Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
attackers to edit any account on the blog, such as changing the admin account's email address. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/41800ea9-1ace-42fc-9e7f-d760a126342b?source=cve - https://blog.nintechnet.com/wordpress-ulisting-plugin-fixed-multiple-critical-vulnerabilities/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2456786%40ulisting&new=2456786%40ulisting&sfp_email=&sfph_mail=
CVE ID: CVE-2021-4347 State: PUBLISHED Published: 2023-06-07T01:51:16.287Z Last Updated: 2024-12-20T23:56:24.499Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H) Vendors: zorem Products: Advanced Shipment Tracking for WooCommerce Problem Types: CWE-862 Missing Authorization Description: The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenticated arbitrary options update. The function allows attackers (including those at customer level) to update any WordPress option in the database. Version 3.2.5 was initially released as a fix, but doesn't fully address the iss
e any WordPress option in the database. Version 3.2.5 was initially released as a fix, but doesn't fully address the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4174b47a-75d0-4ada-bd4d-efbaf0b1a049?source=cve - https://blog.nintechnet.com/wordpress-advanced-shipment-tracking-for-woocommerce-fixed-critical-vulnerability/
CVE ID: CVE-2021-4348 State: PUBLISHED Published: 2023-06-07T01:51:15.874Z Last Updated: 2024-12-28T00:57:09.128Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: createit-pl Products: Ultimate GDPR & CCPA Compliance Toolkit for WordPress Problem Types: CWE-862 Missing Authorization Description: The Ultimate GDPR & CCPA plugin for WordPress is vulnerable to unauthenticated settings import and export via the export_settings & import_settings functions in versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to change plugin settings and conduct attacks such as redirecting visitors to malicious sites. Additional Analyst Notes: -
change plugin settings and conduct attacks such as redirecting visitors to malicious sites. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/40e2e8fb-ea36-4602-bead-8daf75d6dfb9?source=cve - https://blog.nintechnet.com/critical-vulnerability-in-wordpress-ultimate-gdpr-ccpa-compliance-toolkit-plugin/
CVE ID: CVE-2021-4349 State: PUBLISHED Published: 2023-06-07T01:51:15.459Z Last Updated: 2024-12-23T16:22:30.795Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: narinder-singh Products: Process Steps Template Designer Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to conduct unspecified attacks via forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Prog
an trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2acd40d5-8a9c-4ca8-9c89-5bf639b1c66c?source=cve - https://plugins.trac.wordpress.org/changeset/2473649/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
CVE ID: CVE-2021-4350 State: PUBLISHED Published: 2023-06-07T01:51:18.755Z Last Updated: 2024-12-28T00:56:47.575Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L) Vendors: nmedia Products: Frontend File Manager Plugin Problem Types: CWE-862 Missing Authorization Description: The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and including, 18.2. This is due to lacking authentication protections on the wpfm_send_file_in_email AJAX action. This makes it possible for unauthenticated attackers to send emails using the site with a custom subject, recipient email, and body with unsanitized HTML content. This effec
to send emails using the site with a custom subject, recipient email, and body with unsanitized HTML content. This effectively lets the attacker use the site as a spam relay. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/49150180-9de0-4318-b21b-779daaeb7a52?source=cve - https://blog.nintechnet.com/wordpress-frontend-file-manager-plugin-fixed-multiple-critical-vulnerabilities/
CVE ID: CVE-2021-4351 State: PUBLISHED Published: 2023-06-07T01:51:20.326Z Last Updated: 2024-12-28T00:56:39.848Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: nmedia Products: Frontend File Manager Plugin Problem Types: CWE-862 Missing Authorization Description: The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Post Meta Change in versions up to, and including, 18.2. This is due to lacking authentication protections, capability checks, and sanitization, all on the wpfm_file_meta_update AJAX action. This makes it possible for unauthenticated attackers to change the meta data of certain posts and pages. Additional Analyst Notes
s it possible for unauthenticated attackers to change the meta data of certain posts and pages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5539aa79-66ad-43fa-967c-2bec877061e0?source=cve - https://blog.nintechnet.com/wordpress-frontend-file-manager-plugin-fixed-multiple-critical-vulnerabilities/
CVE ID: CVE-2021-4352 State: PUBLISHED Published: 2023-06-07T01:51:21.174Z Last Updated: 2024-12-28T00:56:32.937Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: https://codecanyon.net/item/jobsearch-wp-job-board-wordpress-plugin/21066856 Products: JobSearch WP Job Board Problem Types: CWE-284 Improper Access Control Description: The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the save_locsettings function in versions up to, and including, 1.8.1. This makes it possible for unauthenticated attackers to change the settings of the plugin. Additional Analyst Notes: - CVE Program Container
le for unauthenticated attackers to change the settings of the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/59170f0a-975e-487c-bdb0-585c802b3127?source=cve - https://blog.nintechnet.com/wordpress-jobsearch-wp-job-board-plugin-fixed-vulnerability/ - https://wpscan.com/vulnerability/ed7e664e-5a73-4d2d-a599-a0be89d6c2d1
CVE ID: CVE-2021-4353 State: PUBLISHED Published: 2023-10-20T06:35:25.115Z Last Updated: 2024-09-16T18:16:07.197Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: RightPress Products: WooCommerce Dynamic Pricing and Discounts Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and including, 2.4.1. This is due to missing authorization on the export() function which makes makes it possible for unauthenticated attackers to export the plugin's settings. Additional Analyst Notes: - CVE Prog
es makes it possible for unauthenticated attackers to export the plugin's settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5c1e6685-44a7-452e-89ab-b9fffb65a12b?source=cve - https://blog.nintechnet.com/woocommerce-dynamic-pricing-and-discounts-plugin-fixed-multiple-vulnerabilities/
CVE ID: CVE-2021-4354 State: PUBLISHED Published: 2023-06-07T01:51:22.946Z Last Updated: 2024-12-23T16:21:58.528Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: magazine3 Products: PWA for WP & AMP Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pwaforwp_splashscreen_uploader function in versions up to, and including, 1.7.32. This makes it possible for authenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. Additional Analyst Notes: - CVE
trary files on the affected sites server which may make remote code execution possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6082791e-feac-41f7-b565-9d98624ddf50?source=cve - https://blog.nintechnet.com/wordpress-pwa-for-wp-and-amp-plugin-fixed-vulnerabilities/
CVE ID: CVE-2021-4355 State: PUBLISHED Published: 2023-06-07T01:51:24.304Z Last Updated: 2024-12-28T00:56:04.776Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: uscnanbu Products: Welcart e-Commerce Problem Types: CWE-862 Missing Authorization Description: The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the download_orderdetail_list(), change_orderlist(), and download_member_list() functions called via admin_init hooks in versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to download lists of members, products and orders. Additional Analyst Notes: - C
possible for unauthenticated attackers to download lists of members, products and orders. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/671f5ba5-1f18-49fa-aa97-eaebdb3417bb?source=cve - https://blog.nintechnet.com/wordpress-welcart-e-commerce-plugin-fixed-vulnerabilities/
CVE ID: CVE-2021-4356 State: PUBLISHED Published: 2023-06-07T01:51:27.287Z Last Updated: 2024-12-23T16:21:49.640Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: nmedia Products: Frontend File Manager Plugin Problem Types: CWE-862 Missing Authorization Description: The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, 18.2. This is due to lacking authentication protections, capability checks, and sanitization, all on the wpfm_file_meta_update AJAX action. This makes it possible for unauthenticated attackers to download arbitrary files on the site, potentially leading to site
is makes it possible for unauthenticated attackers to download arbitrary files on the site, potentially leading to site takeover. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/79e2011c-5e4d-4d02-831f-6b4dcfcaa51e?source=cve - https://blog.nintechnet.com/wordpress-frontend-file-manager-plugin-fixed-multiple-critical-vulnerabilities/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2554359%40nmedia-user-file-uploader&new=2554359%40nmedia-user-file-uploader&sfp_email=&sfph_mail=
CVE ID: CVE-2021-4357 State: PUBLISHED Published: 2023-06-07T01:51:26.007Z Last Updated: 2024-12-28T00:55:56.896Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: stylemix Products: Directory Listings WordPress plugin – uListing Problem Types: CWE-862 Missing Authorization Description: The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing security nonce, on the UlistingUserRole::save_role_api function in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to arbitrarily delete site posts and pages. Additional Analyst Notes: - CVE Program Container: - CIS
enticated attackers to arbitrarily delete site posts and pages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/71aa14b8-39bc-4b91-a7cf-9d203fdf44ea?source=cve - https://blog.nintechnet.com/wordpress-ulisting-plugin-fixed-multiple-critical-vulnerabilities/ - https://wordpress.org/plugins/ulisting/#developers - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2456786%40ulisting&new=2456786%40ulisting&sfp_email=&sfph_mail=
CVE ID: CVE-2021-4358 State: PUBLISHED Published: 2023-06-07T01:51:25.133Z Last Updated: 2025-02-05T19:44:08.384Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: legalweb Products: WP DSGVO Tools (GDPR) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 3.1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user
kes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6c18ab1b-02f1-4679-8cff-679d98dc9f4a?source=cve - https://wordpress.org/support/topic/weiterleitung-redirects/ - https://blog.nintechnet.com/wordpress-wp-dsgvo-tools-gdpr-plugin-patched-vulnerability-actively-exploited/
CVE ID: CVE-2021-4359 State: PUBLISHED Published: 2023-06-07T01:51:29.392Z Last Updated: 2024-12-28T00:55:18.551Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: nmedia Products: Frontend File Manager Plugin Problem Types: CWE-862 Missing Authorization Description: The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 18.2. This is due to lacking authentication protections and lacking a security nonce on the wpfm_delete_file AJAX action. This makes it possible for unauthenticated attackers to delete any posts and pages on the site. Additional Analyst Notes: - CVE Program Cont
le for unauthenticated attackers to delete any posts and pages on the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/84c61d00-20c1-4176-a74d-ea6ff6220f26?source=cve - https://blog.nintechnet.com/wordpress-frontend-file-manager-plugin-fixed-multiple-critical-vulnerabilities/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2554359%40nmedia-user-file-uploader&new=2554359%40nmedia-user-file-uploader&sfp_email=&sfph_mail=
CVE ID: CVE-2021-4360 State: PUBLISHED Published: 2023-06-07T01:51:29.828Z Last Updated: 2024-12-23T16:21:35.790Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: waseem_senjer Products: Controlled Admin Access Problem Types: CWE-284 Improper Access Control Description: The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting access to the configuration page. This makes it possible for attackers to create a new administrator role with unrestricted access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordf
cted access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8c57211a-f59d-4379-b09e-7c6049a6b04d?source=cve - https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-controlled-admin-access-plugin/ - https://plugins.svn.wordpress.org/controlled-admin-access/trunk/readme.txt - https://wpscan.com/vulnerability/5ddc0a9d-c081-4bef-aa87-3b10d037379c
CVE ID: CVE-2021-4361 State: PUBLISHED Published: 2023-06-07T01:51:28.550Z Last Updated: 2024-12-23T16:21:42.115Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: https://codecanyon.net/item/jobsearch-wp-job-board-wordpress-plugin/21066856 Products: JobSearch WP Job Board Problem Types: CWE-284 Improper Access Control Description: The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_job_integrations_settin_save AJAX action in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to update arbitrary options on the site. Additional Analyst Notes:
1. This makes it possible for authenticated attackers to update arbitrary options on the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/839a0cc0-a656-4107-a748-4ad85e950237?source=cve - https://blog.nintechnet.com/wordpress-jobsearch-wp-job-board-plugin-fixed-vulnerability/ - https://wpscan.com/vulnerability/a69aa52f-9876-4180-97a4-713459b43f24
CVE ID: CVE-2021-4362 State: PUBLISHED Published: 2023-06-07T01:51:28.136Z Last Updated: 2024-12-28T00:55:32.558Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wpkube Products: Social Sharing Plugin – Kiwi Problem Types: CWE-862 Missing Authorization Description: The Kiwi Social Share plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the kiwi_social_share_get_option() function called via the kiwi_social_share_get_option AJAX action in version 2.1.0. This makes it possible for unauthenticated attackers to read and modify arbitrary options on a WordPress site that can be used for complete site takeover. This wa
attackers to read and modify arbitrary options on a WordPress site that can be used for complete site takeover. This was a previously fixed vulnerability that was reintroduced in this version. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8148b6d0-190a-4b97-8af7-edd6943116d1?source=cve - https://blog.nintechnet.com/wordpress-kiwi-social-sharing-plugin-fixed-critical-vulnerability/ - https://wordpress.org/plugins/kiwi-social-share/#developers
CVE ID: CVE-2021-4363 State: PUBLISHED Published: 2023-06-07T01:51:27.707Z Last Updated: 2024-12-20T23:52:39.559Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: labibahmed42 Products: WP Quick FrontEnd Editor – WordPress Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.5 due to insufficient input sanitization and output escaping on the 'save_content_front' function that uses print_r on the user-supplied $_REQUEST values . This makes it possible for
the 'save_content_front' function that uses print_r on the user-supplied $_REQUEST values . This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7ce8ae7d-c2a5-4da3-8bdd-20dfdb5ce700?source=cve - https://wordpress.org/plugins/wp-quick-front-end-editor/#developers - https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-wp-quick-frontend-editor-plugin-unpatched/
CVE ID: CVE-2021-4364 State: PUBLISHED Published: 2023-06-07T01:51:30.752Z Last Updated: 2024-12-20T23:52:29.496Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: https://codecanyon.net/item/jobsearch-wp-job-board-wordpress-plugin/21066856 Products: JobSearch WP Job Board Problem Types: CWE-284 Improper Access Control Description: The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_add_job_import_schedule_call() function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to add and/or modify schedule calls. Additional Analyst Notes: -
.1. This makes it possible for authenticated attackers to add and/or modify schedule calls. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9114018f-0678-4973-bb1e-932f0d93f963?source=cve - https://blog.nintechnet.com/wordpress-jobsearch-wp-job-board-plugin-fixed-vulnerability/ - https://wpscan.com/vulnerability/7e2dd5df-f758-419c-bfb8-b8e53235fede
CVE ID: CVE-2021-4365 State: PUBLISHED Published: 2023-06-07T01:51:37.021Z Last Updated: 2024-12-28T00:54:29.636Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: nmedia Products: Frontend File Manager Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to, and including, 18.2. This is due to lacking authentication protections and santisation all on the wpfm_edit_file_title_desc AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web
the wpfm_edit_file_title_desc AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a9c82154-d390-44ba-a54a-89f4bb69cdce?source=cve - https://blog.nintechnet.com/wordpress-frontend-file-manager-plugin-fixed-multiple-critical-vulnerabilities/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2554359%40nmedia-user-file-uploader&new=2554359%40nmedia-user-file-uploader&sfp_email=&sfph_mail=
CVE ID: CVE-2021-4366 State: PUBLISHED Published: 2023-06-07T01:51:36.574Z Last Updated: 2024-12-20T23:51:22.814Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: magazine3 Products: PWA for WP & AMP Problem Types: CWE-862 Missing Authorization Description: The PWA for WP & AMP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the pwaforwp_update_features_options function in versions up to, and including, 1.7.32. This makes it possible for authenticated attackers to change the otherwise restricted settings within the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
d settings within the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a9892dd1-3939-41a9-a828-fa1bf7d96eb8?source=cve - https://blog.nintechnet.com/wordpress-pwa-for-wp-and-amp-plugin-fixed-vulnerabilities/ - https://wpscan.com/vulnerability/b38a51d7-375e-4cca-88ba-ccab796ac134