Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-4554 State: PUBLISHED Published: 2024-08-28T06:27:31.937Z Last Updated: 2025-10-06T13:30:05.388Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: OpenText Products: Access Manager Problem Types: CWE-79 Description: Improper Input Validation vulnerability in OpenText NetIQ Access Manager leads to Cross-Site Scripting (XSS) attack. This issue affects Access Manager before 5.0.4.1 and 5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.microfocus.com/documentation/access-manager/5.0/accessmanager504-p1-release-notes/accessmanager504-p1-release-notes.html - https://www.microfocus.com/documentation/access-manager/5.1/ac
p1-release-notes/accessmanager504-p1-release-notes.html - https://www.microfocus.com/documentation/access-manager/5.1/accessmanager51-release-notes/accessmanager51-release-notes.html
CVE ID: CVE-2024-4555 State: PUBLISHED Published: 2024-08-28T06:27:21.348Z Last Updated: 2025-10-06T13:30:22.423Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: OpenText Products: NetIQ Access Manager Problem Types: CWE-266 Description: Improper Privilege Management vulnerability in OpenText NetIQ Access Manager allows user account impersonation in specific scenario. This issue affects NetIQ Access Manager before 5.0.4.1 and before 5.1 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.microfocus.com/documentation/access-manager/5.0/accessmanager504-p1-release-notes/accessmanager504-p1-release-notes.html - https://www.microfocus.com/
ccess-manager/5.0/accessmanager504-p1-release-notes/accessmanager504-p1-release-notes.html - https://www.microfocus.com/documentation/access-manager/5.1/accessmanager51-release-notes/accessmanager51-release-notes.html
CVE ID: CVE-2024-4556 State: PUBLISHED Published: 2024-08-28T06:27:07.990Z Last Updated: 2024-08-28T13:27:43.754Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: OpenText Products: NetIQ Access Manager Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText NetIQ Access Manager allows access the sensitive information. This issue affects NetIQ Access Manager before 5.0.4 and before 5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.microfocus.com/documentation/access-manager/5.0/accessmanager504-p1-release-notes/accessmanager504-p1-release-notes.
www.microfocus.com/documentation/access-manager/5.0/accessmanager504-p1-release-notes/accessmanager504-p1-release-notes.html - https://www.microfocus.com/documentation/access-manager/5.1/accessmanager51-release-notes/accessmanager51-release-notes.html
CVE ID: CVE-2024-4557 State: PUBLISHED Published: 2024-06-26T23:31:10.425Z Last Updated: 2024-08-29T15:04:58.095Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-400 Description: Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1 which allowed an attacker to cause resource exhaustion via banzai pipeline. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/460517 - https://h
DP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/460517 - https://hackerone.com/reports/2485172
CVE ID: CVE-2024-4558 State: PUBLISHED Published: 2024-05-07T19:02:22.673Z Last Updated: 2025-11-04T17:26:57.915Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_7.html - https://issues.chromium.org/issues/337766133 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message
um.org/issues/337766133 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FAWEKDQTHPN7NFEMLIWP7YMIZ2DHF36N/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BWFSZNNWSQYDRYKNLBDGEXXKMBXDYQ3F/ - http://seclists.org
g/archives/list/package-announce@lists.fedoraproject.org/message/BWFSZNNWSQYDRYKNLBDGEXXKMBXDYQ3F/ - http://seclists.org/fulldisclosure/2024/Jul/16 - http://seclists.org/fulldisclosure/2024/Jul/15 - http://seclists.org/fulldisclosure/2024/Jul/18
CVE ID: CVE-2024-4559 State: PUBLISHED Published: 2024-05-07T19:02:22.953Z Last Updated: 2025-02-13T17:53:36.407Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in WebAudio in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_7.html - https://issues.chromium.org/issues/331369797 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproj
//issues.chromium.org/issues/331369797 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
CVE ID: CVE-2024-4560 State: PUBLISHED Published: 2024-05-11T05:38:41.626Z Last Updated: 2024-08-01T20:47:41.085Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: kognetiks Products: Kognetiks Chatbot for WordPress Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the chatbot_chatgpt_upload_file_to_assistant function in all versions up to, and including, 1.9.9. This makes it possible for unauthenticated attackers, with to upload arbitrary files on the affected site's server which may make r
it possible for unauthenticated attackers, with to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7bc33a05-d462-492e-9ea5-cf37b887cc94?source=cve - https://plugins.trac.wordpress.org/browser/chatbot-chatgpt/trunk/includes/utilities/chatbot-file-upload.php#L17
CVE ID: CVE-2024-4561 State: PUBLISHED Published: 2024-05-14T20:35:17.382Z Last Updated: 2024-08-01T20:47:41.190Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-918 Description: In WhatsUp Gold versions released before 2023.1.2 , a blind SSRF vulnerability exists in Whatsup Gold's FaviconController that allows an attacker to send arbitrary HTTP requests on behalf of the vulnerable server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/Announcing-WhatsUp-Gold-
ences: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/Announcing-WhatsUp-Gold-v2023-1-2
CVE ID: CVE-2024-4562 State: PUBLISHED Published: 2024-05-14T20:36:46.905Z Last Updated: 2024-08-01T20:47:41.116Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Progress Software Corporation Products: WhatsUp Gold Problem Types: CWE-918 Description: In WhatsUp Gold versions released before 2023.1.2 , an SSRF vulnerability exists in Whatsup Gold's Issue exists in the HTTP Monitoring functionality. Due to the lack of proper authorization, any authenticated user can access the HTTP monitoring functionality, what leads to the Server Side Request Forgery. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.progre
st Forgery. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.progress.com/network-monitoring - https://community.progress.com/s/article/Announcing-WhatsUp-Gold-v2023-1-2
CVE ID: CVE-2024-4563 State: PUBLISHED Published: 2024-05-22T17:01:00.943Z Last Updated: 2024-08-01T20:47:41.067Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: Progress Software Corporation Products: MOVEit Automation Problem Types: CWE-327 Description: The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.progress.com/moveit - https://community.progress.com/s/article/MOVEit-Automation-Vulnerability-CVE-2024-4563-May-22-2024
CVE ID: CVE-2024-4564 State: PUBLISHED Published: 2024-06-12T03:33:14.904Z Last Updated: 2024-08-01T20:47:40.983Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: codexpert Products: CoDesigner – The Most Compact and User-Friendly Elementor WooCommerce Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Shop Slider, Tabs Classic, and Image Comparison widgets in all versions up to, and including, 4.4.1 due
via the plugin's Shop Slider, Tabs Classic, and Image Comparison widgets in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3115e8ad-8e68-41e9-a3a0-5f003d921037?source=cve - https://plugins.trac.wordpress.org/browser/woolementor/trunk/widgets/shop-slider/template.php#L29 - ht
1037?source=cve - https://plugins.trac.wordpress.org/browser/woolementor/trunk/widgets/shop-slider/template.php#L29 - https://plugins.trac.wordpress.org/browser/woolementor/trunk/widgets/tabs-classic/tabs-classic.php#L329 - https://plugins.trac.wordpress.org/browser/woolementor/trunk/widgets/image-comparison/image-comparison.php#L418 - https://plugins.trac.wordpress.org/changeset/3099922/ - https://wordpress.org/plugins/woolementor/#developers
CVE ID: CVE-2024-4565 State: PUBLISHED Published: 2024-06-20T06:00:02.546Z Last Updated: 2025-08-27T12:00:41.514Z Vendors: Unknown Products: Advanced Custom Fields (ACF), Advanced Custom Fields Pro Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display custom field values for any post via shortcode without checking for the correct access Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/430224c4-d6e3-4ca8-b1bc-b2229a9bcf12/
CVE ID: CVE-2024-4566 State: PUBLISHED Published: 2024-05-21T08:31:04.348Z Last Updated: 2024-08-01T20:47:40.811Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: devitemsllc Products: ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) Problem Types: CWE-862 Missing Authorization Description: The ShopLentor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in all versions up to, and including, 2.8.8. This makes it possible for authenticated attackers, with contributor-level access and above, to set arbitrary WordPre
8. This makes it possible for authenticated attackers, with contributor-level access and above, to set arbitrary WordPress options to "true". NOTE: This vulnerability can be exploited by attackers with subscriber- or customer-level access and above if (1) the WooCommerce plugin is deactivated or (2) access to the default WordPress admin dashboard is explicitly enabled for authenticated users. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c6aaabe9-4f55-4c01-b350-573e6a944353?source=cve - https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/includes/admin/include/class.notice.php#
?source=cve - https://plugins.trac.wordpress.org/browser/woolentor-addons/trunk/includes/admin/include/class.notice.php#L52 - https://plugins.trac.wordpress.org/changeset/3088881/woolentor-addons/trunk/includes/admin/include/class.notice.php
CVE ID: CVE-2024-4567 State: PUBLISHED Published: 2024-05-09T20:03:38.213Z Last Updated: 2024-08-01T20:47:40.724Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themifyme Products: Themify Shortcodes Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themify_button shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access
escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c63ff9d7-6a14-4186-8550-4e5c50855e7f?source=cve - https://plugins.trac.wordpress.org/changeset/3082885/themify-shortcodes
CVE ID: CVE-2024-4568 State: PUBLISHED Published: 2024-05-06T19:56:15.633Z Last Updated: 2024-08-01T20:47:40.665Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Xpdf Products: Xpdf Problem Types: CWE-674 Description: In Xpdf 4.05 (and earlier), a PDF object loop in the PDF resources leads to infinite recursion and a stack overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.xpdfreader.com/security-bug/object-loops.html
CVE ID: CVE-2024-4569 State: PUBLISHED Published: 2024-06-27T04:04:32.280Z Last Updated: 2024-08-01T20:47:40.519Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: webtechstreet Products: Elementor Addon Elements Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, and including, 1.13.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitra
ing. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/63ef7383-d684-473b-aa0f-45027ef245f6?source=cve - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/modules/modal-popup/widgets/modal-popup.php#L1060 - https://plugins.trac.wordpress.org/changeset/3107074/
CVE ID: CVE-2024-4570 State: PUBLISHED Published: 2024-06-27T04:04:32.934Z Last Updated: 2024-08-01T20:47:40.919Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: webtechstreet Products: Elementor Addon Elements Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, and including, 1.13.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitra
ing. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ab5f43c0-83d3-4d09-becd-a3552bebd609?source=cve - https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.13.4/classes/helper.php#L232 - https://plugins.trac.wordpress.org/changeset/3107074/
CVE ID: CVE-2024-4571 State: REJECTED Published: N/A Last Updated: 2024-05-09T17:58:55.419Z Description: No description available.
CVE ID: CVE-2024-4572 State: REJECTED Published: N/A Last Updated: 2024-05-09T17:58:43.719Z Description: No description available.
CVE ID: CVE-2024-4574 State: PUBLISHED Published: 2024-05-10T22:33:08.858Z Last Updated: 2024-08-01T20:47:40.993Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: iqonicdesign Products: Graphina – Elementor Charts and Graphs Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Graphina – Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.8.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with con
nitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1febe2d8-d354-4c78-a611-c1bb0937e53d?source=cve - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/charts/area/widget/area_chart.php#L457 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/charts/bubble/
hp#L457 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/charts/bubble/widget/bubble_chart.php#L685 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/charts/candle/widget/candle_chart.php#L517 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/charts/column/widget/column_chart.php#L531 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/charts/distributed_column/widget/Distributed_Column_chart.php#L464 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/charts
_chart.php#L464 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/charts/donut/widget/donut_chart.php#L325 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/charts/heatmap/widget/heatmap_chart.php#L448 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/charts/line/widget/line_chart.php#L426 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/charts/pie/widget/pie_chart.php#L279 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/charts/polar/widget/polar_chart.
plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/charts/polar/widget/polar_chart.php#L413 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/charts/radar/widget/radar_chart.php#L546 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/charts/radial/widget/radial_chart.php#L417 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/charts/scatter/widget/scatter_chart.php#L419 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/charts/timeline/widget/timeline_chart.php#L462 - h
ress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/charts/timeline/widget/timeline_chart.php#L462 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/google_charts/area/widget/area_google_chart.php#L570 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/google_charts/bar/widget/bar_google_chart.php#L524 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/google_charts/column/widget/column_google_chart.php#L536 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/google_charts/donut/widget/don
//plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/google_charts/donut/widget/donut_google_chart.php#L384 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/google_charts/line/widget/line_google_chart.php#L578 - https://plugins.trac.wordpress.org/browser/graphina-elementor-charts-and-graphs/trunk/elementor/google_charts/pie/widget/pie_google_chart.php#L391
CVE ID: CVE-2024-4575 State: PUBLISHED Published: 2024-05-23T11:02:37.956Z Last Updated: 2024-08-01T20:47:41.239Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: LayerSlider Products: LayerSlider Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The LayerSlider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ls_search_form shortcode in version 7.11.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scr
This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4fa4167a-686f-4fd0-a53d-eb61d57228a1?source=cve - https://layerslider.com/release-log/