Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-23635 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T18:34:46.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://herolab.usd.de/security-advisories/ - https://github.com/jellyfin/jellyfin-web/issues/3788 - https://herolab.usd.de/security-advisories/usd-2022-0031/
CVE ID: CVE-2023-23636 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T18:44:45.735Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://herolab.usd.de/security-advisories/ - https://github.com/jellyfin/jellyfin-web/issues/3788 - https://herolab.usd.de/security-advisories/usd-2022-0030/
CVE ID: CVE-2023-23637 State: PUBLISHED Published: 2023-01-17T00:00:00.000Z Last Updated: 2025-04-04T17:39:52.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: IMPatienT before 1.5.2 allows stored XSS via onmouseover in certain text fields within a PATCH /modify_onto request to the ontology builder. This may allow attackers to steal Protected Health Information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/lambda-science/IMPatienT/compare/v1.5.1...v1.5.2 - https://github.com/lambda-science/IMPatienT/issues/101 - https://github.com/lambda-science/IMPatienT/releases/tag/v1.5.2
CVE ID: CVE-2023-23638 State: PUBLISHED Published: 2023-03-08T10:48:58.574Z Last Updated: 2024-10-23T16:41:29.622Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Apache Software Foundation Products: Apache Dubbo Problem Types: CWE-502 Description: A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/8h6z
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/8h6zscfzj482z512d2v5ft63hdhzm0cb
CVE ID: CVE-2023-23639 State: PUBLISHED Published: 2024-06-09T09:13:30.428Z Last Updated: 2024-08-02T10:35:33.644Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: MainWP Products: MainWP Staging Extension Problem Types: CWE-862 Description: Missing Authorization vulnerability in MainWP MainWP Staging Extension.This issue affects MainWP Staging Extension: from n/a through 4.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/mainwp-staging-extension/wordpress-mainwp-staging-extension-plugin-4-0-3-subscriber-arbitrary-plugin-activation-vulnerability?_s_id=cve
CVE ID: CVE-2023-23640 State: PUBLISHED Published: 2024-06-09T09:15:40.602Z Last Updated: 2024-08-02T10:35:33.653Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: MainWP Products: MainWP UpdraftPlus Extension Problem Types: CWE-862 Description: Missing Authorization vulnerability in MainWP MainWP UpdraftPlus Extension.This issue affects MainWP UpdraftPlus Extension: from n/a through 4.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/mainwp-updraftplus-extension/wordpress-mainwp-updraftplus-extension-plugin-4-0-6-subscriber-arbitrary-plugin-activation-vulnerability?_s_
s-extension/wordpress-mainwp-updraftplus-extension-plugin-4-0-6-subscriber-arbitrary-plugin-activation-vulnerability?_s_id=cve
CVE ID: CVE-2023-23641 State: PUBLISHED Published: 2023-05-16T09:18:08.898Z Last Updated: 2024-10-10T18:57:55.499Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPmanage Products: Uji Popup Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WPmanage Uji Popup plugin <= 1.4.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/uji-popup/wordpress-uji-popup-plugin-1-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23645 State: PUBLISHED Published: 2024-05-17T06:30:36.081Z Last Updated: 2024-08-02T10:35:33.661Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: MainWP Products: MainWP Code Snippets Extension Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in MainWP MainWP Code Snippets Extension allows Code Injection.This issue affects MainWP Code Snippets Extension: from n/a through 4.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/mainwp-code-snippets-extension/wordpress-mainwp-code-snippets-extension-
- https://patchstack.com/database/vulnerability/mainwp-code-snippets-extension/wordpress-mainwp-code-snippets-extension-plugin-4-0-2-subscriber-arbitrary-php-code-injection-execution-vulnerability?_s_id=cve
CVE ID: CVE-2023-23646 State: PUBLISHED Published: 2023-07-17T10:50:48.819Z Last Updated: 2024-10-07T15:11:25.986Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: A WP Life Products: Album Gallery – WordPress Gallery Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Album Gallery – WordPress Gallery plugin <= 1.4.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/new-album-gallery/wordpress-album-gallery-wordpress-gallery-plugin-1-4-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-23647 State: PUBLISHED Published: 2023-05-09T11:05:57.025Z Last Updated: 2025-01-09T15:22:52.325Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Sk. Abul Hasan Products: Team Member – Team with Slider Problem Types: CWE-79 Description: Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in Sk. Abul Hasan Team Member – Team with Slider plugin <= 4.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/team-showcase-supreme/wordpress-team-member-team-with-slider-plugin-4-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23649 State: PUBLISHED Published: 2024-03-28T06:12:22.156Z Last Updated: 2024-08-02T10:35:33.743Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MainWP Products: MainWP Links Manager Extension Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in MainWP MainWP Links Manager Extension.This issue affects MainWP Links Manager Extension: from n/a through 2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/mainwp-links-manager-extension/wordpress-mainwp-links-manager-extension-plugin-2-1-unauthenticated-php-object-injection-vul
nwp-links-manager-extension/wordpress-mainwp-links-manager-extension-plugin-2-1-unauthenticated-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-23650 State: PUBLISHED Published: 2023-03-23T12:40:43.842Z Last Updated: 2025-01-10T19:17:24.942Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: MainWP Products: MainWP Code Snippets Extension Problem Types: CWE-79 Description: Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in MainWP MainWP Code Snippets Extension plugin <= 4.0.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mainwp-code-snippets-extension/wordpress-mainwp-code-snippets-extension-plugin-4-0-2-subscriber-stored-cross-site-scripting-vulnerability?_s_id=cve
CVE ID: CVE-2023-23651 State: PUBLISHED Published: 2023-10-12T11:26:03.790Z Last Updated: 2024-09-18T16:29:45.246Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: MainWP Products: MainWP Google Analytics Extension Problem Types: CWE-89 Description: Auth. (subscriber+) SQL Injection (SQLi) vulnerability in MainWP Google Analytics Extension plugin <= 4.0.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mainwp-google-analytics-extension/wordpress-mainwp-google-analytics-extension-plugin-4-0-4-subscriber-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-23654 State: PUBLISHED Published: 2023-05-15T11:40:07.285Z Last Updated: 2024-08-02T13:40:46.084Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: SparkPost Products: SparkPost Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SparkPost plugin <= 3.2.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/sparkpost/wordpress-sparkpost-plugin-3-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23656 State: PUBLISHED Published: 2024-03-26T19:51:56.582Z Last Updated: 2024-08-07T17:56:13.274Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: MainWP Products: MainWP File Uploader Extension Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in MainWP MainWP File Uploader Extension.This issue affects MainWP File Uploader Extension: from n/a through 4.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mainwp-file-uploader-extension/wordpress-mainwp-file-uploader-extension-plugin-4-1-unauthenticated-arbitra
vulnerability/mainwp-file-uploader-extension/wordpress-mainwp-file-uploader-extension-plugin-4-1-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2023-23657 State: PUBLISHED Published: 2023-05-16T09:24:25.681Z Last Updated: 2024-10-10T18:57:47.564Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Richard Leishman t/a Webforward Products: Mail Subscribe List Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Richard Leishman t/a Webforward Mail Subscribe List plugin <= 2.1.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mail-subscribe-list/wordpress-mail-subscribe-list-plugin-2-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23659 State: PUBLISHED Published: 2023-02-23T14:46:50.988Z Last Updated: 2025-01-13T15:56:30.148Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: MainWP Products: MainWP Matomo Extension Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in MainWP Matomo Extension <= 4.0.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mainwp-piwik-extension/wordpress-mainwp-matomo-extension-plugin-4-0-4-csrf-leading-to-plugin-settings-change-vulnerability?_s_id=cve
CVE ID: CVE-2023-23660 State: PUBLISHED Published: 2023-07-18T12:42:29.141Z Last Updated: 2024-09-26T15:11:46.677Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: MainWP Products: MainWP Maintenance Extension Problem Types: CWE-89 Description: Auth. (subscriber+) SQL Injection (SQLi) vulnerability in MainWP MainWP Maintenance Extension plugin <= 4.1.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mainwp-maintenance-extension/wordpress-mainwp-maintenance-extension-plugin-4-1-1-subscriber-sql-injection-vulnerability?_s_id=cve - https://patchstack.com/articles/mult
intenance-extension-plugin-4-1-1-subscriber-sql-injection-vulnerability?_s_id=cve - https://patchstack.com/articles/multiple-vulnerabilities-affecting-mainwp-extensions?_s_id=cve
CVE ID: CVE-2023-23664 State: PUBLISHED Published: 2023-05-09T09:58:01.631Z Last Updated: 2024-08-02T10:35:33.654Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: ConvertBox Products: ConvertBox Auto Embed WordPress plugin Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ConvertBox ConvertBox Auto Embed WordPress plugin <= 1.0.19 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/convertbox-auto-embed/wordpress-convertbox-auto-embed-wordpress-plugin-plugin-1-0-19-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23667 State: PUBLISHED Published: 2023-05-18T10:21:15.146Z Last Updated: 2024-10-10T18:57:39.891Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: BeRocket Products: Brands for WooCommerce Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in BeRocket Brands for WooCommerce plugin <= 3.7.0.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/brands-for-woocommerce/wordpress-brands-for-woocommerce-plugin-3-7-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23668 State: PUBLISHED Published: 2023-05-08T11:56:34.589Z Last Updated: 2025-01-09T15:25:53.171Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: GiveWP Products: GiveWP Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in GiveWP plugin <= 2.25.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-25-1-contributor-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23670 State: PUBLISHED Published: 2023-03-30T10:44:53.343Z Last Updated: 2025-02-19T21:36:58.876Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Team Heateor Products: Fancy Comments WordPress Problem Types: CWE-79 Description: Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Team Heateor Fancy Comments WordPress plugin <= 1.2.10 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/fancy-facebook-comments/wordpress-fancy-comments-wordpress-plugin-1-2-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23671 State: PUBLISHED Published: 2023-07-11T11:22:22.726Z Last Updated: 2024-08-02T14:48:39.830Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) Vendors: Muneeb Products: Layer Slider Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Muneeb Layer Slider plugin <= 1.1.9.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/slider-slideshow/wordpress-layer-slider-plugin-1-1-9-6-cross-site-request-forgery-csrf-leading-to-post-page-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2023-23672 State: PUBLISHED Published: 2025-01-02T15:06:38.479Z Last Updated: 2025-01-03T18:56:35.217Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Liquid Web / StellarWP Products: GiveWP Problem Types: CWE-862 Description: Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP.This issue affects GiveWP: from n/a through 2.25.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-2-25-1-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2023-23673 State: PUBLISHED Published: 2023-05-16T08:28:51.231Z Last Updated: 2025-01-09T15:15:34.402Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Harish Chouhan, Themeist Products: I Recommend This Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Harish Chouhan, Themeist I Recommend This plugin <= 3.8.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/i-recommend-this/wordpress-i-recommend-this-plugin-3-8-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23674 State: PUBLISHED Published: 2023-05-15T11:24:20.068Z Last Updated: 2025-02-19T21:30:23.663Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: RVOLA Products: WP Original Media Path Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in RVOLA WP Original Media Path plugin <= 2.4.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-original-media-path/wordpress-wp-original-media-path-plugin-2-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23675 State: PUBLISHED Published: 2023-03-30T10:48:59.204Z Last Updated: 2025-02-19T21:36:42.717Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Catchsquare Products: WP Smart Preloader Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Catchsquare WP Smart Preloader plugin <= 1.15 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-smart-preloader/wordpress-wp-smart-preloader-plugin-1-15-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23676 State: PUBLISHED Published: 2023-05-16T08:35:38.631Z Last Updated: 2025-01-09T15:15:25.909Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Bruno "Aesqe" Babic Products: File Gallery Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Bruno "Aesqe" Babic File Gallery plugin <= 1.8.5.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/file-gallery/wordpress-file-gallery-plugin-1-8-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23677 State: PUBLISHED Published: 2023-03-30T10:58:00.903Z Last Updated: 2025-02-19T21:36:33.193Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: GTmetrix Products: GTmetrix for WordPress Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/gtmetrix-for-wordpress/wordpress-gtmetrix-for-wordpress-plugin-0-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23678 State: PUBLISHED Published: 2023-11-07T15:48:28.420Z Last Updated: 2024-09-05T14:19:24.248Z Vendors: WPEkaClub Products: WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) Problem Types: CWE-1236 Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in WPEkaClub WP Cookie Consent ( for GDPR, CCPA & ePrivacy ).This issue affects WP Cookie Consent ( for GDPR, CCPA & ePrivacy ): from n/a through 2.2.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/gdpr-cookie-consent/wordpress-wp-cookie-notice-for-gdpr-ccpa-eprivacy-consent-plugin-2-2-5-csv-injection-vulne
erability/gdpr-cookie-consent/wordpress-wp-cookie-notice-for-gdpr-ccpa-eprivacy-consent-plugin-2-2-5-csv-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-23679 State: PUBLISHED Published: 2023-06-23T14:21:36.432Z Last Updated: 2024-10-18T13:01:38.834Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: JS Help Desk Products: JS Help Desk Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in JS Help Desk js-support-ticket allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk: from n/a through 2.7.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/js-support-ticket/wordpress-js-help-desk-best-help-desk-support-plugin-plugin
ps://patchstack.com/database/vulnerability/js-support-ticket/wordpress-js-help-desk-best-help-desk-support-plugin-plugin-2-7-7-idor-leading-to-ticket-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2023-23680 State: PUBLISHED Published: 2023-05-22T08:31:22.939Z Last Updated: 2025-01-09T15:11:52.622Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Bob Goetz Products: WP-TopBar Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Bob Goetz WP-TopBar plugin <= 5.36 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-topbar/wordpress-wp-topbar-plugin-5-36-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-23681 State: PUBLISHED Published: 2023-03-30T11:06:21.055Z Last Updated: 2025-01-10T19:12:42.866Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Labib Ahmed Products: Image Hover Effects For WPBakery Page Builder Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Labib Ahmed Image Hover Effects For WPBakery Page Builder plugin <= 4.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/image-hover-effects-visual-composer-extension/wordpress-image-hover-effects-for-wpbakery-page-builder-plugin-4
erability/image-hover-effects-visual-composer-extension/wordpress-image-hover-effects-for-wpbakery-page-builder-plugin-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-23682 State: PUBLISHED Published: 2023-05-15T12:14:17.191Z Last Updated: 2025-01-09T15:15:43.159Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Snap Creek Software Products: EZP Maintenance Mode Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Snap Creek Software EZP Maintenance Mode plugin <= 1.0.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/easy-pie-maintenance-mode/wordpress-ezp-maintenance-mode-plugin-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve