Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c7429367-f9f4-4859-9537-0f543e32870a?source=cve - https://plugins.trac.wordpress.org/browser/learnpress-import-export/trunk/inc/admin/views/import.php#L23 - https://plugins.trac.wordpress.org/browser/learnpress-import-export/trunk/inc/admin/providers/learnpress/class-lp-import-learnpress.php#L90 - https://plugins.trac.wordpress.org/changeset/3186901/lear
dmin/providers/learnpress/class-lp-import-learnpress.php#L90 - https://plugins.trac.wordpress.org/changeset/3186901/learnpress-import-export/trunk/inc/admin/views/import.php - https://plugins.trac.wordpress.org/changeset/3186901/learnpress-import-export/trunk/inc/admin/providers/learnpress/class-lp-import-learnpress.php
CVE ID: CVE-2024-9610 State: PUBLISHED Published: 2024-10-11T06:50:20.874Z Last Updated: 2024-10-11T14:59:46.544Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: rafasashi Products: Language Switcher Problem Types: CWE-79 Description: The Language Switcher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.7.13. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Note
cute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f117fffb-2bbb-4e95-b589-909972db1e5e?source=cve - https://plugins.trac.wordpress.org/browser/language-switcher/tags/3.7.13/includes/class-language-switcher-settings.php#L464 - https://plugins.trac.wordpress.org/changeset/3165172/
CVE ID: CVE-2024-9611 State: PUBLISHED Published: 2024-10-11T06:50:15.170Z Last Updated: 2024-10-11T13:44:49.522Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ttodua Products: Increase upload file size & Maximum Execution Time limit Problem Types: CWE-79 Description: The Increase upload file size & Maximum Execution Time limit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into
uthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1c432dbe-8542-41de-966a-b2699d1685ce?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3166370%40increase-upload-file-size-maximum-execution-time-limit&new=3166370%40increase-upload-file-size-maximum-execution-time-limit - https://plugins.trac.wordpress.org/browser/increase-upload-file-size-maximum-execution-time-limit/trunk/library_default_puvox.php?rev=2589469
wordpress.org/browser/increase-upload-file-size-maximum-execution-time-limit/trunk/library_default_puvox.php?rev=2589469#L8560
CVE ID: CVE-2024-9612 State: PUBLISHED Published: 2025-03-20T10:11:08.077Z Last Updated: 2025-03-20T13:34:33.986Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: danswer-ai Products: danswer-ai/danswer Problem Types: CWE-1100 Description: In danswer-ai/danswer v0.3.94, administrators can set the visibility of pages within a workspace, including the search page. When the search page is set to be invisible, regular users cannot view the search page or access its functionalities from the front-end interface. However, the back-end does not verify the visibility status of the search page. Consequently, attackers can directly call the API to access the functionali
fy the visibility status of the search page. Consequently, attackers can directly call the API to access the functionalities provided by the search page, bypassing the visibility restriction set by the administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/c1046fa0-a719-475e-ba62-2b97873fbac4
CVE ID: CVE-2024-9613 State: PUBLISHED Published: 2024-10-26T02:31:32.274Z Last Updated: 2024-10-28T17:37:23.501Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: manidoraisamy Products: FormFacade – WordPress plugin for Google Forms Problem Types: CWE-79 Description: The FormFacade – WordPress plugin for Google Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'userId' and 'publishId' parameters in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfull
it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e4a00ad0-5761-4fb7-a4e6-cb213cf32cb2?source=cve - https://plugins.trac.wordpress.org/browser/formfacade/trunk/formfacade.php#L173
CVE ID: CVE-2024-9614 State: PUBLISHED Published: 2024-11-13T02:02:32.557Z Last Updated: 2024-11-13T14:42:31.648Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: mailmunch Products: Constant Contact Forms by MailMunch Problem Types: CWE-79 Description: The Constant Contact Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking
trary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/92abab9e-904a-4a62-a911-a57baa9aa4af?source=cve - https://plugins.trac.wordpress.org/browser/constant-contact-forms-by-mailmunch/trunk/admin/partials/constantcontact-mailmunch-integrate.php#L48 - https://plugins.trac.wordpress.org/browser/constant-contact-forms-by-mailmunch/trunk/admin/partials/constantcontact-mailmunch-integrate.php#L32 - https://plugins.trac.wordpress.org/browser/constant-contact-forms-by-mailmunch/trunk/admin/partials/con
egrate.php#L32 - https://plugins.trac.wordpress.org/browser/constant-contact-forms-by-mailmunch/trunk/admin/partials/constantcontact-mailmunch-integrate.php#L21 - https://plugins.trac.wordpress.org/browser/constant-contact-forms-by-mailmunch/trunk/admin/partials/constantcontact-mailmunch-integrate.php#L15
CVE ID: CVE-2024-9615 State: PUBLISHED Published: 2024-11-16T03:20:49.607Z Last Updated: 2024-11-16T15:10:02.660Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: engelen Products: BulkPress Problem Types: CWE-79 Description: The BulkPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 0.3.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnr
ccessfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bbce4588-fbd2-4b75-8f67-51c7d02892be?source=cve - https://plugins.trac.wordpress.org/browser/bulkpress/trunk/lib/classes/AdminMenuPage/class.Abstract.php#L221
CVE ID: CVE-2024-9616 State: PUBLISHED Published: 2024-10-11T06:50:16.684Z Last Updated: 2024-10-11T13:43:34.109Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: blockmeister Products: BlockMeister – Block Pattern Builder Problem Types: CWE-79 Description: The BlockMeister – Block Pattern Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.1.10. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as cl
t arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/584d4517-1152-42fa-9ea9-a9e9ed8996fa?source=cve - https://plugins.trac.wordpress.org/browser/blockmeister/tags/3.1.10/includes/Pattern_Builder/Admin/BlockMeister_Pattern_List_Table.php#L272 - https://plugins.trac.wordpress.org/browser/blockmeister/tags/3.1.10/includes/JSON_File_Uploader.php#L31 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3165925%40blockmeister&new=3165925%40blockmeister&sfp_email=
wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3165925%40blockmeister&new=3165925%40blockmeister&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/browser/blockmeister/tags/3.1.11/includes/JSON_File_Uploader.php?rev=3165925#L31
CVE ID: CVE-2024-9617 State: PUBLISHED Published: 2025-03-20T10:10:25.706Z Last Updated: 2025-10-15T12:50:47.220Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: danswer-ai Products: danswer-ai/danswer Problem Types: CWE-639 Description: An IDOR vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to view any files. The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/{file_id} interface to view any user's file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/8f683ff6-3a99-41c6-b763-a8f7b73bd146
CVE ID: CVE-2024-9618 State: PUBLISHED Published: 2025-03-04T08:23:41.992Z Last Updated: 2025-03-04T14:24:49.549Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: litonice13 Products: Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations Problem Types: CWE-79 Description: The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.0.7.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it
including, 2.0.7.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b8d399f3-5517-4c5d-b792-94eb8b0cc0f4?source=cve - https://wordpress.org/plugins/master-addons/#developers - https://plugins.trac.wordpress.org/browser/master-addons/trunk/assets/js/master-addons-scripts.js#L510 - https://plugins.trac.wordpress.org/browser/master-addons/trunk
er-addons/trunk/assets/js/master-addons-scripts.js#L510 - https://plugins.trac.wordpress.org/browser/master-addons/trunk/assets/js/master-addons-scripts.js#L1993 - https://plugins.trac.wordpress.org/browser/master-addons/trunk/assets/js/master-addons-scripts.js#L1030 - https://plugins.trac.wordpress.org/browser/master-addons/trunk/assets/js/master-addons-scripts.js#L535 - https://master-addons.com/changelogs/ - https://plugins.trac.wordpress.org/changeset/3243199/ - https://plugins.trac.wordpress.org/changeset/3249130/
CVE ID: CVE-2024-9619 State: PUBLISHED Published: 2024-12-20T06:59:07.849Z Last Updated: 2024-12-20T17:37:37.231Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: holithemes Products: WP SHAPES Problem Types: CWE-79 Description: The WP SHAPES plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichme
cripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8207ae15-b6ae-4b58-8877-1f87c12dbe7c?source=cve - https://wordpress.org/plugins/wp-shapes/#developers
CVE ID: CVE-2024-9620 State: PUBLISHED Published: 2024-10-08T16:25:39.944Z Last Updated: 2025-11-20T20:58:17.772Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 2 Problem Types: CWE-319 Description: A flaw was found in Event-Driven Automation (EDA) in Ansible Automation Platform (AAP), which lacks encryption of sensitive information. An attacker with network access could exploit this vulnerability by sniffing the plaintext data transmitted between the EDA and AAP. An attacker with system access could exploit this vulnerability by reading the plaintext data stored in EDA and AAP databases. Additional Anal
m access could exploit this vulnerability by reading the plaintext data stored in EDA and AAP databases. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-9620 - https://bugzilla.redhat.com/show_bug.cgi?id=2317129
CVE ID: CVE-2024-9621 State: PUBLISHED Published: 2024-10-08T16:26:09.155Z Last Updated: 2025-11-20T20:58:20.093Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: Red Hat Build of Apache Camel 4.4 for Quarkus 3.8 Problem Types: CWE-532 Description: A vulnerability was found in Quarkus CXF. Passwords and other secrets may appear in the application log in spite of the user configuring them to be hidden. This issue requires some special configuration to be vulnerable, such as SOAP logging enabled, application set client, and endpoint logging properties, and the attacker must have access to the application log. Additional Analyst Notes: - CISA A
ndpoint logging properties, and the attacker must have access to the application log. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:10035 - https://access.redhat.com/security/cve/CVE-2024-9621 - https://bugzilla.redhat.com/show_bug.cgi?id=2317130
CVE ID: CVE-2024-9622 State: PUBLISHED Published: 2024-10-08T16:26:13.413Z Last Updated: 2025-11-21T07:28:36.663Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack Problem Types: CWE-444 Description: A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling request with an ASCII control character is sent, it causes the Netty HttpObjectDecoder to transition into a
P smuggling request with an ASCII control character is sent, it causes the Netty HttpObjectDecoder to transition into a BAD_MESSAGE state. As a result, any subsequent legitimate requests on the same connection are ignored, leading to client timeouts, which may impact systems using load balancers and expose them to risk. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-9622 - https://bugzilla.redhat.com/show_bug.cgi?id=2317179 - https://github.com/orgs/resteasy/discussions/4351 - https://github.com/resteasy/resteasy
CVE ID: CVE-2024-9623 State: PUBLISHED Published: 2024-10-10T09:30:38.315Z Last Updated: 2024-10-10T12:52:37.951Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-863 Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/459995
CVE ID: CVE-2024-9624 State: PUBLISHED Published: 2024-12-17T05:23:40.625Z Last Updated: 2024-12-17T14:36:25.022Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N) Vendors: Soflyy Products: WP All Import Pro Problem Types: CWE-918 Description: The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protection on the pmxi_curl_download function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from interna
to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On cloud platforms, it might allow attackers to read the Instance metadata. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eabde2e7-5cd4-4c3e-959a-69e04f6350d3?source=cve - https://www.wpallimport.com
CVE ID: CVE-2024-9625 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:14.564Z Description: No description available.
CVE ID: CVE-2024-9626 State: PUBLISHED Published: 2024-10-26T01:58:36.028Z Last Updated: 2024-10-28T19:14:11.620Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: zemanta Products: Editorial Assistant by Sovrn Problem Types: CWE-862 Description: The Editorial Assistant by Sovrn plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_zemanta_set_featured_image' function in versions up to, and including, 1.3.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload attachment files (such as jpg, png, txt, zip), and set the post featured image. Additiona
el access and above, to upload attachment files (such as jpg, png, txt, zip), and set the post featured image. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8775662f-d007-4edf-826e-f755d7b11c25?source=cve - https://plugins.trac.wordpress.org/browser/zemanta/tags/1.3.3/zemanta.php#L713
CVE ID: CVE-2024-9627 State: PUBLISHED Published: 2024-10-22T06:50:30.492Z Last Updated: 2024-10-22T14:22:38.117Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: gsuvorov Products: TeploBot – Telegram Bot for WP Problem Types: CWE-200 Description: The TeploBot - Telegram Bot for WP plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'service_process' function in all versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to view the Telegram Bot Token, which is a secret token to control the bot. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
en, which is a secret token to control the bot. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/091dadcb-71ac-4321-b3aa-72b5fbbd9163?source=cve - https://plugins.trac.wordpress.org/browser/green-wp-telegram-bot-by-teplitsa/trunk/inc/core.php?rev=1754863#L266
CVE ID: CVE-2024-9628 State: PUBLISHED Published: 2024-10-25T07:38:00.869Z Last Updated: 2024-10-25T15:21:02.252Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: wpsolution Products: WPS Telegram Chat Problem Types: CWE-862 Description: The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Wps_Telegram_Chat_Admin::checkСonnection' function in versions up to, and including, 4.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to have full access to the Telegram Bot API endpoint and communicate with it. Additional Ana
ber-level access and above, to have full access to the Telegram Bot API endpoint and communicate with it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c7f7e545-5e14-421e-90b4-bc54b23d0fe6?source=cve - https://plugins.trac.wordpress.org/browser/wps-telegram-chat/tags/4.5.4/admin/class-wps-telegram-chat-admin.php#L176
CVE ID: CVE-2024-9629 State: PUBLISHED Published: 2024-10-28T17:31:55.257Z Last Updated: 2024-10-28T19:59:02.267Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: hokku Products: Contact Form 7 + Telegram Problem Types: CWE-862 Description: The Contact Form 7 + Telegram plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'wpcf7_Telegram::ajax' function in versions up to, and including, 0.8.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to approve, pause and refuse subscriptions. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
access and above, to approve, pause and refuse subscriptions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f330fa5a-b471-45ee-a2a6-3ae8f3941bfe?source=cve - https://plugins.trac.wordpress.org/browser/cf7-telegram/tags/0.8.4/classes/wpcf7telegram.php#L537 - https://plugins.trac.wordpress.org/changeset/3176353/cf7-telegram#file21
CVE ID: CVE-2024-9630 State: PUBLISHED Published: 2024-10-25T07:38:00.356Z Last Updated: 2024-10-25T15:21:28.685Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: wpsolution Products: WPS Telegram Chat Problem Types: CWE-862 Description: The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when accessing messages in versions up to, and including, 4.5.4. This makes it possible for unauthenticated attackers to view the messages that are sent through the Telegram Bot API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/86b9b17f
Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/86b9b17f-f819-4316-8565-4e7603cd5de7?source=cve - https://plugins.trac.wordpress.org/browser/wps-telegram-chat/tags/4.5.4/public/partials/wps-telegram-chat-public-handler.php#L92