Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-3877 State: PUBLISHED Published: 2022-12-19T00:00:00.000Z Last Updated: 2025-04-15T12:56:46.658Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Click Studios Products: Passwordstate, Passwordstate Browser Extension Chrome Problem Types: CWE-707 Description: A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected is an unknown function of the component URL Field Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade t
launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. VDB-216246 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html - https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf - https://vuldb.com/?id.216246
CVE ID: CVE-2022-3878 State: PUBLISHED Published: 2022-11-07T00:00:00.000Z Last Updated: 2025-04-14T15:56:28.273Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Maxon Products: ERP Problem Types: CWE-707 Description: A vulnerability classified as critical has been found in Maxon ERP. This affects an unknown part of the file /index.php/purchase_order/browse_data. The manipulation of the argument tb_search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-213039. Additional Analyst Notes: - CVE Program Container: - CISA ADP
ssociated identifier of this vulnerability is VDB-213039. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/huclilu/CVE_Add - https://vuldb.com/?id.213039
CVE ID: CVE-2022-3879 State: PUBLISHED Published: 2022-12-12T17:54:52.907Z Last Updated: 2025-04-22T20:11:21.185Z Vendors: Unknown Products: Car Dealer (Dealership) and Vehicle sales WordPress Plugin Problem Types: CWE-863 Incorrect Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnera
org Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0db1762e-1401-4006-88ed-d09a4bc6585b
CVE ID: CVE-2022-3880 State: PUBLISHED Published: 2022-12-12T17:54:54.003Z Last Updated: 2025-04-22T20:10:22.591Z Vendors: Unknown Products: Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan Problem Types: CWE-863 Incorrect Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org Additional Analyst Notes: - CVE Program Container: -
ll it and install and activate arbitrary plugins from wordpress.org Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/24743c72-310f-41e9-aac9-e05b2bb1a14e
CVE ID: CVE-2022-3881 State: PUBLISHED Published: 2022-12-12T17:54:54.806Z Last Updated: 2025-04-22T20:06:37.054Z Vendors: Unknown Products: WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log Problem Types: CWE-863 Incorrect Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.or
wing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c2a9cf01-051a-429a-82ca-280885114b5a
CVE ID: CVE-2022-3882 State: PUBLISHED Published: 2022-12-12T17:54:34.345Z Last Updated: 2025-04-22T15:36:52.073Z Vendors: Unknown Products: Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin Problem Types: CWE-863 Incorrect Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin WordPress plugin before 2.46 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
vate arbitrary plugins from wordpress.org Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a39c643f-eaa4-4c71-b75d-2c4fe34ac875
CVE ID: CVE-2022-3883 State: PUBLISHED Published: 2022-12-12T17:54:36.736Z Last Updated: 2025-04-22T15:12:48.359Z Vendors: Unknown Products: Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Problem Types: CWE-863 Incorrect Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
tivate arbitrary plugins from wordpress.org Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8695b157-abac-4aa6-a022-e3ae41c03544
CVE ID: CVE-2022-3884 State: PUBLISHED Published: 2023-02-28T02:01:26.105Z Last Updated: 2025-03-07T18:14:32.411Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: Hitachi Products: Hitachi Ops Center Analyzer Problem Types: CWE-276 Description: Incorrect Default Permissions vulnerability in Hitachi Ops Center Analyzer on Windows (Hitachi Ops Center Analyzer RAID Agent component) allows local users to read and write specific files.This issue affects Hitachi Ops Center Analyzer: from 10.9.0-00 before 10.9.0-01. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/
ogram Container: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-105/index.html
CVE ID: CVE-2022-3885 State: PUBLISHED Published: 2022-11-09T00:00:00 Last Updated: 2024-10-23T19:46:35.136Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop.html - https://crbug.com/1377816 - https://www.debian.org/security/2022/dsa-5275
CVE ID: CVE-2022-3886 State: PUBLISHED Published: 2022-11-09T00:00:00 Last Updated: 2024-10-23T19:37:11.162Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Speech Recognition in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop.html - https://crbug.com/1372999 - https://www.debian.org/security/2022/dsa-5275
CVE ID: CVE-2022-3887 State: PUBLISHED Published: 2022-11-09T00:00:00 Last Updated: 2024-10-23T19:28:56.368Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Web Workers in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop.html - https://crbug.com/1372695 - https://www.debian.org/security/2022/dsa-5275
CVE ID: CVE-2022-3888 State: PUBLISHED Published: 2022-11-09T00:00:00 Last Updated: 2024-10-23T19:21:42.148Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in WebCodecs in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop.html - https://crbug.com/1375059 - https://www.debian.org/security/2022/dsa-5275
CVE ID: CVE-2022-3889 State: PUBLISHED Published: 2022-11-09T00:00:00 Last Updated: 2024-10-23T19:20:16.183Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type confusion in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop.html - https://crbug.com/1380063 - https://www.debian.org/security/2022/dsa-5275
CVE ID: CVE-2022-3890 State: PUBLISHED Published: 2022-11-09T00:00:00 Last Updated: 2024-10-23T19:17:43.215Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in Crashpad in Google Chrome on Android prior to 107.0.5304.106 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop.html - https://crbug.com/1380083 - https://www.debian.org/security/2022/dsa-5275
CVE ID: CVE-2022-3891 State: PUBLISHED Published: 2023-02-13T14:32:26.964Z Last Updated: 2025-03-21T14:21:49.317Z Vendors: Unknown Products: WP FullCalendar Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The WP FullCalendar WordPress plugin before 1.5 does not ensure that the post retrieved via an AJAX action is public and can be accessed by the user making the request, allowing unauthenticated attackers to get the content of arbitrary posts, including draft/private as well as password-protected ones. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5a69965d-d243-4d51-b7a4-d6f4b199
gram Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5a69965d-d243-4d51-b7a4-d6f4b199abf1
CVE ID: CVE-2022-3892 State: PUBLISHED Published: 2022-12-05T16:50:32.317Z Last Updated: 2025-04-24T13:23:37.337Z Vendors: Unknown Products: WP OAuth Server (OAuth Authentication) Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/33dddaec-a32a-4fce-89d6-164565be1
ram Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/33dddaec-a32a-4fce-89d6-164565be13e1
CVE ID: CVE-2022-3893 State: PUBLISHED Published: 2022-11-15T14:24:48.875Z Last Updated: 2025-04-29T20:12:41.873Z Severity: LOW (CVSS 2.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Hallo Welt! GmbH Products: BlueSpice Problem Types: CWE-79 Description: Cross-site Scripting (XSS) vulnerability in BlueSpiceCustomMenu extension of BlueSpice allows user with admin permissions to inject arbitrary HTML into the custom menu navigation of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-06
CVE ID: CVE-2022-3894 State: PUBLISHED Published: 2023-03-20T15:52:07.429Z Last Updated: 2025-02-26T19:07:21.381Z Vendors: Unknown Products: WP OAuth Server (OAuth Authentication) Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.5 does not have CSRF check when deleting a client, and does not ensure that the object to be deleted is actually a client, which could allow attackers to make a logged in admin delete arbitrary client and post via a CSRF attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/298487b2-4141-4c9f-9bb2-e14
E Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/298487b2-4141-4c9f-9bb2-e1450aefc1a8
CVE ID: CVE-2022-3895 State: PUBLISHED Published: 2022-11-15T14:24:49.235Z Last Updated: 2025-04-29T18:12:08.089Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Hallo Welt! GmbH Products: Common User Interface Component Problem Types: CWE-79 Description: Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML (XSS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-08
CVE ID: CVE-2022-3896 State: PUBLISHED Published: 2022-11-29T20:41:47.681Z Last Updated: 2025-01-23T21:17:23.927Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: tipsandtrickshq Products: WP Affiliate Platform Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Affiliate Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER["REQUEST_URI"] in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if the
aping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is unlikely to work in modern browsers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tipsandtricks-hq.com/wordpress-affiliate-platform-plugin-simple-affiliate-program-for-wordpress-blogsite-1474 - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3896
CVE ID: CVE-2022-3897 State: PUBLISHED Published: 2022-11-29T20:42:01.833Z Last Updated: 2025-01-23T21:09:44.932Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: tipsandtrickshq Products: WP Affiliate Platform Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary w
his makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tipsandtricks-hq.com/wordpress-affiliate-platform-plugin-simple-affiliate-program-for-wordpress-blogsite-1474 - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3897
CVE ID: CVE-2022-3898 State: PUBLISHED Published: 2022-11-29T20:42:19.502Z Last Updated: 2025-01-23T20:50:42.802Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: tipsandtrickshq Products: WP Affiliate Platform Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Affiliate Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.3.9. This is due to missing or incorrect nonce validation on various functions including the affiliates_menu method. This makes it possible for unauthenticated attackers to delete affiliate records, via forged request granted they can trick a site administrator
or unauthenticated attackers to delete affiliate records, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tipsandtricks-hq.com/wordpress-affiliate-platform-plugin-simple-affiliate-program-for-wordpress-blogsite-1474 - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3898
CVE ID: CVE-2022-3899 State: PUBLISHED Published: 2024-01-16T15:50:51.026Z Last Updated: 2025-06-02T15:10:45.628Z Vendors: Unknown Products: 3dprint Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The 3dprint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will delete any number of files or directories on the target server by tricking a logged in admin into submitting a form. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e3131e16-a0eb-4d26-b6d3-048f
Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e3131e16-a0eb-4d26-b6d3-048fc1f1e9fa/
CVE ID: CVE-2022-3900 State: PUBLISHED Published: 2022-12-12T17:57:08.950Z Last Updated: 2025-04-22T14:43:41.505Z Vendors: Unknown Products: Cooked Pro Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore action, allowing an unauthenticated attacker to trigger a PHP Object injection vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c969c4bc-82d7-46a0-88ba-e056c0b27de7
CVE ID: CVE-2022-3901 State: PUBLISHED Published: 2023-02-20T18:07:34.082Z Last Updated: 2025-04-01T04:48:08.974Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Visio Globe Products: Visioweb Problem Types: CWE-1321 Description: Prototype Pollution in Visioweb.js 1.10.6 allows attackers to execute XSS on the client system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://csirt.divd.nl/CVE-2022-3901
CVE ID: CVE-2022-3902 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T15:00:25.550Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to unmask webhook secret tokens by reviewing the logs after testing webhooks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitl
hooks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/381895 - https://hackerone.com/reports/1757999 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3902.json
CVE ID: CVE-2022-3903 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T19:09:58.139Z Vendors: n/a Products: Kernel Problem Types: CWE-843 Description: An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs when a user attaches a malicious USB device. A local user could use this flaw to starve the resources, causing denial of service or potentially crashing the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lore.kernel.org/all/CAB7eexLLApHJwZfMQ=X-PtRhw0BgO+5KcSMS05FNUYejJXqtSA%40mail.gmail.com/ - https://lore.kernel.org/all/E1obysd-009Grw-He%
l/CAB7eexLLApHJwZfMQ=X-PtRhw0BgO+5KcSMS05FNUYejJXqtSA%40mail.gmail.com/ - https://lore.kernel.org/all/E1obysd-009Grw-He%40www.linuxtv.org/
CVE ID: CVE-2022-3904 State: PUBLISHED Published: 2023-01-16T15:37:44.169Z Last Updated: 2025-04-08T19:34:28.248Z Vendors: Unknown Products: MonsterInsights Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/244d9ef1-335c-4f65-94ad-27c0c633f6ad
CVE ID: CVE-2022-3905 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2022-3906 State: PUBLISHED Published: 2022-12-12T17:54:52.119Z Last Updated: 2025-04-22T20:13:09.278Z Vendors: Unknown Products: Easy Form Builder Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fee8652d-cd50-4cb0-b94d-2d124f56af1a