Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
r-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2c925848-1ba7-4009-93c2-1648dbf808e9?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-classified-listings/tags/1.4/inc/helpers.php#L407
CVE ID: CVE-2024-13749 State: PUBLISHED Published: 2025-02-12T03:21:39.225Z Last Updated: 2025-02-12T15:15:39.499Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: era404 Products: StaffList Problem Types: CWE-79 Description: The StaffList plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missing or incorrect nonce validation on the 'stafflist' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Anal
equest granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b8da640d-8965-45bb-be68-57d4eb598759?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3232922%40stafflist&new=3232922%40stafflist&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13750 State: PUBLISHED Published: 2025-03-01T04:21:48.987Z Last Updated: 2025-03-03T20:57:33.421Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: prismitsystems Products: Multilevel Referral Affiliate Plugin for WooCommerce Problem Types: CWE-89 Description: The Multilevel Referral Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.27 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and abo
tion on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4389ddc9-de69-4316-9bfa-ff3bd3346c69?source=cve - https://plugins.trac.wordpress.org/browser/multilevel-referral-plugin-for-woocommerce/tags/2.27/classes/referral-program.php#L310
CVE ID: CVE-2024-13751 State: PUBLISHED Published: 2025-02-21T03:21:23.081Z Last Updated: 2025-02-21T14:25:33.917Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: labibahmed42 Products: 3D Photo Gallery Problem Types: CWE-79 Description: The 3D Photo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'des[]' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst
o inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eae1c878-3df9-47af-8283-de3d5acb219a?source=cve - https://plugins.trac.wordpress.org/browser/3d-photo-gallery/tags/1.3/plugin.class.php#L57
CVE ID: CVE-2024-13752 State: PUBLISHED Published: 2025-02-15T09:24:23.809Z Last Updated: 2025-02-18T21:28:50.524Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: wedevs Products: WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts Problem Types: CWE-862 Description: The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the '/pm/v2/settings/notice' endpoint all versions up to, and including, 2.6.17. This makes it possible for authenticated attackers, with S
s/notice' endpoint all versions up to, and including, 2.6.17. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cause a persistent denial of service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bd54a50b-13ce-43ce-bce1-8fe132abc07e?source=cve - https://plugins.trac.wordpress.org/browser/wedevs-project-manager/trunk/core/Upgrades/Upgrade_2_0.php#L255 - https://plugins.trac.wordpress.org/browser/wedevs-project-manager/trunk/core/Upgrades/Upgrade_2_3.php#L151 - https://wordpress.org/plugins/wedevs-project-manager/#developers - https://plugins.trac.wordpress.org/ch
_2_3.php#L151 - https://wordpress.org/plugins/wedevs-project-manager/#developers - https://plugins.trac.wordpress.org/changeset/3239348/ - https://plugins.trac.wordpress.org/changeset?old_path=%2Fwedevs-project-manager%2Ftags%2F2.6.17%2Fsrc%2FSettings%2FControllers%2FSettings_Controller.php&old=3213295&new_path=%2Fwedevs-project-manager%2Ftags%2F2.6.18%2Fsrc%2FSettings%2FControllers%2FSettings_Controller.php&new=3240807&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?old_path=%2Fwedevs-project-manager%2Ftrunk%2Froutes%2Fsettings.php&old=3213295&new_path=%2Fwedevs-project-manager%2Ftrunk%2Froutes%2Fsettings.php&new=3240806&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13753 State: PUBLISHED Published: 2025-02-20T09:21:38.663Z Last Updated: 2025-02-20T15:31:35.092Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: webcodingplace Products: Ultimate Classified Listings Problem Types: CWE-352 Description: The Ultimate Classified Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the update_profile function. This makes it possible for unauthenticated attackers to modify victim's email via a forged request, which might lead to account takeover, granted they can trick a user into performing an ac
's email via a forged request, which might lead to account takeover, granted they can trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/61365b95-da97-425d-a314-648b3d00236f?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-classified-listings/tags/1.4/classes/class-shortcodes.php#L701
CVE ID: CVE-2024-13757 State: PUBLISHED Published: 2025-03-05T09:21:45.634Z Last Updated: 2025-03-05T14:49:57.257Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: averta Products: Master Slider – Responsive Touch Slider Problem Types: CWE-79 Description: The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_layer shortcode in all versions up to, and including, 3.10.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in page
t possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/26a7fb51-f40d-46b8-9f52-495716032a1b?source=cve - https://wordpress.org/plugins/master-slider/#developers - https://plugins.trac.wordpress.org/browser/master-slider/trunk/includes/msp-shortcodes.php#L815
CVE ID: CVE-2024-13758 State: PUBLISHED Published: 2025-01-30T08:21:26.061Z Last Updated: 2025-01-30T15:06:54.994Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: codepeople Products: CP Contact Form with PayPal Problem Types: CWE-352 Description: The CP Contact Form with PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.52. This is due to missing or incorrect nonce validation on the cp_contact_form_paypal_check_init_actions() function. This makes it possible for unauthenticated attackers to add discount codes via a forged request granted they can trick a site administrator into performing an ac
d attackers to add discount codes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/495183b6-dc7c-4ff7-bc99-fc05a10d1269?source=cve - https://plugins.trac.wordpress.org/browser/cp-contact-form-with-paypal/trunk/cp_contactformpp_functions.php#L616 - https://wordpress.org/plugins/cp-contact-form-with-paypal/#developers - https://plugins.trac.wordpress.org/changeset/3230873/
CVE ID: CVE-2024-13759 State: PUBLISHED Published: 2025-05-09T15:20:02.750Z Last Updated: 2025-05-09T19:07:12.574Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Avira Products: Prime Problem Types: CWE-59 Description: Local Privilege Escalation in Avira.Spotlight.Service.exe in Avira Prime 1.1.96.2 on Windows 10 x64 allows local attackers to gain system-level privileges via arbitrary file deletion Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gendigital.com/us/en/contact-us/security-advisories/)
CVE ID: CVE-2024-13767 State: PUBLISHED Published: 2025-01-31T02:24:17.971Z Last Updated: 2025-01-31T19:36:34.934Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: jiangweifang Products: Live2DWebCanvas Problem Types: CWE-862 Description: The Live2DWebCanvas plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ClearFiles() function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.ph
files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/23c89d9f-8958-4333-8604-54173c31efac?source=cve - https://wordpress.org/plugins/live-2d/
CVE ID: CVE-2024-13768 State: PUBLISHED Published: 2025-03-22T06:41:13.494Z Last Updated: 2025-03-24T13:17:46.071Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ashikcse Products: CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts Problem Types: CWE-352 Description: The CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2. This is due to missing or incorrect nonce validation on the cits_assign_fonts_tab() function. This makes it possible for unauthenticated attackers to delete font assignments via a forged request
nts_tab() function. This makes it possible for unauthenticated attackers to delete font assignments via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ea1f1825-241c-4060-a1e1-a13f92421fef?source=cve - https://plugins.trac.wordpress.org/browser/cits-support-svg-webp-media-upload/trunk/includes/cits-custom-fonts.php
CVE ID: CVE-2024-13769 State: PUBLISHED Published: 2025-02-12T04:22:13.636Z Last Updated: 2025-02-12T14:54:53.265Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ThemeREX Products: Puzzles | WP Magazine / Review with Store WordPress Theme + RTL Problem Types: CWE-862 Description: The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the 'theme_options_ajax_post_action' AJAX action in all versions up to, and including, 4.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's setti
This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings and inject malicious web scripts. The developer opted to remove the software from the repository, so an update is not available and it is recommended to find a replacement software. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3c22d064-348d-4335-beaf-22dcdcf88518?source=cve - https://themeforest.net/item/puzzles-wordpress-magazinereview-with-wooc/5690583
CVE ID: CVE-2024-13770 State: PUBLISHED Published: 2025-02-13T04:21:46.559Z Last Updated: 2025-02-13T14:36:57.059Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ThemeREX Products: Puzzles | WP Magazine / Review with Store WordPress Theme + RTL Problem Types: CWE-502 Description: The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2.4 via deserialization of untrusted input 'view_more_posts' AJAX action. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means
unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. The developer opted to remove the software from the repository, so an update is not available and it is recommended to find a replacement software. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ww
recommended to find a replacement software. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/950d1c8f-6715-4b0d-bf3d-af978a146838?source=cve - https://themeforest.net/item/puzzles-wordpress-magazinereview-with-wooc/5690583
CVE ID: CVE-2024-13771 State: PUBLISHED Published: 2025-03-14T11:15:52.455Z Last Updated: 2025-04-03T13:07:20.148Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: uxper Products: Civi - Job Board & Freelance Marketplace WordPress Theme Problem Types: CWE-288 Description: The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.4. This is due to a lack of user validation before changing a password. This makes it possible for unauthenticated attackers to change the password of arbitrary users, including administrators, if the attacker knows the username
cated attackers to change the password of arbitrary users, including administrators, if the attacker knows the username of the victim. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5ab2c74d-b83b-40ea-951c-83aeb76a7515?source=cve - http://localhost:1337/wp-content/themes/civi/includes/class-ajax.php#L715
CVE ID: CVE-2024-13772 State: PUBLISHED Published: 2025-03-14T11:15:53.188Z Last Updated: 2025-06-17T18:05:41.908Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: uxper Products: Civi - Job Board & Freelance Marketplace WordPress Theme Problem Types: CWE-288 Description: The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.6.1. This is due to a lack of password randomization and user validation through the fb_ajax_login_or_register and google_ajax_login_or_register actions. This makes it possible for unauthenticated attackers to login as any user as
and google_ajax_login_or_register actions. This makes it possible for unauthenticated attackers to login as any user as long as they have access to the email. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bf04f458-7900-4dd3-84fb-169b74db97ab?source=cve - https://themeforest.net/item/civi-job-board-wordpress-theme/42770817#item-description__changelogs
CVE ID: CVE-2024-13773 State: PUBLISHED Published: 2025-03-14T11:15:53.544Z Last Updated: 2025-03-14T12:28:42.629Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: uxper Products: Civi - Job Board & Freelance Marketplace WordPress Theme Problem Types: CWE-321 Description: The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via hard-coded credentials. This makes it possible for unauthenticated attackers to extract sensitive data including LinkedIn client and secret keys. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
data including LinkedIn client and secret keys. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e3499182-7501-4fec-a7c6-b66ae47533cd?source=cve - http://localhost:1337/wp-content/themes/civi/includes/class-init.php#L36
CVE ID: CVE-2024-13774 State: PUBLISHED Published: 2025-03-08T02:24:04.980Z Last Updated: 2025-03-10T15:57:26.023Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wpcodefactory Products: Wishlist for WooCommerce: Multi Wishlists Per Customer Problem Types: CWE-352 Description: The Wishlist for WooCommerce: Multi Wishlists Per Customer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.7. This is due to missing or incorrect nonce validation on the 'save_to_multiple_wishlist' function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged req
his makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c11456bb-dde3-4ab8-b00b-a6cdcc68a760?source=cve - https://plugins.trac.wordpress.org/browser/wish-list-for-woocommerce/tags/3.1.7/includes/free/class-alg-wc-wish-list-ajax.php#L337 - https://plugins.trac.wordpress.org/browser/wish-list-for-woocommerce/tags/3.1.7/includes/free/class-alg-wc-wish-list-ajax.php#L789
CVE ID: CVE-2024-13775 State: PUBLISHED Published: 2025-02-01T12:21:31.365Z Last Updated: 2025-02-03T16:36:29.727Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: vanquish Products: WooCommerce Support Ticket System Problem Types: CWE-862 Description: The WooCommerce Support Ticket System plugin for WordPress is vulnerable to unauthorized access and loss of data due to missing capability checks on the 'ajax_delete_message', 'ajax_get_customers_partial_list', and 'ajax_get_admins_list' functions in all versions up to, and including, 17.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts, and
is makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts, and read names, emails, and capabilities of all users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/72dc919a-c13d-49b4-927d-a0bb837b63dd?source=cve - https://codecanyon.net/item/woocommerce-support-ticket-system/17930050#item-description__change-log
CVE ID: CVE-2024-13776 State: PUBLISHED Published: 2025-04-05T05:32:12.407Z Last Updated: 2025-04-07T14:11:57.825Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: ZoomIt Products: ZoomSounds - WordPress Wave Audio Player with Playlist Problem Types: CWE-862 Description: The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'dzsap_delete_notice' AJAX action in all versions up to, and including, 6.91. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option v
ng, 6.91. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'seen' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration. There are several other functions also vulnerable to missing authorization. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0c8e538b-7157-42d3-abee-8259c6715cd5?source=cve - https://codecanyon.net/item/zoomsounds-wordpress-wave-audio-player-with-playlist/6181433
CVE ID: CVE-2024-13777 State: PUBLISHED Published: 2025-03-05T09:21:44.881Z Last Updated: 2025-03-05T14:52:06.628Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ZoomIt Products: ZoomSounds - WordPress Wave Audio Player with Playlist Problem Types: CWE-502 Description: The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.91 via deserialization of untrusted input from the 'margs' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has
ers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1ec4633a-0742-4646-accd-cc0b9e01302a?source=cve - https://codecanyon.net/item/zoomsounds-wordpress-wave-audio-player-with-p
4633a-0742-4646-accd-cc0b9e01302a?source=cve - https://codecanyon.net/item/zoomsounds-wordpress-wave-audio-player-with-playlist/6181433