Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12797 State: PUBLISHED Published: 2025-02-11T15:59:36.719Z Last Updated: 2025-02-18T14:01:55.140Z Vendors: OpenSSL Products: OpenSSL Problem Types: CWE-392 Description: Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set. Impact summary: TLS and DTLS connections using raw public keys may be vulnerable to man-in-middle attacks when server authentication failure is not detected by clients. RPKs are disabled by default in both TLS clients and TLS servers. The issue only arises when TLS clients exp
by clients. RPKs are disabled by default in both TLS clients and TLS servers. The issue only arises when TLS clients explicitly enable RPK use by the server, and the server, likewise, enables sending of an RPK instead of an X.509 certificate chain. The affected clients are those that then rely on the handshake to fail when the server's RPK fails to match one of the expected public keys, by setting the verification mode to SSL_VERIFY_PEER. Clients that enable server-side raw public keys can still find out that raw public key verification failed by calling SSL_get_verify_result(), and those that do, and take appropriate action, are not affected. This issue was introduced in the initial impleme
lt(), and those that do, and take appropriate action, are not affected. This issue was introduced in the initial implementation of RPK support in OpenSSL 3.2. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://openssl-library.org/news/secadv/20250211.txt - https://github.com/openssl/openssl/commit/738d4f9fdeaad57660dcba50a619fafced3fd5e9 - https://github.com/openssl/openssl/commit/87ebd203feffcf92ad5889df92f90bb0ee10a699 - https://github.com/openssl/openssl/commit/798779d43494549b611233f92652f0da5328fbe7
CVE ID: CVE-2024-12798 State: PUBLISHED Published: 2024-12-19T15:14:21.598Z Last Updated: 2025-01-03T13:38:58.152Z Vendors: QOS.CH Sarl Products: Logback-core Problem Types: CWE-917 Description: ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension. A successful attack requires the user to have write access to a config
ry code using the JaninoEventEvaluator extension. A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://logback.qos.ch/news.html#1.5.13 - https://logback.qos.ch/news.html#1.3.15
CVE ID: CVE-2024-12799 State: PUBLISHED Published: 2025-03-05T14:55:55.363Z Last Updated: 2025-03-05T16:21:23.627Z Vendors: OpenText Products: Identity Manager Advanced Edition Problem Types: CWE-522 Description: Insufficiently Protected Credentials vulnerability in OpenText Identity Manager Advanced Edition on Windows, Linux, 64 bit allows Privilege Abuse. This vulnerability could allow an authenticated user to obtain higher privileged user’s sensitive information via crafted payload. This issue affects Identity Manager Advanced Edition: from 4.8.0.0 through 4.8.7.0102, 4.9.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000037
9.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000037455
CVE ID: CVE-2024-12800 State: PUBLISHED Published: 2025-05-15T20:06:56.920Z Last Updated: 2025-05-20T19:30:12.006Z Vendors: Unknown Products: IP Based Login Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The IP Based Login WordPress plugin before 2.4.1 does not sanitise values when importing, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8f1ceca5-3b7b-4cf0-bccd-03e204e5bfad/
CVE ID: CVE-2024-12801 State: PUBLISHED Published: 2024-12-19T16:11:50.044Z Last Updated: 2025-01-03T13:40:41.135Z Vendors: QOS.CH Sarl Products: logback Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML. The attacks involves the modification of DOCTYPE declaration in XML configuration files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://logback.qos.ch/news.html#1.5.13 - https://logback.qos.ch/news.html#1.3.15
CVE ID: CVE-2024-12802 State: PUBLISHED Published: 2025-01-09T09:08:26.012Z Last Updated: 2025-01-09T14:30:34.676Z Vendors: SonicWall Products: SonicOS Problem Types: CWE-305 Description: SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when integrated with Microsoft Active Directory, allowing MFA to be configured independently for each login method and potentially enabling attackers to bypass MFA by exploiting the alternative account name. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0001
CVE ID: CVE-2024-12803 State: PUBLISHED Published: 2025-01-09T07:21:53.799Z Last Updated: 2025-01-17T02:16:09.661Z Vendors: SonicWall Products: SonicOS Problem Types: CWE-121 Description: A post-authentication stack-based buffer overflow vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0004
CVE ID: CVE-2024-12804 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:36.703Z Description: No description available.
CVE ID: CVE-2024-12805 State: PUBLISHED Published: 2025-01-09T07:24:12.357Z Last Updated: 2025-01-17T02:15:26.594Z Vendors: SonicWall Products: SonicOS Problem Types: CWE-134 Description: A post-authentication format string vulnerability in SonicOS management allows a remote attacker to crash a firewall and potentially leads to code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0004
CVE ID: CVE-2024-12806 State: PUBLISHED Published: 2025-01-09T07:28:13.844Z Last Updated: 2025-01-17T02:17:43.603Z Vendors: SonicWall Products: SonicOS Problem Types: CWE-37 Description: A post-authentication absolute path traversal vulnerability in SonicOS management allows a remote attacker to read an arbitrary file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0004
CVE ID: CVE-2024-12807 State: PUBLISHED Published: 2025-01-28T06:00:11.412Z Last Updated: 2025-01-28T15:15:04.341Z Vendors: Unknown Products: Social Share Buttons for WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Social Share Buttons for WordPress plugin through 2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fcce0839-bb1d-4aa3-b236-ff5f5e9b6120/
CVE ID: CVE-2024-12808 State: PUBLISHED Published: 2025-05-15T20:06:57.291Z Last Updated: 2025-05-20T19:30:01.116Z Vendors: Unknown Products: WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA AD
when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f1f823f5-d0f1-45a5-85c2-60208d76366e/
CVE ID: CVE-2024-12809 State: PUBLISHED Published: 2025-03-07T06:40:03.042Z Last Updated: 2025-03-07T16:10:04.454Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pickplugins Products: Wishlist Problem Types: CWE-79 Description: The Wishlist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wishlist_button' shortcode in all versions up to, and including, 1.0.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an
tributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1b902d46-ff27-486f-836d-f55a8048f08c?source=cve - https://plugins.trac.wordpress.org/browser/wishlist/trunk/includes/classes/class-shortcodes.php?rev=3215801#L223 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3242533%40wishlist&new=3242533%40wishlist&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3251476%40wishlist&new=3251476%40wishlist&sfp_ema
ugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3251476%40wishlist&new=3251476%40wishlist&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12810 State: PUBLISHED Published: 2025-03-14T11:15:51.851Z Last Updated: 2025-03-14T12:51:15.259Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: JobCareer | Job Board Responsive WordPress Theme Problem Types: CWE-862 Description: The JobCareer | Job Board Responsive WordPress Theme theme for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability checks on multiple functions in all versions up to, and including, 7.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files, generate backups, restore backups, update the
ackers, with Subscriber-level access and above, to delete arbitrary files, generate backups, restore backups, update theme options, and reset theme options to default settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/24889552-0db6-44e6-9b12-f31b5e92a42e?source=cve - https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636
CVE ID: CVE-2024-12811 State: PUBLISHED Published: 2025-02-27T23:22:40.122Z Last Updated: 2025-02-28T14:24:04.275Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ShineTheme Products: Travel Booking WordPress Theme Problem Types: CWE-98 Description: The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via the 'hotel_alone_slider' shortcode 'style' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access cont
trary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a09298b3-3b5c-4a92-9332-79ff83234479?source=cve - https://travelerwp.com/traveler-changelog/
CVE ID: CVE-2024-12812 State: PUBLISHED Published: 2025-05-15T20:06:57.500Z Last Updated: 2025-08-27T12:00:29.663Z Vendors: Unknown Products: WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue where employees can manipulate parameters to access the data of terminated employees. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/757e76fd-830f-4d1c-8b89-dfad7c9c1f37/
CVE ID: CVE-2024-12813 State: PUBLISHED Published: 2025-02-18T04:21:14.151Z Last Updated: 2025-02-18T15:15:02.543Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pixelgrade Products: Open Hours – Easy Opening Hours Problem Types: CWE-79 Description: The Open Hours – Easy Opening Hours plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'open-hours-current-status' shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts i
akes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3feb5f46-e861-40ec-84e8-aade0667eec6?source=cve - https://wordpress.org/plugins/open-hours/
CVE ID: CVE-2024-12814 State: PUBLISHED Published: 2024-12-24T06:59:01.230Z Last Updated: 2024-12-24T16:31:51.829Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: aerin Products: Loan Comparison Problem Types: CWE-79 Description: The Loan Comparison plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'loancomparison' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d9d000ad-a8f1-44c8-8c11-4a1982e1e6e4?source=cve - https://plugins.trac.wordpress.org/changeset?old_path=/loan-comparison/tags/2.0&new_path=/loan-comparison/tags/2.0.1&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3212274%40loan-comparison&new=3212274%40loan-comparison&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12815 State: PUBLISHED Published: 2025-03-05T09:21:48.649Z Last Updated: 2025-03-05T14:19:37.230Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: zipang Products: Point Maker Problem Types: CWE-79 Description: The Point Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'point_maker' shortcode in all versions up to, and including, 0.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inje
utor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c4a46d4c-3f03-4d41-8382-b43a02b59cb2?source=cve - https://plugins.trac.wordpress.org/browser/point-maker/trunk/shortcode.php - https://wordpress.org/plugins/point-maker/
CVE ID: CVE-2024-12816 State: PUBLISHED Published: 2025-01-25T07:24:12.913Z Last Updated: 2025-01-27T14:54:23.984Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mastowkir Products: NOTICE BOARD BY TOWKIR Problem Types: CWE-79 Description: The NOTICE BOARD BY TOWKIR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'notice-board' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/069b2f3e-da9d-476c-a9fa-1b7d445a704b?source=cve - https://plugins.trac.wordpress.org/browser/notice-board-by-towkir/trunk/towkir-notice-board.php - https://wordpress.org/plugins/notice-board-by-towkir/
CVE ID: CVE-2024-12817 State: PUBLISHED Published: 2025-01-25T07:24:18.188Z Last Updated: 2025-01-27T14:53:08.826Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: coreymcollins Products: Etsy Importer Problem Types: CWE-79 Description: The Etsy Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'product_link' shortcode in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acce
with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b9d77b08-3a4a-441b-8725-fd93744de73c?source=cve - https://plugins.trac.wordpress.org/browser/etsy-importer/trunk/includes/shortcodes.php - https://wordpress.org/plugins/etsy-importer/
CVE ID: CVE-2024-12818 State: PUBLISHED Published: 2025-01-15T09:25:55.673Z Last Updated: 2025-01-15T15:03:25.539Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: robdavenport Products: WP Smart TV Problem Types: CWE-79 Description: The WP Smart TV plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tv-video-player' shortcode in all versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user access
th contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e1d7cf90-1a9f-4d88-9dfb-f48481095a0c?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3222468%40wp-smart-tv&new=3222468%40wp-smart-tv&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12819 State: PUBLISHED Published: 2025-01-09T11:11:02.195Z Last Updated: 2025-01-09T14:43:35.466Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: searchie Products: Searchie Problem Types: CWE-79 Description: The Searchie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sio_embed_media' shortcode in all versions up to, and including, 1.17.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inj
butor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8abed8c7-0c3f-4054-a116-82ce47d605de?source=cve - https://plugins.trac.wordpress.org/browser/searchie/trunk/SIO/Shortcodes/WidgetsEmbed.php - https://wordpress.org/plugins/searchie/
CVE ID: CVE-2024-12820 State: PUBLISHED Published: 2025-02-28T05:23:15.594Z Last Updated: 2025-02-28T14:57:03.724Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: manoj_rana91986 Products: MK Google Directions Problem Types: CWE-79 Description: The MK Google Directions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MKGD' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a use
kers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/23b3570c-cd8e-4dec-bbad-6374c44530bd?source=cve - https://plugins.trac.wordpress.org/changeset/3246361/google-distance-calculator/tags/3.1.1/mk-google-directions.php?old=3046209&old_path=google-distance-calculator%2Ftags%2F3.1%2Fmk-google-directions.php
CVE ID: CVE-2024-12821 State: PUBLISHED Published: 2025-01-30T13:42:02.900Z Last Updated: 2025-01-30T14:51:00.337Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: DeluxeThemes Products: Media Manager for UserPro Problem Types: CWE-862 Description: The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the upm_upload_media() function in all versions up to, and including, 3.12.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged
ckers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/89afc78b-efd5-445e-884f-2345e08df705?source=cve - https://codecanyon.net/item/media-manager-for-userpro/8664618