/dynamic-content-for-elementor/wordpress-dynamic-content-for-elementor-plugin-2-12-5-cross-site-request-forge