Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6201 State: PUBLISHED Published: 2023-11-28T11:32:53.152Z Last Updated: 2025-06-05T13:52:06.471Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Univera Computer System Products: Panorama Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Univera Computer System Panorama allows Command Injection.This issue affects Panorama: before 8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-23-0665
CVE ID: CVE-2023-6202 State: PUBLISHED Published: 2023-11-27T09:12:04.786Z Last Updated: 2024-10-11T17:58:15.479Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get their information (e.g. name, surname, nickname) via Mattermost Boards. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-6203 State: PUBLISHED Published: 2023-12-18T20:07:53.415Z Last Updated: 2024-08-02T08:21:17.837Z Vendors: Unknown Products: The Events Calendar Problem Types: CWE-287 Improper Authentication Description: The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/229273e6-e849-447f-a95a-0730969ecdae
CVE ID: CVE-2023-6204 State: PUBLISHED Published: 2023-11-21T14:28:52.188Z Last Updated: 2025-02-13T17:26:09.300Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Out-of-bound memory access in WebGL2 blitFramebuffer Description: On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the images created on the canvas element. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1841050 - https://www.mozilla.org/security/advisories/mfsa2023-49/
ences: - https://bugzilla.mozilla.org/show_bug.cgi?id=1841050 - https://www.mozilla.org/security/advisories/mfsa2023-49/ - https://www.mozilla.org/security/advisories/mfsa2023-50/ - https://www.mozilla.org/security/advisories/mfsa2023-52/ - https://www.debian.org/security/2023/dsa-5561 - https://lists.debian.org/debian-lts-announce/2023/11/msg00017.html - https://lists.debian.org/debian-lts-announce/2023/11/msg00030.html
CVE ID: CVE-2023-6205 State: PUBLISHED Published: 2023-11-21T14:28:52.504Z Last Updated: 2025-02-13T17:26:09.949Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Use-after-free in MessagePort::Entangled Description: It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1854076 - https://www.mozilla.org/security/advisories/mfsa2023-49/ - https://www.mozilla.o
a.mozilla.org/show_bug.cgi?id=1854076 - https://www.mozilla.org/security/advisories/mfsa2023-49/ - https://www.mozilla.org/security/advisories/mfsa2023-50/ - https://www.mozilla.org/security/advisories/mfsa2023-52/ - https://www.debian.org/security/2023/dsa-5561 - https://lists.debian.org/debian-lts-announce/2023/11/msg00017.html - https://lists.debian.org/debian-lts-announce/2023/11/msg00030.html
CVE ID: CVE-2023-6206 State: PUBLISHED Published: 2023-11-21T14:28:52.832Z Last Updated: 2025-02-13T17:26:10.493Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Clickjacking permission prompts using the fullscreen transition Description: The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.m
< 115.5.0, and Thunderbird < 115.5. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1857430 - https://www.mozilla.org/security/advisories/mfsa2023-49/ - https://www.mozilla.org/security/advisories/mfsa2023-50/ - https://www.mozilla.org/security/advisories/mfsa2023-52/ - https://www.debian.org/security/2023/dsa-5561 - https://lists.debian.org/debian-lts-announce/2023/11/msg00017.html - https://lists.debian.org/debian-lts-announce/2023/11/msg00030.html
CVE ID: CVE-2023-6207 State: PUBLISHED Published: 2023-11-21T14:28:53.190Z Last Updated: 2025-02-13T17:26:11.085Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Use-after-free in ReadableByteStreamQueueEntry::Buffer Description: Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1861344 - https://www.mozilla.org/security/advisories/mfsa2023-49/ - https://www.mozilla.org/security/advisories/mfsa2023-50/ - https://www.mozilla.org/security/advisories
es/mfsa2023-49/ - https://www.mozilla.org/security/advisories/mfsa2023-50/ - https://www.mozilla.org/security/advisories/mfsa2023-52/ - https://www.debian.org/security/2023/dsa-5561 - https://lists.debian.org/debian-lts-announce/2023/11/msg00017.html - https://lists.debian.org/debian-lts-announce/2023/11/msg00030.html
CVE ID: CVE-2023-6208 State: PUBLISHED Published: 2023-11-21T14:28:53.494Z Last Updated: 2025-02-13T17:26:11.625Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Using Selection API would copy contents into X11 primary selection. Description: When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not unlike the clipboard. *This bug only affects Firefox on X11. Other systems are unaffected.* This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi
bird < 115.5. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1855345 - https://www.mozilla.org/security/advisories/mfsa2023-49/ - https://www.mozilla.org/security/advisories/mfsa2023-50/ - https://www.mozilla.org/security/advisories/mfsa2023-52/ - https://www.debian.org/security/2023/dsa-5561 - https://lists.debian.org/debian-lts-announce/2023/11/msg00017.html - https://lists.debian.org/debian-lts-announce/2023/11/msg00030.html
CVE ID: CVE-2023-6209 State: PUBLISHED Published: 2023-11-21T14:28:53.787Z Last Updated: 2025-02-13T17:26:12.209Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Incorrect parsing of relative URLs starting with "///" Description: Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host. This could contribute to security problems in web sites. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1858570 - https://www.mozil
t Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1858570 - https://www.mozilla.org/security/advisories/mfsa2023-49/ - https://www.mozilla.org/security/advisories/mfsa2023-50/ - https://www.mozilla.org/security/advisories/mfsa2023-52/ - https://www.debian.org/security/2023/dsa-5561 - https://lists.debian.org/debian-lts-announce/2023/11/msg00017.html - https://lists.debian.org/debian-lts-announce/2023/11/msg00030.html
CVE ID: CVE-2023-6210 State: PUBLISHED Published: 2023-11-21T14:28:54.144Z Last Updated: 2025-02-13T17:26:12.934Z Vendors: Mozilla Products: Firefox Problem Types: Mixed-content resources not blocked in a javascript: pop-up Description: When an https: web page created a pop-up from a "javascript:" URL, that pop-up was incorrectly allowed to load blockable content such as iframes from insecure http: URLs This vulnerability affects Firefox < 120. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1801501 - https://www.mozilla.org/security/advisories/mfsa2023-49/ - https://security.gentoo.org/glsa/202401-10
CVE ID: CVE-2023-6211 State: PUBLISHED Published: 2023-11-21T14:28:54.446Z Last Updated: 2025-02-13T17:26:13.463Z Vendors: Mozilla Products: Firefox Problem Types: Clickjacking to load insecure pages in HTTPS-only mode Description: If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacker could have tricked the user into clicking to grant an HTTPS-only exception if they could get the user to participate in a clicking game. This vulnerability affects Firefox < 120. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1850200 - https://www.mozilla.org/security/advisories/mfsa
r: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1850200 - https://www.mozilla.org/security/advisories/mfsa2023-49/ - https://security.gentoo.org/glsa/202401-10
CVE ID: CVE-2023-6212 State: PUBLISHED Published: 2023-11-21T14:28:54.749Z Last Updated: 2025-02-13T17:26:14.068Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5 Description: Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
R < 115.5.0, and Thunderbird < 115.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1658432%2C1820983%2C1829252%2C1856072%2C1856091%2C1859030%2C1860943%2C1862782 - https://www.mozilla.org/security/advisories/mfsa2023-49/ - https://www.mozilla.org/security/advisories/mfsa2023-50/ - https://www.mozilla.org/security/advisories/mfsa2023-52/ - https://www.debian.org/security/2023/dsa-5561 - https://lists.debian.org/debian-lts-announce/2023/11/msg00017.html - https://lists.debian.org/debian-lts-announce/2023/11/msg00030.html
CVE ID: CVE-2023-6213 State: PUBLISHED Published: 2023-11-21T14:28:55.054Z Last Updated: 2025-02-13T17:26:14.670Z Vendors: Mozilla Products: Firefox Problem Types: Memory safety bugs fixed in Firefox 120 Description: Memory safety bugs present in Firefox 119. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 120. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1849265%2C1851118%2C1854911 - https://www.mozilla.org/security/advisories/mfsa2023-49/ - https://security.gentoo.org/glsa/20240
%2C1851118%2C1854911 - https://www.mozilla.org/security/advisories/mfsa2023-49/ - https://security.gentoo.org/glsa/202401-10
CVE ID: CVE-2023-6214 State: PUBLISHED Published: 2024-05-02T16:52:07.346Z Last Updated: 2024-08-02T08:21:18.088Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: devitemsllc Products: HT Mega – Absolute Addons For Elementor Problem Types: CWE-200 Information Exposure Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.6 via the purchased_products function. This makes it possible for unauthenticatied attackers to extract sensitive data including the previous 7 days of order data including products and customer PII. Additional Analyst Notes: - CISA
e data including the previous 7 days of order data including products and customer PII. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/54043c6a-48a1-48e8-ba61-a7e8a1773036?source=cve - https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.3.6/extensions/wc-sales-notification/classes/class.sale_notification.php - https://plugins.trac.wordpress.org/changeset/3048999/ht-mega-for-elementor/trunk/extensions/wc-sales-notification/classes/class.sale_notification.php?old=2654447&old_path=ht-mega-for-elementor%2Ftrunk%2Fextensions%2Fwc-sales-notification%2Fclasses%2Fclass.sale_notifi
hp?old=2654447&old_path=ht-mega-for-elementor%2Ftrunk%2Fextensions%2Fwc-sales-notification%2Fclasses%2Fclass.sale_notification.php
CVE ID: CVE-2023-6215 State: PUBLISHED Published: 2025-10-07T14:31:53.244Z Last Updated: 2025-10-07T15:14:47.089Z Vendors: HP, Inc. Products: HP Sure Start IFD Protection Description: A potential security vulnerability has been identified in HP Sure Start’s protection of the Intel Flash Descriptor in certain HP PC products, which might allow security bypass, arbitrary code execution, loss of integrity or confidentiality, or denial of service. HP is releasing BIOS updates to mitigate the potential vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hp.com/us-en/document/ish_13064666-13064688-16/hpsbhf04061
CVE ID: CVE-2023-6217 State: PUBLISHED Published: 2023-11-29T16:14:02.264Z Last Updated: 2024-08-02T08:21:17.933Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Progress Software Corporation Products: MOVEit Transfer Problem Types: CWE-79 Description: In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerability has been identified when MOVEit Gateway is used in conjunction with MOVEit Transfer. An attacker could craft a malicious payload targeting the system which comprises a MOVEit Gateway and MOVEit Transfer deployment. If a MOVEit user interacts with the
argeting the system which comprises a MOVEit Gateway and MOVEit Transfer deployment. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victim’s browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.progress.com/moveit - https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-November-2023
CVE ID: CVE-2023-6218 State: PUBLISHED Published: 2023-11-29T16:14:17.324Z Last Updated: 2024-08-02T08:21:17.955Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Progress Software Corporation Products: MOVEit Transfer Problem Types: CWE-269 Description: In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with group administrators has been identified. It is possible for a group administrator to elevate a group members permissions to the role of an organization administrator. Additional Analyst Notes: - CVE Program Container: References: - https://www.progress.com/
n organization administrator. Additional Analyst Notes: - CVE Program Container: References: - https://www.progress.com/moveit - https://community.progress.com/s/article/MOVEit-Transfer-Service-Pack-November-2023
CVE ID: CVE-2023-6219 State: PUBLISHED Published: 2023-11-28T02:37:20.309Z Last Updated: 2024-08-02T08:21:18.053Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: reputeinfosystems Products: BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'bookingpress_process_upload' function in versions up to, and including, 1.0.76. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arb
1.0.76. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/710b8e4e-01de-4e99-8cf2-31abc2419b29?source=cve - https://plugins.trac.wordpress.org/browser/bookingpress-appointment-booking/tags/1.0.76/core/classes/class.bookingpress_fileupload_class.php#L140 - https://plugins.trac.wordpress.org/changeset/3001484/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress_settings.php - https
dpress.org/changeset/3001484/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress_settings.php - https://plugins.trac.wordpress.org/changeset/3001484/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress_fileupload_class.php
CVE ID: CVE-2023-6220 State: PUBLISHED Published: 2024-01-11T08:32:51.372Z Last Updated: 2025-06-03T14:09:14.990Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: piotnetdotcom Products: Piotnet Forms Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'piotnetforms_ajax_form_builder' function in versions up to, and including, 1.0.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analys
to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/af2b7eac-a3f5-408f-b139-643e70b3f27a?source=cve - https://plugins.trac.wordpress.org/browser/piotnetforms/tags/1.0.26/inc/forms/ajax-form-builder.php#L430
CVE ID: CVE-2023-6221 State: PUBLISHED Published: 2024-02-01T22:18:31.089Z Last Updated: 2025-05-15T19:51:24.142Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: MachineSense Products: FeverWarn Problem Types: CWE-306 Description: The cloud provider MachineSense uses for integration and deployment for multiple MachineSense devices, such as the programmable logic controller (PLC), PumpSense, PowerAnalyzer, FeverWarn, and others is insufficiently protected against unauthorized access. An attacker with access to the internal procedures could view source code, secret credentials, and more. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
w source code, secret credentials, and more. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-01 - https://machinesense.com/pages/about-machinesense
CVE ID: CVE-2023-6222 State: PUBLISHED Published: 2023-12-18T20:07:54.232Z Last Updated: 2024-09-30T18:54:45.595Z Vendors: Unknown Products: Quttera Web Malware Scanner Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/df892e99-c0f6-42b8-a834-fc55d1bde130 - https://drive.google.com/file/d/1krgHH2NvVFr93VpErLkOjDV3L6M5yIA1/vi
ulnerability/df892e99-c0f6-42b8-a834-fc55d1bde130 - https://drive.google.com/file/d/1krgHH2NvVFr93VpErLkOjDV3L6M5yIA1/view?usp=sharing
CVE ID: CVE-2023-6223 State: PUBLISHED Published: 2024-01-11T06:49:32.006Z Last Updated: 2025-06-03T14:25:13.227Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: thimpress Products: LearnPress – WordPress LMS Plugin Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST API due to missing validation on the 'userID' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the details of
This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the details of another user's course progress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/215d5d9e-dabb-462d-8c51-952f8c497b78?source=cve - https://plugins.trac.wordpress.org/changeset/3013957/learnpress
CVE ID: CVE-2023-6225 State: PUBLISHED Published: 2023-11-28T04:31:51.706Z Last Updated: 2024-08-02T08:21:17.992Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gn_themes Products: WP Shortcodes Plugin — Shortcodes Ultimate Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_meta shortcode combined with post meta data in all versions up to, and including, 5.13.3 due to insufficient input sanitization and output escaping on user supplied meta values. This makes
nd including, 5.13.3 due to insufficient input sanitization and output escaping on user supplied meta values. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/558e36f6-4678-46a2-8154-42770fbb5574?source=cve - https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/meta.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3000576%40shortcodes-ultimate&new=3000
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3000576%40shortcodes-ultimate&new=3000576%40shortcodes-ultimate&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6226 State: PUBLISHED Published: 2023-11-28T04:31:51.116Z Last Updated: 2024-08-02T08:21:17.936Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: gn_themes Products: WP Shortcodes Plugin — Shortcodes Ultimate Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.13.3 via the su_meta shortcode due to missing validation on the user controlled keys 'key' and 'post_id'. This makes it possible for authenticated attackers, with contributor-level access and above,