Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-13704 State: PUBLISHED Published: 2025-02-18T07:28:12.710Z Last Updated: 2025-02-18T15:47:54.786Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: themepoints Products: Super Testimonials Problem Types: CWE-80 Description: The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'st_user_title' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichme
ts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/20720912-6bfd-4df1-97c7-7025c16d7a0f?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3240039%40super-testimonial&new=3240039%40super-testimonial&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13705 State: PUBLISHED Published: 2025-01-30T13:41:57.656Z Last Updated: 2025-01-30T14:52:39.113Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: malcolm-oph Products: StageShow Problem Types: CWE-79 Description: The StageShow plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 9.8.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA A
y can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4c5a6436-1a08-4b3d-ab85-e5f75f216ab8?source=cve - https://plugins.trac.wordpress.org/browser/stageshow/trunk/admin/stageshow_manage_seating.php#L502
CVE ID: CVE-2024-13706 State: PUBLISHED Published: 2025-01-30T11:10:20.340Z Last Updated: 2025-02-18T19:04:59.996Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: filipmedia Products: WP Image Uploader Problem Types: CWE-79 Description: The WP Image Uploader plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'file' parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional
ages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fea1546c-1d8f-4478-81b7-20a9096e0217?source=cve - https://plugins.trac.wordpress.org/browser/wp-image-uploader/trunk/index.php#L85
CVE ID: CVE-2024-13707 State: PUBLISHED Published: 2025-01-30T13:41:59.660Z Last Updated: 2025-01-30T14:41:22.046Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: filipmedia Products: WP Image Uploader Problem Types: CWE-352 Description: The WP Image Uploader plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the gky_image_uploader_main_function() function. This makes it possible for unauthenticated attackers to delete arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a l
files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/646a9885-8e0e-42a9-a113-0688c9f6dc93?source=cve - https://plugins.trac.wordpress.org/browser/wp-image-uploader/trunk/index.php#L85
CVE ID: CVE-2024-13708 State: PUBLISHED Published: 2025-04-04T05:22:46.789Z Last Updated: 2025-04-04T13:07:23.784Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: pluggabl Products: Booster for WooCommerce Problem Types: CWE-434 Description: The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in versions 4.0.1 to 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f58b3971-e1e4-4337-82a3-99c9079c6696?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/trunk/includes/class-wcj-checkout-files-upload.php
CVE ID: CVE-2024-13709 State: PUBLISHED Published: 2025-01-25T03:21:18.130Z Last Updated: 2025-01-27T15:34:32.967Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: linearoy Products: Linear Problem Types: CWE-352 Description: The Linear plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.1. This is due to missing or incorrect nonce validation on the 'linear-debug'. This makes it possible for unauthenticated attackers to reset the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnric
a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/83af4ee4-2763-4706-8cb2-fa102a72be68?source=cve - https://plugins.trac.wordpress.org/browser/linear/trunk/includes/class-linear-settings.php#L1874
CVE ID: CVE-2024-13710 State: PUBLISHED Published: 2025-03-25T08:22:15.157Z Last Updated: 2025-03-31T16:30:54.102Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: estatebud Products: Estatebud – Properties & Listings Problem Types: CWE-352 Description: The Estatebud – Properties & Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.5.0. This is due to missing or incorrect nonce validation on the 'estatebud_settings' page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action su
date the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c43f4c91-329d-46b9-b2c8-f35e5baa38d7?source=cve - https://wordpress.org/plugins/estatebud-properties-listings/
CVE ID: CVE-2024-13711 State: PUBLISHED Published: 2025-02-19T07:32:08.537Z Last Updated: 2025-02-19T14:39:00.630Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: binnyva Products: Pollin Problem Types: CWE-79 Description: The Pollin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'question' parameter in all versions up to, and including, 1.01.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CI
they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4beb01c1-2144-4b1f-9d32-cf2725a8d4ae?source=cve - https://wordpress.org/plugins/pollin/
CVE ID: CVE-2024-13712 State: PUBLISHED Published: 2025-02-19T07:32:06.596Z Last Updated: 2025-02-19T21:20:26.800Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: binnyva Products: Pollin Problem Types: CWE-89 Description: The Pollin plugin for WordPress is vulnerable to SQL Injection via the 'question' parameter in all versions up to, and including, 1.01.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
dditional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2d4a463b-e447-4fd0-a8df-284ecd6cd975?source=cve - https://wordpress.org/plugins/pollin/
CVE ID: CVE-2024-13713 State: PUBLISHED Published: 2025-02-21T11:09:34.028Z Last Updated: 2025-02-21T13:35:43.335Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: wpexpertsio Products: WPExperts Square For GiveWP Problem Types: CWE-89 Description: The WPExperts Square For GiveWP plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already exist
for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7863c5fb-1eda-41a3-b8ec-054784ab2438?source=cve - https://plugins.trac.wordpress.org/browser/wpexperts-square-for-give/trunk/includes/class-give-square.php#L189 - https://plugins.trac.wordpress.org/changeset/3242658/wpexperts-square-for-give/trunk/includes/class-give-square.php
CVE ID: CVE-2024-13714 State: PUBLISHED Published: 2025-02-12T05:28:40.090Z Last Updated: 2025-02-12T16:08:49.346Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: allimages Products: All-Images.ai – IA Image Bank and Custom Image creation Problem Types: CWE-434 Description: The All-Images.ai – IA Image Bank and Custom Image creation plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_get_image_by_url' function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which m
cated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/422c634c-5119-40ef-adf7-681c3d8c09a2?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3231889%40all-images-ai&new=3231889%40all-images-ai&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13715 State: PUBLISHED Published: 2025-01-30T13:42:05.833Z Last Updated: 2025-01-30T14:38:59.908Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: ilenejohnson Products: zStore Manager Basic Problem Types: CWE-862 Description: The zStore Manager Basic plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the zstore_clear_cache() function in all versions up to, and including, 3.311. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear the plugin's cache. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat
ar the plugin's cache. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/974ffc87-369a-431e-b601-8c6679d963c3?source=cve - https://plugins.trac.wordpress.org/browser/zstore-manager-basic/trunk/zstore-manager.php#L441
CVE ID: CVE-2024-13716 State: PUBLISHED Published: 2025-02-28T08:23:15.098Z Last Updated: 2025-02-28T13:45:45.284Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: tarborali Products: Forex Calculators Problem Types: CWE-862 Description: The Forex Calculators plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_settings_callback() function in all versions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com
update the plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/49ce8ca1-c1ae-4dda-909e-70c3b6d2b561?source=cve - https://plugins.trac.wordpress.org/browser/fx-calculators/tags/1.3.5/forex-calculators.php#L101
CVE ID: CVE-2024-13717 State: PUBLISHED Published: 2025-01-31T05:22:34.212Z Last Updated: 2025-01-31T19:36:16.465Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: vcita Products: Contact Form and Calls To Action by vcita Problem Types: CWE-862 Description: The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_ajax_toggle_ae and vcita_ajax_toggle_contact functions in all versions up to, and including, 2.7.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to enabled and disable widgets. Additional Analyst N
or authenticated attackers, with subscriber-level access and above, to enabled and disable widgets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/93800bd9-5d11-4d5b-99b2-4c5c78510af7?source=cve - https://plugins.trac.wordpress.org/browser/lead-capturing-call-to-actions-by-vcita/trunk/vcita-ajax-function.php#L5
CVE ID: CVE-2024-13718 State: PUBLISHED Published: 2025-02-18T08:21:42.508Z Last Updated: 2025-02-18T14:36:33.225Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: wpdesk Products: Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later Problem Types: CWE-352 Description: The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.26. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to modify/update/create other user's wishlists via a forged req
ns. This makes it possible for unauthenticated attackers to modify/update/create other user's wishlists via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1f2b4030-92b1-4795-b72e-761632dd523d?source=cve - https://plugins.trac.wordpress.org/changeset?old_path=flexible-wishlist/tags/1.2.26&new_path=/flexible-wishlist/tags/1.2.27&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13719 State: PUBLISHED Published: 2025-02-19T07:32:07.577Z Last Updated: 2025-02-19T21:33:25.744Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: peprodev Products: PeproDev Ultimate Invoice Problem Types: CWE-862 Description: The PeproDev Ultimate Invoice plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8 via the invoicing viewer due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view invoices for completed orders which can contain PII of users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.
ted orders which can contain PII of users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/46186f8d-e50c-476a-9480-b6121412474a?source=cve - https://wordpress.org/plugins/pepro-ultimate-invoice/
CVE ID: CVE-2024-13720 State: PUBLISHED Published: 2025-01-30T13:41:57.290Z Last Updated: 2025-01-30T14:52:53.163Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: filipmedia Products: WP Image Uploader Problem Types: CWE-352 Description: The WP Image Uploader plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the gky_image_uploader_main_function() function in all versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional A
ver, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4af41f69-1335-4199-bf29-c9699de50a16?source=cve - https://plugins.trac.wordpress.org/browser/wp-image-uploader/trunk/index.php#L85
CVE ID: CVE-2024-13721 State: PUBLISHED Published: 2025-01-25T05:30:07.128Z Last Updated: 2025-01-27T15:34:16.208Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: plethoraplugins Products: Plethora Plugins Tabs + Accordions Problem Types: CWE-85 Description: The Plethora Plugins Tabs + Accordions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the anchor parameter in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acces
ith Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9755e5d4-dbf6-4778-84d6-cc967e8afb48?source=cve - https://plugins.trac.wordpress.org/browser/plethora-tabs-accordions/trunk/plethoraplugins-tabs.php#L423
CVE ID: CVE-2024-13722 State: PUBLISHED Published: 2025-02-04T22:04:00.315Z Last Updated: 2025-11-03T19:29:15.962Z Vendors: Checkmk Products: NagVis Problem Types: CWE-79 Description: The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaScript in the context of the browser once clicked. The attack can be performed on both authenticated and unauthenticated users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://korelogic.com/Resources/Advisories/KL-001-2025-001.txt - https://www.nagvis.org/downloads/changelog/1.9.42 - https://checkmk.com/wer
m/Resources/Advisories/KL-001-2025-001.txt - https://www.nagvis.org/downloads/changelog/1.9.42 - https://checkmk.com/werks?version=2.3.0p10
CVE ID: CVE-2024-13723 State: PUBLISHED Published: 2025-02-04T22:02:19.226Z Last Updated: 2025-11-03T19:29:17.332Z Vendors: Checkmk Products: NagVis Problem Types: CWE-434 Description: The "NagVis" component within Checkmk is vulnerable to remote code execution. An authenticated attacker with administrative level privileges is able to upload a malicious PHP file and modify specific settings to execute the contents of the file as PHP. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://korelogic.com/Resources/Advisories/KL-001-2025-002.txt - https://www.nagvis.org/downloads/changelog/1.9.42 - https://checkmk.com/werks?version=2.3.0p10
CVE ID: CVE-2024-13724 State: PUBLISHED Published: 2025-03-04T08:23:42.467Z Last Updated: 2025-03-04T14:24:09.700Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpswings Products: Wallet System for WooCommerce Problem Types: CWE-285 Description: The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to increase their own wallet balance, transfer balances between arbitrary users and initiate transfer requests from other users' wallets. A
wn wallet balance, transfer balances between arbitrary users and initiate transfer requests from other users' wallets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bda326b0-9049-496a-a600-fa65151ce98f?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3244479%40wallet-system-for-woocommerce%2Ftrunk&old=3231275%40wallet-system-for-woocommerce%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13725 State: PUBLISHED Published: 2025-02-18T04:21:16.466Z Last Updated: 2025-02-18T15:02:35.921Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: infusionsoft Products: Keap Official Opt-in Forms Problem Types: CWE-22 Description: The Keap Official Opt-in Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.1 via the service parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP
e files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included. If register_argc_argv is enabled on the server and pearcmd.php is installed, this issue might lead to Remote Code Execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/692a5838-4a32-4444-b1a0-018fa25594a9?source=cve - https://wordpress.org/plugins/infusionsoft-official-opt-in-forms/ - https://plugins.trac.wordpress.org/browser/infusionsoft-official-opt-in-forms/trunk/infusionsoft.php#L2540
CVE ID: CVE-2024-13726 State: PUBLISHED Published: 2025-02-17T06:00:09.727Z Last Updated: 2025-02-19T21:42:06.052Z Vendors: Unknown Products: Themes Coder Problem Types: CWE-89 SQL Injection Description: The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ec226d22-0c09-4e7c-86ec-b64819089b60/