Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
lls by submitting specially crafted XML data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/c4a0fac9-0c5a-4718-9ee4-2d06d58adabb - https://github.com/scrapy/scrapy/commit/809bfac4890f75fc73607318a04d2ccba71b3d9f
CVE ID: CVE-2024-3573 State: PUBLISHED Published: 2024-04-16T00:00:14.753Z Last Updated: 2024-08-01T20:12:07.901Z Severity: CRITICAL (CVSS 9.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: mlflow Products: mlflow/mlflow Problem Types: CWE-29 Description: mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'is_local_uri' function's failure to properly handle URIs with empty or 'file' schemes, leading to the misclassification of URIs as non-local. Attackers can exploit this by crafting malicious model versions with specially crafted 'source' para
URIs as non-local. Attackers can exploit this by crafting malicious model versions with specially crafted 'source' parameters, enabling the reading of sensitive files within at least two directory levels from the server's root. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/8ea058a7-4ef8-4baf-9198-bc0147fc543c - https://github.com/mlflow/mlflow/commit/438a450714a3ca06285eeea34bdc6cf79d7f6cbc
CVE ID: CVE-2024-3574 State: PUBLISHED Published: 2024-04-16T00:00:15.109Z Last Updated: 2024-08-01T20:12:08.239Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: scrapy Products: scrapy/scrapy Problem Types: CWE-200 Description: In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authorization header when redirecting across domains. The exposure of the Authorization header to unauthorized actors could potentially allow for account hijacking. Additional Analyst No
of the Authorization header to unauthorized actors could potentially allow for account hijacking. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/49974321-2718-43e3-a152-62b16eed72a9 - https://github.com/scrapy/scrapy/commit/5bcb8fd5019c72d05c4a96da78a7fcb6ecb55b75
CVE ID: CVE-2024-3575 State: PUBLISHED Published: 2024-04-16T00:00:13.688Z Last Updated: 2024-08-01T20:12:07.856Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: mindsdb Products: mindsdb/mindsdb Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in mindsdb/mindsdb Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/5f720b48-ddeb-4f2a-830f-a3dd15d5daa2
CVE ID: CVE-2024-3576 State: PUBLISHED Published: 2024-05-06T12:04:47.826Z Last Updated: 2024-08-01T20:12:07.894Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Moxa Products: NPort 5100A Series Problem Types: CWE-79 Description: The NPort 5100A Series firmware version v1.6 and prior versions are affected by web server XSS vulnerability. The vulnerability is caused by not correctly neutralizing user-controllable input before placing it in output. Malicious users may use the vulnerability to get sensitive information and escalate privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.moxa.com/en/suppor
Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.moxa.com/en/support/product-support/security-advisory/mpsa-246328-nport-5100a-series-store-xss-vulnerability
CVE ID: CVE-2024-3579 State: PUBLISHED Published: 2024-05-14T08:51:53.437Z Last Updated: 2024-08-01T20:12:07.901Z Vendors: Puneeth Reddy Products: Online Shopping System Advanced Problem Types: CWE-79 Description: Open-source project Online Shopping System Advanced is vulnerable to Reflected Cross-Site Scripting (XSS). An attacker might trick somebody into using a crafted URL, which will cause a script to be run in user's browser. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert.pl/en/posts/2024/05/CVE-2024-3579 - https://cert.pl/posts/2024/05/CVE-2024-3579
CVE ID: CVE-2024-3580 State: PUBLISHED Published: 2024-05-17T06:00:02.530Z Last Updated: 2024-11-07T16:50:58.386Z Vendors: Unknown Products: Popup4Phone Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/31f401c4-735a-4efb-b81f-ab98c00c526b/
CVE ID: CVE-2024-3581 State: PUBLISHED Published: 2024-05-02T16:51:42.646Z Last Updated: 2024-08-01T20:12:07.903Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: maxfoundry Products: MaxGalleria Problem Types: CWE-862 Missing Authorization Description: The MaxGalleria plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the add_media_library_images_to_gallery function in all versions up to, and including, 6.4.2. This makes it possible for authenticated attackers, with subscriber access or above, to upload arbitrary images to a gallery. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container:
e, to upload arbitrary images to a gallery. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0629798c-ede2-43ac-9ec4-2cd99cd34ae2?source=cve - https://plugins.trac.wordpress.org/browser/maxgalleria/trunk/maxgalleria-image-gallery.php#L95 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3070919%40maxgalleria%2Ftrunk&old=3059014%40maxgalleria%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3582 State: PUBLISHED Published: 2024-05-09T06:00:02.529Z Last Updated: 2025-03-28T23:44:31.413Z Vendors: Unknown Products: UnGallery Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The UnGallery WordPress plugin through 2.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/5a348b5d-13aa-40c3-9d21-0554683f8019/
CVE ID: CVE-2024-3583 State: PUBLISHED Published: 2024-05-30T10:59:28.911Z Last Updated: 2024-08-01T20:12:08.160Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: fornyhucker Products: Simple Like Page Plugin Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and abo
g on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/070f6820-e70c-4325-b5cb-d2010da34dce?source=cve - https://plugins.trac.wordpress.org/changeset/3092346/simple-facebook-plugin/trunk?contextall=1&old=3051436&old_path=%2Fsimple-facebook-plugin%2Ftrunk
CVE ID: CVE-2024-3584 State: PUBLISHED Published: 2024-05-30T12:33:21.326Z Last Updated: 2024-08-01T20:12:07.892Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: qdrant Products: qdrant/qdrant Problem Types: CWE-20 Description: qdrant/qdrant version 1.9.0-dev is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint. By manipulating the `name` parameter through URL encoding, an attacker can upload a file to an arbitrary location on the system, such as `/root/poc.txt`. This vulnerability allows for the writing and overwriting of arbitrary files on the server, potentially leading to a full takeove
erability allows for the writing and overwriting of arbitrary files on the server, potentially leading to a full takeover of the system. The issue is fixed in version 1.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/5c7c82e2-4873-40b7-a5f3-0f4a42642f73 - https://github.com/qdrant/qdrant/commit/15479a45ffa3b955485ae516696f7e933a8cce8a
CVE ID: CVE-2024-3585 State: PUBLISHED Published: 2024-05-02T16:51:43.101Z Last Updated: 2024-08-01T20:12:07.928Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: florent73 Products: Send PDF for Contact Form 7 Problem Types: CWE-862 Missing Authorization Description: The Send PDF for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of form submissions due to a missing capability check on the hooks function in all versions up to, and including, 1.0.2.3. This makes it possible for unauthenticated attackers to download information about contact form entries with PDFs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Conta
information about contact form entries with PDFs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0646fcba-afe5-49a2-acd5-e15d009926c4?source=cve - https://plugins.trac.wordpress.org/browser/send-pdf-for-contact-form-7/trunk/classes/send-pdf.php#L56 - https://plugins.trac.wordpress.org/changeset/3074631/send-pdf-for-contact-form-7/trunk?contextall=1&old=3069882&old_path=%2Fsend-pdf-for-contact-form-7%2Ftrunk
CVE ID: CVE-2024-3587 State: PUBLISHED Published: 2024-07-16T08:32:31.862Z Last Updated: 2024-08-01T20:12:07.927Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: averta Products: Premium Portfolio Features for Phlox theme Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Portfolios Widget in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate
insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ea041b-f09d-4c62-aada-26afbc60b6f2?source=cve - https://plugins.trac.wordpress.org/browser/auxin-portfolio/tags/2.3.2/public/templates/elements/recent-portfolio.php#L179 - https://plugins.trac.wordpress.org/changeset/3115537/auxin-portfolio/trunk/public/templates/elements/r
tfolio.php#L179 - https://plugins.trac.wordpress.org/changeset/3115537/auxin-portfolio/trunk/public/templates/elements/recent-portfolio.php
CVE ID: CVE-2024-3588 State: PUBLISHED Published: 2024-05-02T16:52:36.257Z Last Updated: 2024-08-01T20:12:07.863Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jetmonsters Products: Getwid – Gutenberg Blocks Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown block in all versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level
output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c4770184-1b96-490c-b506-f648ab3ed764?source=cve - https://plugins.trac.wordpress.org/browser/getwid/trunk/assets/blocks/counter/frontend.js - https://github.com/motopress/getwid/pull/123/files#diff-042442d51783880aea585ad052aae32346491ed600f83b950955084a96a6e030 - https://plugins.trac.wordpress.org/changeset?sf
#diff-042442d51783880aea585ad052aae32346491ed600f83b950955084a96a6e030 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3077603%40getwid&new=3077603%40getwid&sfp_email=&sfph_mail=#file7
CVE ID: CVE-2024-3590 State: PUBLISHED Published: 2024-05-09T06:00:02.736Z Last Updated: 2024-08-21T20:51:24.611Z Vendors: Unknown Products: LetterPress Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The LetterPress WordPress plugin through 1.2.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as delete arbitrary subscribers Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/829f4d40-e5b0-4009-b753-85ca2a5b3d25/
CVE ID: CVE-2024-3591 State: PUBLISHED Published: 2024-05-01T06:00:02.438Z Last Updated: 2024-08-01T20:12:07.872Z Vendors: Unknown Products: Geo Controller Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/f85d8b61-eaeb-433c-b857-06ee4db5c7d5/
CVE ID: CVE-2024-3592 State: PUBLISHED Published: 2024-06-07T05:33:47.004Z Last Updated: 2024-08-01T20:12:08.048Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: expresstech Products: Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'question_id' parameter in all versions up to, and including, 9.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on
, and including, 9.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fc085413-db43-43e3-9b60-aeb341eed4e1?source=cve - https://plugins.trac.wordpress.org/changeset/3097878/quiz-master-next/trunk/php/admin/options-page-questions-tab.php
CVE ID: CVE-2024-3593 State: PUBLISHED Published: 2024-06-22T05:47:56.767Z Last Updated: 2024-08-01T20:12:07.928Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L) Vendors: SevenSpark Products: UberMenu Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The UberMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.3. This is due to missing or incorrect nonce validation on the ubermenu_delete_all_item_settings and ubermenu_reset_settings functions. This makes it possible for unauthenticated attackers to delete and reset the plugin's settings via a forged request granted they can trick a site admi
uthenticated attackers to delete and reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/621ef583-bf99-4b81-ae9c-b4f1c86b86aa?source=cve - https://codecanyon.net/item/ubermenu-wordpress-mega-menu-plugin/154703
CVE ID: CVE-2024-3594 State: PUBLISHED Published: 2024-05-23T06:00:02.724Z Last Updated: 2025-03-20T19:05:26.924Z Vendors: Unknown Products: IDonate Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The IDonate WordPress plugin through 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/7a8a834a-e5d7-4678-9d35-4390d1200437/
CVE ID: CVE-2024-3595 State: PUBLISHED Published: 2024-05-09T20:03:28.614Z Last Updated: 2024-08-01T20:12:07.782Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pure-chat Products: Pure Chat – Live Chat Plugin & More! Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Pure Chat – Live Chat Plugin & More! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the purechatwid and purechatwname parameter in all versions up to, and including, 2.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber access o
ent input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5d03c798-dc77-407c-8674-d0bd2f1ada8c?source=cve - https://wordpress.org/plugins/pure-chat/
CVE ID: CVE-2024-3596 State: PUBLISHED Published: 2024-07-09T12:02:53.001Z Last Updated: 2025-11-04T17:20:52.225Z Vendors: IETF Products: RFC Problem Types: CWE-328: Use of Weak Hash, CWE-200 Exposure of Sensitive Information to an Unauthorized Actor, CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel Description: RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Pro
lision attack against MD5 Response Authenticator signature. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://datatracker.ietf.org/doc/html/rfc2865 - https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/ - https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf - https://www.blastradius.fail/ - http://www.openwall.com/lists/oss-security/2024/07/09/4 - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014 - https://cert-portal.siemens.com/productcert/html/ssa-794185.html - https://cert-portal.siemens.com/productcert/html/ssa-723487.html
CVE ID: CVE-2024-3597 State: PUBLISHED Published: 2024-06-20T02:08:23.945Z Last Updated: 2024-08-09T18:47:05.540Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: recorp Products: Export WP Page to Static HTML/CSS Problem Types: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') Description: The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.2.2. This is due to insufficient validation on the redirect url supplied via the rc_exported_zip_file parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successful
makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/598e2c2e-7dd5-435e-a366-6c7569243f2a?source=cve - https://plugins.trac.wordpress.org/browser/export-wp-page-to-static-html/trunk/admin/class-export-wp-page-to-static-html-admin.php#L1289
CVE ID: CVE-2024-3598 State: PUBLISHED Published: 2024-04-19T01:57:10.415Z Last Updated: 2024-08-01T20:12:08.016Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpmet Products: ElementsKit Pro Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Creative Button widget in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, t
user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a9e4b14f-0f55-47bc-8e40-19b262e50561?source=cve - https://wpmet.com/plugin/elementskit/
CVE ID: CVE-2024-3599 State: PUBLISHED Published: 2024-05-02T16:52:03.427Z Last Updated: 2024-08-01T20:12:08.159Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: wpeka-club Products: WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) Problem Types: CWE-862 Missing Authorization Description: The WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the gdpr_policy_process_delete() function in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to delete arbitrary posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
sible for unauthenticated attackers to delete arbitrary posts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4b9abbf1-d9f5-4406-9d0c-bc2f9891d0e8?source=cve - https://plugins.trac.wordpress.org/changeset/3071278/gdpr-cookie-consent/tags/3.1.0/admin/class-gdpr-cookie-consent-admin.php