Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-8709 State: PUBLISHED Published: 2024-09-12T02:31:04.772Z Last Updated: 2024-09-12T13:16:24.385Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Best House Rental Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. Affected is the function delete_user/save_user of the file /admin_class.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:
as been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277218 - https://vuldb.com/?ctiid.277218 - https://vuldb.com/?submit.405594 - https://github.com/gaorenyusi/gaorenyusi/blob/main/rental1.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8710 State: PUBLISHED Published: 2024-09-12T03:00:05.685Z Last Updated: 2024-09-12T13:15:30.049Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Inventory Management Problem Types: CWE-89 Description: A vulnerability classified as critical was found in code-projects Inventory Management 1.0. Affected by this vulnerability is an unknown functionality of the file /model/viewProduct.php of the component Products Table Page. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277219 - https://vuldb.com/?ctiid.277219 - https://vuldb.com/?submit.404976 - https://github.com/ali0999109/Inventory-management/blob/main/Sql.md - https://code-projects.org/
CVE ID: CVE-2024-8711 State: PUBLISHED Published: 2024-09-12T03:31:04.967Z Last Updated: 2024-09-12T13:04:22.723Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SourceCodester Products: Food Ordering Management System Problem Types: CWE-548 Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Food Ordering Management System 1.0. Affected by this issue is some unknown functionality of the file /includes/. The manipulation leads to exposure of information through directory listing. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA A
y be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.277220 - https://vuldb.com/?ctiid.277220 - https://vuldb.com/?submit.405343 - https://github.com/jz-qb/cve/blob/main/dir.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8712 State: PUBLISHED Published: 2024-09-28T08:36:48.476Z Last Updated: 2024-09-30T15:46:03.092Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: gtmserver Products: GTM Server Side Problem Types: CWE-79 Description: The GTM Server Side plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.19. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: -
if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/28f77d5a-fc17-4e17-85b9-4e6f66dbf2c7?source=cve - https://plugins.trac.wordpress.org/browser/gtm-server-side/tags/2.1.19/templates/class-gtm-server-side-admin.php#L30 - https://plugins.trac.wordpress.org/changeset/3158847/gtm-server-side/tags/2.1.20/templates/class-gtm-server-side-admin.php
CVE ID: CVE-2024-8713 State: PUBLISHED Published: 2024-09-25T02:05:12.051Z Last Updated: 2024-09-25T13:40:05.154Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: pierre-lebedel Products: Kodex Posts likes Problem Types: CWE-79 Description: The Kodex Posts likes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst
execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/44780988-cadf-4ff2-9ba9-148b7b6650df?source=cve - https://plugins.trac.wordpress.org/browser/kodex-posts-likes/trunk/admin/partials/settings.php#L14
CVE ID: CVE-2024-8714 State: PUBLISHED Published: 2024-09-13T15:10:38.299Z Last Updated: 2024-09-13T15:33:39.934Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: iovamihai Products: WordPress Affiliates Plugin — SliceWP Affiliates Problem Types: CWE-79 Description: The WordPress Affiliates Plugin — SliceWP Affiliates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.1.20. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into perform
cated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/45dd22d4-9a51-4569-a756-1f1a5f8626c1?source=cve - https://plugins.trac.wordpress.org/changeset/3151062/ - https://plugins.trac.wordpress.org/browser/slicewp/tags/1.1.20/includes/admin/commissions/class-list-table-commissions.php#L544 - https://plugins.trac.wordpress.org/browser/slicewp/tags/1.1.20/includes/admin/visits/class-list-table-visits.php#L396 - https://plugins.trac.wordpress.org/browser/slicewp/tags/1.1
.20/includes/admin/visits/class-list-table-visits.php#L396 - https://plugins.trac.wordpress.org/browser/slicewp/tags/1.1.20/includes/admin/payouts/class-list-table-payments.php#L490
CVE ID: CVE-2024-8715 State: PUBLISHED Published: 2024-09-28T02:31:28.030Z Last Updated: 2024-09-28T17:38:06.076Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: clifgriffin Products: Simple LDAP Login Problem Types: CWE-79 Description: The Simple LDAP Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Not
ecute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cbaa95d4-899f-49a0-a888-4ffee61c0335?source=cve - https://plugins.trac.wordpress.org/changeset/3158322/ - https://plugins.trac.wordpress.org/browser/simple-ldap-login/tags/1.6.0/Simple-LDAP-Login-Admin.php#L15
CVE ID: CVE-2024-8716 State: PUBLISHED Published: 2024-09-24T01:56:46.440Z Last Updated: 2024-09-24T13:50:19.850Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: xplodedthemes Products: XT Ajax Add To Cart for WooCommerce Problem Types: CWE-79 Description: The XT Ajax Add To Cart for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clic
arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a003129b-4a31-40f8-a9b2-9d3a3286cabe?source=cve - https://plugins.trac.wordpress.org/changeset/3151911/xt-woo-ajax-add-to-cart/tags/1.1.3/xt-framework/includes/class-system-status.php - https://plugins.trac.wordpress.org/browser/xt-woo-ajax-add-to-cart/tags/1.1.2/xt-framework/includes/class-system-status.php#L786
CVE ID: CVE-2024-8717 State: PUBLISHED Published: 2024-10-24T08:32:22.265Z Last Updated: 2024-10-24T13:30:36.524Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: dearhive Products: Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer Problem Types: CWE-79 Description: The PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pdf_source' parameter in all versions up to, and including, 2.3.32 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they c
ng. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6d4c2944-28e8-4866-b4da-91cf12d9d115?source=cve - https://plugins.trac.wordpress.org/browser/3d-flipbook-dflip-lite/trunk/assets/js/dflip.min.js - https://plugins.trac.wordpress.org/changeset/3172275/
CVE ID: CVE-2024-8718 State: PUBLISHED Published: 2024-10-01T07:30:11.287Z Last Updated: 2024-10-01T14:01:52.365Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: daveshine Products: Gravity Forms Toolbar Problem Types: CWE-79 Description: The Gravity Forms Toolbar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Addit
in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4d1c6daf-1799-4f8a-81e3-ef3968f41b8e?source=cve - https://plugins.trac.wordpress.org/browser/gravity-forms-toolbar/tags/1.7.0/admin/form.php#L25 - https://plugins.trac.wordpress.org/browser/gravity-forms-toolbar/tags/1.7.0/admin/form.php#L44
CVE ID: CVE-2024-8719 State: PUBLISHED Published: 2024-10-17T03:32:50.462Z Last Updated: 2024-10-17T13:03:28.942Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: flexmls Products: Flexmls® IDX Plugin Problem Types: CWE-79 Description: The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters like 'MaxBeds' and 'MinBeds' in all versions up to, and including, 3.14.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as c
ct arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aac3fb8e-9b92-4ed1-ac9f-50870d4c5c9f?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3169439%40flexmls-idx&new=3169439%40flexmls-idx&sfp_email=&sfph_mail=
CVE ID: CVE-2024-8720 State: PUBLISHED Published: 2024-10-01T07:30:11.788Z Last Updated: 2024-10-01T13:56:34.799Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: rumbletalk Products: RumbleTalk Live Group Chat – HTML5 Problem Types: CWE-79 Description: The RumbleTalk Live Group Chat – HTML5 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rumbletalk-admin-button' shortcode in all versions up to, and including, 6.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web script
s makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4e620ae8-03fc-43b5-8e8f-5b0884e8eefb?source=cve - https://plugins.trac.wordpress.org/browser/rumbletalk-chat-a-chat-with-themes/trank/public/class-rumbletalk-public.php#L128
CVE ID: CVE-2024-8721 State: PUBLISHED Published: 2024-12-24T09:21:49.639Z Last Updated: 2024-12-24T15:22:31.896Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: data443 Products: Tracking Code Manager Problem Types: CWE-79 Description: The Tracking Code Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the tracking code field in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional
above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/443d2e80-31db-40ac-9c35-88eec841ebba?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3211908%40tracking-code-manager&new=3211908%40tracking-code-manager&sfp_email=&sfph_mail=
CVE ID: CVE-2024-8722 State: PUBLISHED Published: 2025-01-19T04:21:13.279Z Last Updated: 2025-01-21T15:13:44.043Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Soflyy Products: WP All Import Pro Problem Types: CWE-79 Description: The Import any XML or CSV File to WordPress PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Ad
l access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dbc6ad3f-698e-4dfd-bbba-086f94831bba?source=cve - https://www.wpallimport.com/downloads/wp-all-import-annual/?changelog=1
CVE ID: CVE-2024-8723 State: PUBLISHED Published: 2024-09-26T02:03:23.016Z Last Updated: 2024-09-26T14:57:16.876Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ouhinit Products: 012 Ps Multi Languages Problem Types: CWE-79 Description: The 012 Ps Multi Languages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via translated titles in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analy
, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/30a1517e-5ea5-47a1-afe8-9543e1ffd199?source=cve - https://plugins.svn.wordpress.org/012-ps-multi-languages/trunk/includes/ps-multilingual-edit-post.php
CVE ID: CVE-2024-8724 State: PUBLISHED Published: 2024-09-14T03:19:28.619Z Last Updated: 2024-09-15T19:56:48.766Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: xootix Products: Waitlist Woocommerce ( Back in stock notifier ) Problem Types: CWE-79 Description: The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.7.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an ac
ackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c298c87e-cf3c-4b72-bb0e-a01ca2dfe52f?source=cve - https://plugins.trac.wordpress.org/browser/waitlist-woocommerce/trunk/admin/templates/xoo-wl-import-form.php#L8 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3151186%40waitlist-woocommerce&new=3151186%40waitlist-woocommerce&sfp_email=&sfph_mail=
CVE ID: CVE-2024-8725 State: PUBLISHED Published: 2024-09-26T10:59:34.321Z Last Updated: 2024-09-26T13:01:50.554Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: modalweb Products: Advanced File Manager Problem Types: CWE-434 Description: Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions. This is due to a lack of proper checks to ensure lower-privileged roles cannot upload .css and .js files to arbitrary directories. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files to any directory within th
l access and above, and granted permissions by an administrator, to upload .css and .js files to any directory within the WordPress root directory, which could lead to Stored Cross-Site Scripting. The Advanced File Manager Shortcodes plugin must be installed to exploit this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ce2b4f93-93a6-480f-a877-ca47bd133bb6?source=cve - https://plugins.trac.wordpress.org/browser/file-manager-advanced/trunk/application/class_fma_main.php#L24 - https://plugins.trac.wordpress.org/browser/file-manager-advanced/trunk/application/class_fma_shortcode.php#L28 - https://plugins.
lugins.trac.wordpress.org/browser/file-manager-advanced/trunk/application/class_fma_shortcode.php#L28 - https://plugins.trac.wordpress.org/changeset/3157713/
CVE ID: CVE-2024-8726 State: PUBLISHED Published: 2024-11-20T06:42:54.917Z Last Updated: 2024-11-20T15:16:27.322Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: mailmunch Products: MailChimp Forms by MailMunch Problem Types: CWE-79 Description: The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Ad
pts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a1a1c5e7-75a4-4ca5-9707-4076b92e0c33?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3189361%40mailchimp-forms-by-mailmunch&new=3189361%40mailchimp-forms-by-mailmunch&sfp_email=&sfph_mail=
CVE ID: CVE-2024-8727 State: PUBLISHED Published: 2024-10-01T07:30:16.877Z Last Updated: 2024-10-01T13:39:34.005Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: torstenbulk Products: DK PDF Problem Types: CWE-79 Description: The DK PDF plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.9.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnric
essfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d71cdd64-7cd6-4b1a-ae8d-e9bf78e630c7?source=cve - https://plugins.trac.wordpress.org/browser/dk-pdf/trunk/includes/class-dkpdf-settings.php#L420
CVE ID: CVE-2024-8728 State: PUBLISHED Published: 2024-10-01T07:30:17.383Z Last Updated: 2024-10-01T15:33:00.291Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: brianbrey Products: Easy Load More Problem Types: CWE-79 Description: The Easy Load More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CI
they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d890e7a5-ea9f-40e5-9549-a6f26421b043?source=cve - https://plugins.trac.wordpress.org/browser/easy-load-more/trunk/includes/class-easy-load-more-settings.php#L268
CVE ID: CVE-2024-8729 State: PUBLISHED Published: 2024-10-10T02:06:10.990Z Last Updated: 2024-10-10T13:11:58.678Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: brianbrey Products: Easy Social Share Buttons Problem Types: CWE-79 Description: The Easy Social Share Buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.4.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Addition