Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-23978 State: PUBLISHED Published: 2023-11-22T23:34:37.802Z Last Updated: 2024-10-01T15:48:59.891Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SwitchWP Products: WP Client Reports Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SwitchWP WP Client Reports plugin <= 1.0.16 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-client-reports/wordpress-wp-client-reports-plugin-1-0-16-subscriber-sensitive-data-exposure?_s_id=cve
CVE ID: CVE-2023-23979 State: PUBLISHED Published: 2023-04-06T05:17:03.440Z Last Updated: 2024-08-02T13:46:15.146Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Fullworks Products: Quick Event Manager Problem Types: CWE-79 Description: Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/quick-event-manager/wordpress-quick-event-manager-plugin-9-7-4-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-23980 State: PUBLISHED Published: 2023-04-06T07:39:03.583Z Last Updated: 2025-01-10T19:10:41.094Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: MailOptin Popup Builder Team Products: MailOptin Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MailOptin Popup Builder Team MailOptin plugin <= 1.2.54.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mailoptin/wordpress-mailoptin-plugin-1-2-54-0-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-23981 State: PUBLISHED Published: 2023-04-06T04:43:21.905Z Last Updated: 2025-01-10T19:11:36.101Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: QuantumCloud Products: Conversational Forms for ChatBot Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in QuantumCloud Conversational Forms for ChatBot plugin <= 1.1.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/conversational-forms/wordpress-conversational-forms-for-chatbot-plugin-1-1-6-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-23982 State: PUBLISHED Published: 2023-04-06T04:49:44.144Z Last Updated: 2025-01-10T19:11:24.402Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: WPGear.Pro Products: WPFrom Email Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPGear.Pro WPFrom Email plugin <= 1.8.8 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wpfrom-email/wordpress-wpfrom-email-plugin-1-8-8-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-23983 State: PUBLISHED Published: 2023-02-28T14:36:13.091Z Last Updated: 2025-01-13T15:55:57.739Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: wpdevart Products: Responsive Vertical Icon Menu Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 can lead to theme deletion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wpdevart-vertical-menu/wordpress-responsive-vertical-icon-menu-plugin-1-5-8-cross-site-request-forgery-csrf-leading-to-settings-change-vulnerability
ress-responsive-vertical-icon-menu-plugin-1-5-8-cross-site-request-forgery-csrf-leading-to-settings-change-vulnerability?_s_id=cve
CVE ID: CVE-2023-23984 State: PUBLISHED Published: 2023-03-01T12:27:36.126Z Last Updated: 2025-01-13T15:55:28.155Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Wow-Company Products: Bubble Menu – circle floating menu Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Bubble Menu – circle floating menu plugin <= 3.0.1 leading to form deletion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/bubble-menu/wordpress-bubble-menu-circle-floating-menu-plugin-3-0-1-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2023-23985 State: PUBLISHED Published: 2024-04-24T11:00:57.759Z Last Updated: 2024-08-02T10:49:08.812Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Quiz Maker team Products: Quiz Maker Problem Types: CWE-862 Description: Missing Authorization vulnerability in Quiz Maker team Quiz Maker.This issue affects Quiz Maker: from n/a through 6.3.9.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/quiz-maker/wordpress-quiz-maker-plugin-6-3-9-4-content-spoofing?_s_id=cve
CVE ID: CVE-2023-23986 State: PUBLISHED Published: 2024-12-09T11:31:42.240Z Last Updated: 2024-12-09T18:42:00.559Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Noah Hearle, Design Extreme Products: Reviews and Rating – Google My Business Problem Types: CWE-862 Description: Missing Authorization vulnerability in Noah Hearle, Design Extreme Reviews and Rating – Google My Business allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reviews and Rating – Google My Business: from n/a through 4.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/g-business-re
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/g-business-reviews-rating/vulnerability/wordpress-reviews-and-rating-google-my-business-plugin-4-14-broken-access-control?_s_id=cve
CVE ID: CVE-2023-23987 State: PUBLISHED Published: 2023-04-06T05:22:56.281Z Last Updated: 2025-01-10T19:11:03.879Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: WPEverest Products: User Registration Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPEverest User Registration plugin <= 2.3.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/user-registration/wordpress-user-registration-custom-registration-form-login-form-and-user-profile-for-wordpress-plugin-2-3-0-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-23988 State: PUBLISHED Published: 2024-05-17T06:33:10.087Z Last Updated: 2024-08-02T10:49:08.944Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Joseph C Dolson Products: My Tickets Problem Types: CWE-862 Description: Missing Authorization vulnerability in Joseph C Dolson My Tickets.This issue affects My Tickets: from n/a through 1.9.11. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/my-tickets/wordpress-my-tickets-plugin-1-9-11-payment-bypass-vulnerability?_s_id=cve
CVE ID: CVE-2023-23989 State: PUBLISHED Published: 2024-04-24T14:41:06.971Z Last Updated: 2024-08-02T10:49:09.088Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Metagauss Products: RegistrationMagic Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.1.9.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-custom-registra
abase/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-custom-registration-forms-user-registration-and-user-login-plugin-plugin-5-1-9-2-content-injection?_s_id=cve
CVE ID: CVE-2023-23990 State: PUBLISHED Published: 2024-05-17T06:33:39.433Z Last Updated: 2024-08-02T10:49:08.842Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Qube One Ltd. Products: Redirection for Contact Form 7 Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in Qube One Ltd. Redirection for Contact Form 7 wpcf7-redirect allows Privilege Escalation.This issue affects Redirection for Contact Form 7: from n/a through 2.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wpcf7-redirect/wordpress-redirection-for-contact-form-7-plugin-2-7-0
es: - https://patchstack.com/database/vulnerability/wpcf7-redirect/wordpress-redirection-for-contact-form-7-plugin-2-7-0-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2023-23991 State: PUBLISHED Published: 2024-03-26T08:56:12.055Z Last Updated: 2024-08-02T17:18:32.897Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: WPdevelop / Oplugins Products: Booking Calendar Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdevelop / Oplugins Booking Calendar allows SQL Injection.This issue affects Booking Calendar: from n/a through 9.4.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/booking/wordpress-booking-calendar-plugin-9-4-2-sql-injection?_s
rences: - https://patchstack.com/database/vulnerability/booking/wordpress-booking-calendar-plugin-9-4-2-sql-injection?_s_id=cve
CVE ID: CVE-2023-23992 State: PUBLISHED Published: 2023-02-28T13:41:53.530Z Last Updated: 2025-01-13T15:56:06.123Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: AutomatorWP Products: AutomatorWP Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in AutomatorWP plugin <= 2.5.0 leads to object delete. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/automatorwp/wordpress-automatorwp-the-most-flexible-and-powerful-no-code-automation-plugin-for-wordpress-plugin-2-5-0-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2023-23993 State: PUBLISHED Published: 2023-07-10T15:27:42.999Z Last Updated: 2024-10-17T15:49:21.210Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: LionScripts.com Products: LionScripts: IP Blocker Lite Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in LionScripts.Com LionScripts: IP Blocker Lite plugin <= 11.1.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ip-address-blocker/wordpress-lionscripts-ip-blocker-lite-plugin-11-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-23994 State: PUBLISHED Published: 2023-04-07T11:51:01.833Z Last Updated: 2025-01-10T18:58:03.335Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Marcel Bootsman Products: Auto Hide Admin Bar Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marcel Bootsman Auto Hide Admin Bar plugin <= 1.6.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/auto-hide-admin-bar/wordpress-auto-hide-admin-bar-plugin-1-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23995 State: PUBLISHED Published: 2023-04-25T19:20:07.405Z Last Updated: 2025-01-09T15:33:34.634Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Tim Reeves & David Stöckl Products: TinyMCE Custom Styles Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tim Reeves & David Stöckl TinyMCE Custom Styles plugin <= 1.1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/tinymce-custom-styles/wordpress-tinymce-custom-styles-plugin-1-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23996 State: PUBLISHED Published: 2023-04-06T07:46:40.926Z Last Updated: 2025-01-10T19:10:33.158Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: ProfilePress Membership Team Products: ProfilePress Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-user-avatar/wordpress-paid-membership-ecommerce-registration-form-login-form-user-profile-paywall-restrict-content-profilepress-plugin-4-5-3-cr
aid-membership-ecommerce-registration-form-login-form-user-profile-paywall-restrict-content-profilepress-plugin-4-5-3-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-23997 State: PUBLISHED Published: 2023-07-11T07:39:18.300Z Last Updated: 2024-10-11T16:09:15.376Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Dave Jesch Products: Database Collation Fix Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Dave Jesch Database Collation Fix plugin <= 1.2.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/database-collation-fix/wordpress-database-collation-fix-plugin-1-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-23998 State: PUBLISHED Published: 2023-04-06T07:42:52.411Z Last Updated: 2024-08-02T13:44:56.406Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: E4J s.r.l. Products: VikRentCar Car Rental Management System Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in E4J s.R.L. VikRentCar Car Rental Management System plugin <= 1.3.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/vikrentcar/wordpress-vikrentcar-car-rental-management-system-plugin-1-3-0-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-23999 State: PUBLISHED Published: 2023-05-18T10:14:41.558Z Last Updated: 2025-01-09T15:13:47.737Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: MonsterInsights Products: MonsterInsights Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in MonsterInsights plugin <= 8.14.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/google-analytics-for-wordpress/wordpress-google-analytics-by-monsterinsights-plugin-8-14-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-24000 State: PUBLISHED Published: 2023-10-31T13:54:07.430Z Last Updated: 2024-09-06T18:03:33.674Z Vendors: GamiPress Products: GamiPress Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GamiPress gamipress allows SQL Injection.This issue affects GamiPress: from n/a through 2.5.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/gamipress/wordpress-gamipress-plugin-2-5-7-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-24001 State: PUBLISHED Published: 2023-04-06T07:50:15.807Z Last Updated: 2025-01-10T19:10:22.588Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Yannick Lefebvre Products: Modal Dialog Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Yannick Lefebvre Modal Dialog plugin <= 3.5.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/modal-dialog/wordpress-modal-dialog-plugin-3-5-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-24002 State: PUBLISHED Published: 2023-04-06T08:04:24.910Z Last Updated: 2025-01-10T19:08:29.654Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: WPdevart Products: YouTube Embed, Playlist and Popup by WpDevArt Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPdevart YouTube Embed, Playlist and Popup by WpDevArt plugin <= 2.6.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/youtube-video-player/wordpress-youtube-embed-playlist-and-popup-by-wpdevart-plugin-2-6-3-cross-site-scripting-xss?_s_id=
youtube-video-player/wordpress-youtube-embed-playlist-and-popup-by-wpdevart-plugin-2-6-3-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-24003 State: PUBLISHED Published: 2023-04-06T08:09:14.646Z Last Updated: 2025-02-19T21:35:10.010Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Timersys Products: WP Popups – WordPress Popup builder Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Timersys WP Popups – WordPress Popup plugin <= 2.1.4.8 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-popups-lite/wordpress-wp-popups-wordpress-popup-builder-plugin-2-1-4-8-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-24004 State: PUBLISHED Published: 2023-04-06T08:00:22.034Z Last Updated: 2025-01-10T19:10:12.337Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: WPdevart Products: Image and Video Lightbox, Image PopUp Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPdevart Image and Video Lightbox, Image PopUp plugin <= 2.1.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/lightbox-popup/wordpress-image-and-video-lightbox-image-popup-plugin-2-1-5-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-24005 State: PUBLISHED Published: 2023-04-25T19:45:36.878Z Last Updated: 2025-01-09T15:33:06.808Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Winwar Media Products: Inline Tweet Sharer – Twitter Sharing Plugin Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media Inline Tweet Sharer – Twitter Sharing Plugin plugin <= 2.5.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/inline-tweet-sharer/wordpress-inline-tweet-sharer-twitter-sharing-plugin-plugin-2-5-3-cross-site-scripting-xss-vul
ility/inline-tweet-sharer/wordpress-inline-tweet-sharer-twitter-sharing-plugin-plugin-2-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-24006 State: PUBLISHED Published: 2023-04-06T07:55:06.247Z Last Updated: 2025-02-19T21:35:18.202Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Link Software LLC Products: WP Terms Popup Problem Types: CWE-79 Description: Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Link Software LLC WP Terms Popup plugin <= 2.6.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-terms-popup/wordpress-wp-terms-popup-terms-and-conditions-and-privacy-policy-wordpress-popups-plugin-2-6-0-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2023-24007 State: PUBLISHED Published: 2023-05-26T11:57:26.419Z Last Updated: 2024-11-12T14:12:12.811Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: TheOnlineHero - Tom Skroza Products: Admin Block Country Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in TheOnlineHero - Tom Skroza Admin Block Country plugin <= 7.1.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/admin-block-country/wordpress-admin-block-country-plugin-7-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-24008 State: PUBLISHED Published: 2023-05-26T12:15:02.398Z Last Updated: 2024-08-02T14:47:57.363Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: yonifre Products: Maspik – Spam Blacklist Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in yonifre Maspik – Spam Blacklist plugin <= 0.7.8 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/contact-forms-anti-spam/wordpress-maspik-spam-blacklist-plugin-0-7-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-24009 State: PUBLISHED Published: 2023-08-10T10:14:58.875Z Last Updated: 2024-09-25T16:44:43.953Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Wpazure Themes Products: Upfrontwp Problem Types: CWE-79 Description: Auth. (subscriber+) Reflected Cross-site Scripting (XSS) vulnerability in Wpazure Themes Upfrontwp theme <= 1.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/upfrontwp/wordpress-upfrontwp-theme-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-24010 State: PUBLISHED Published: 2025-01-09T14:36:05.972Z Last Updated: 2025-01-09T20:05:48.421277Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: eProsima Products: DDS Problem Types: CWE-200 Description: An attacker can arbitrarily craft malicious DDS Participants (or ROS 2 Nodes) with valid certificates to compromise and get full control of the attacked secure DDS databus system by exploiting vulnerable attributes in the configuration of PKCS#7 certificate’s validation. This is caused by a non-compliant implementation of permission document verification used by some DDS vendors. Specifically, an improper use of the OpenSSL PKCS7_verify fu
permission document verification used by some DDS vendors. Specifically, an improper use of the OpenSSL PKCS7_verify function used to validate S/MIME signatures. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ros2/sros2/issues/282 - https://gist.github.com/vmayoral/235c02d0b0ef85a29812eff6980ff80d
CVE ID: CVE-2023-24011 State: PUBLISHED Published: 2025-01-09T14:36:10.761Z Last Updated: 2025-01-09T20:05:46.897043Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: ZettaScale Products: DDS Problem Types: CWE-200 Description: An attacker can arbitrarily craft malicious DDS Participants (or ROS 2 Nodes) with valid certificates to compromise and get full control of the attacked secure DDS databus system by exploiting vulnerable attributes in the configuration of PKCS#7 certificate’s validation. This is caused by a non-compliant implementation of permission document verification used by some DDS vendors. Specifically, an improper use of the OpenSSL PKCS7_verify