Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12149 State: PUBLISHED Published: 2024-12-04T17:18:01.565Z Last Updated: 2024-12-05T18:46:29.926Z Vendors: Devolutions Products: Remote Desktop Manager Problem Types: CWE-732 Description: Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authenticated user that request temporary permissions on an entry to obtain more privileges than requested. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2024-0017
CVE ID: CVE-2024-12150 State: PUBLISHED Published: 2025-06-27T16:40:47.711Z Last Updated: 2025-09-23T07:39:29.018Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Eron Software Products: Wowwo CRM Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eron Software Wowwo CRM allows Blind SQL Injection.This issue affects Wowwo CRM. NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.g
n new information becomes available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0141
CVE ID: CVE-2024-12151 State: PUBLISHED Published: 2024-12-04T17:17:31.712Z Last Updated: 2024-12-05T18:48:20.286Z Vendors: Devolutions Products: Server Problem Types: CWE-732 Description: Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2024-0017
CVE ID: CVE-2024-12152 State: PUBLISHED Published: 2025-01-07T09:22:15.610Z Last Updated: 2025-01-07T16:11:24.559Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: mulika Products: MIPL WC Multisite Sync – Synchronize WC Products, Orders, Customers & Coupons across multiple sites Problem Types: CWE-22 Description: The MIPL WC Multisite Sync plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.5 via the 'mipl_wc_sync_download_log' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CIS
the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/575d1e24-d23d-4589-bb71-f52efec1ac58?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3216574%40mipl-wc-multisite-sync&new=3216574%40mipl-wc-multisite-sync&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3215735%40mipl-wc-multisite-sync&new=3215735%40mipl-wc-multisite-sync&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12153 State: PUBLISHED Published: 2025-01-07T04:22:16.140Z Last Updated: 2025-01-07T16:21:32.460Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: grandy Products: GDY Modular Content Problem Types: CWE-79 Description: The GDY Modular Content plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 0.9.91. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst No
xecute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8f854737-e87b-4c50-a9fb-d3b129f9d9fc?source=cve - https://plugins.trac.wordpress.org/browser/gdy-modular-content/trunk/includes/elements.php#L16
CVE ID: CVE-2024-12154 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:35.790Z Description: No description available.
CVE ID: CVE-2024-12155 State: PUBLISHED Published: 2024-12-06T08:24:57.390Z Last Updated: 2024-12-06T17:14:38.060Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: matthias-reuter Products: SV100 Companion Problem Types: CWE-862 Description: The SV100 Companion plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the settings_import() function in all versions up to, and including, 2.0.02. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to admini
ate arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c244eb33-acaf-460b-ae1d-6688b21cc60f?source=cve - https://plugins.trac.wordpress.org/browser/sv100-companion/trunk/lib/modules/sv_settings/sv_settings.php#L47
CVE ID: CVE-2024-12156 State: PUBLISHED Published: 2024-12-12T04:23:14.700Z Last Updated: 2024-12-12T15:46:53.340Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: quantumcloud Products: AI Content Writer, RSS Feed to Post, Autoblogging SEO Help Problem Types: CWE-79 Description: The AI Content Writer, RSS Feed to Post, Autoblogging SEO Help plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 6.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succes
makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d5111215-7ce9-46e3-b247-c3f0f28ec094?source=cve - https://plugins.trac.wordpress.org/browser/seo-help/trunk/inc/scan-list-scan-table-header-results.php#L102 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3204821%40seo-help&new=3204821%40seo-help&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12157 State: PUBLISHED Published: 2025-01-07T04:21:58.312Z Last Updated: 2025-01-07T16:24:42.599Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: arrowplugins Products: Popup – MailChimp, GetResponse and ActiveCampaign Intergrations Problem Types: CWE-89 Description: The Popup – MailChimp, GetResponse and ActiveCampaign Intergrations plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'upc_delete_db_record' AJAX action in all versions up to, and including, 3.2.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unaut
e user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3e63ce97-40af-493d-9376-231a99d9bd58?source=cve - https://wordpress.org/plugins/ultimate-popup-creator/
CVE ID: CVE-2024-12158 State: PUBLISHED Published: 2025-01-07T04:22:16.501Z Last Updated: 2025-01-07T16:21:20.622Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: arrowplugins Products: Popup – MailChimp, GetResponse and ActiveCampaign Intergrations Problem Types: CWE-862 Description: The Popup – MailChimp, GetResponse and ActiveCampaign Intergrations plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'upc_delete_db_data' AJAX action in all versions up to, and including, 3.2.6. This makes it possible for unauthenticated attackers to delete the DB data for the plugin. Additional Analyst Notes: - CISA ADP V
s it possible for unauthenticated attackers to delete the DB data for the plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/93a698df-fd68-4fbc-946e-a9b5a7f93b71?source=cve - https://wordpress.org/plugins/ultimate-popup-creator/
CVE ID: CVE-2024-12159 State: PUBLISHED Published: 2025-01-07T04:22:19.794Z Last Updated: 2025-01-07T16:19:30.253Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: muzaara Products: Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords Problem Types: CWE-200 Description: The Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.1 due to the print_php_information.php being publicly accessible. This makes it possible for unauthenticated attackers to extract sensitive configuration data that can be leveraged in another attack. Ad
ssible for unauthenticated attackers to extract sensitive configuration data that can be leveraged in another attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cfeca343-c796-45d5-a71d-8211d8b38b3e?source=cve - https://plugins.trac.wordpress.org/browser/muzaara-adwords-optimize-dashboard/trunk/lib/muzaara/lib/google-ads-php/scripts/print_php_information.php
CVE ID: CVE-2024-12160 State: PUBLISHED Published: 2024-12-12T08:22:35.285Z Last Updated: 2024-12-12T15:45:24.300Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: seraphinitesoft Products: Seraphinite Bulk Discounts for WooCommerce Problem Types: CWE-79 Description: The Seraphinite Bulk Discounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an ac
ackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bd748b6c-110a-46b6-a609-64d093dfc3e5?source=cve - https://plugins.trac.wordpress.org/browser/seraphinite-discount-for-woocommerce/trunk/Cmn/Plugin.php#L1060 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3206551%40seraphinite-discount-for-woocommerce&new=3206551%40seraphinite-discount-for-woocommerce&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12161 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:09.565Z Description: No description available.
CVE ID: CVE-2024-12162 State: PUBLISHED Published: 2024-12-12T04:23:14.349Z Last Updated: 2024-12-12T15:47:02.657Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: suiteplugins Products: Video & Photo Gallery for Ultimate Member Problem Types: CWE-79 Description: The Video & Photo Gallery for Ultimate Member plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performin
ted attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b588b8d0-5d71-4e95-ad97-821e47b013c8?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3204552%40gallery-for-ultimate-member&new=3204552%40gallery-for-ultimate-member&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset/3204552/#file8
CVE ID: CVE-2024-12163 State: PUBLISHED Published: 2025-01-30T06:00:08.044Z Last Updated: 2025-01-30T15:56:20.975Z Vendors: Unknown Products: goodlayers-core Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The goodlayers-core WordPress plugin before 2.1.3 allows users with a subscriber role and above to upload SVGs containing malicious payloads. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ea704054-fb66-4014-89bd-1c61074f64e5/
CVE ID: CVE-2024-12164 State: PUBLISHED Published: 2025-02-12T04:22:14.942Z Last Updated: 2025-02-12T14:51:55.561Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: creativewerkdesigns Products: WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon Problem Types: CWE-862 Description: The WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsslwp_reset_settings() function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's
, 1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/83bd48fb-f5f9-4d3d-8fc4-a06adfa5a225?source=cve - https://plugins.trac.wordpress.org/browser/wpsyncsheets-wpforms/tags/1.5/includes/class-wpsslwp-service.php#L92 - https://plugins.trac.wordpress.org/browser/wpsyncsheets-wpforms/tags/1.5/includes/class-wpsslwp-service.php#L779 - https://plugins.trac.wordpress.org/changeset/3234445/wpsyncsheets-wpforms/tags/1.6.1/includes/class-wpsslwp-service.php?old=3232281&old_path=wpsyncsheets-wpforms%2Ftag
34445/wpsyncsheets-wpforms/tags/1.6.1/includes/class-wpsslwp-service.php?old=3232281&old_path=wpsyncsheets-wpforms%2Ftags%2F1.6%2Fincludes%2Fclass-wpsslwp-service.php
CVE ID: CVE-2024-12165 State: PUBLISHED Published: 2024-12-07T01:45:51.957Z Last Updated: 2024-12-09T18:03:03.521Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: tsjippy Products: Mollie for Contact Form 7 Problem Types: CWE-79 Description: The Mollie for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a lin
scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a21b3a-a60f-4083-a474-ec9fedd9b8cb?source=cve - https://plugins.trac.wordpress.org/browser/cf7-mollie/trunk/includes/php/admin_menu.php#L164
CVE ID: CVE-2024-12166 State: PUBLISHED Published: 2024-12-07T01:45:50.083Z Last Updated: 2024-12-09T18:03:57.609Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: cmorillas1 Products: Shortcodes Blocks Creator Ultimate Problem Types: CWE-79 Description: The Shortcodes Blocks Creator Ultimate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such
inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6ece9b6d-6802-44b9-9ead-1563286f4ff3?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-shortcodes-creator/trunk/admin/class-shortcode-list-table.php#L83
CVE ID: CVE-2024-12167 State: PUBLISHED Published: 2024-12-07T01:45:52.314Z Last Updated: 2024-12-09T18:02:53.164Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: cmorillas1 Products: Shortcodes Blocks Creator Ultimate Problem Types: CWE-79 Description: The Shortcodes Blocks Creator Ultimate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wpnonce' parameter in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action
s to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/db6ccadb-5e90-4234-88cc-28241846acea?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-shortcodes-creator/trunk/admin/class-admin.php#L111
CVE ID: CVE-2024-12168 State: PUBLISHED Published: 2025-06-02T12:44:31.161Z Last Updated: 2025-06-02T13:04:26.267Z Vendors: Yandex Products: Telemost Problem Types: CWE-426 Description: Yandex Telemost for Desktop before 2.7.0 has a DLL Hijacking Vulnerability because an untrusted search path is used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://yandex.com/bugbounty/i/hall-of-fame-products
CVE ID: CVE-2024-12169 State: PUBLISHED Published: 2025-03-25T12:36:02.457Z Last Updated: 2025-03-25T13:11:20.584Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Hitachi Energy Products: RTU500 Problem Types: CWE:410 Insufficient Resource Pool Description: A vulnerability exists in RTU500 IEC 60870-5-104 controlled station functionality and IEC 61850 functionality, that allows an attacker performing a specific attack sequence to restart the affected CMU. This vulnerability only applies, if secure communication using IEC 62351-3 (TLS) is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?Docu
abled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000207&languageCode=en&Preview=true
CVE ID: CVE-2024-12170 State: PUBLISHED Published: 2025-01-07T04:22:00.143Z Last Updated: 2025-01-07T16:23:35.566Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: swarminteractive Products: ViewMedica 9 Problem Types: CWE-352 Description: The ViewMedica 9 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.15. This is due to missing or incorrect nonce validation on the 'Viewmedica-Admin' page. This makes it possible for unauthenticated attackers to inject arbitrary SQL queries via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional
ged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/58209530-9e68-4d2c-a723-e6a164db7f46?source=cve - https://wordpress.org/plugins/viewmedica/
CVE ID: CVE-2024-12171 State: PUBLISHED Published: 2025-02-01T03:21:13.218Z Last Updated: 2025-02-03T16:38:13.298Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: elextensions Products: ELEX WordPress HelpDesk & Customer Ticketing System Problem Types: CWE-862 Description: The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'eh_crm_agent_add_user' AJAX action in all versions up to, and including, 3.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new administrative user accounts. Additional Analyst No
ted attackers, with Subscriber-level access and above, to create new administrative user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cbcd978b-e81f-4c39-b2f7-adc948d21b1b?source=cve - https://plugins.trac.wordpress.org/changeset/3227859/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-ajax-functions-one.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3213791%40elex-helpdesk-customer-support-ticket-system&new=3213791%40elex-helpdesk-customer-support-ticket-system&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12172 State: PUBLISHED Published: 2024-12-12T05:24:21.551Z Last Updated: 2024-12-12T14:50:35.267Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: hookandhook Products: WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses Problem Types: CWE-862 Description: The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpc_update_user_meta_option() function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with Subscriber
nction in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary user's metadata which can be levereged to block an administrator from accessing their site when wp_capabilities is set to 0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/760e999e-cac9-493f-9737-ad0cf055c880?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3203679%40wp-courses&new=3203679%40wp-courses&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12173 State: PUBLISHED Published: 2025-02-19T06:00:03.134Z Last Updated: 2025-02-21T16:28:26.070Z Vendors: Unknown Products: Master Slider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Master Slider WordPress plugin before 3.10.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0f35be0e-0f63-4e33-aa4d-c47b1f1e0595/