Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11760 State: PUBLISHED Published: 2024-12-12T08:22:34.909Z Last Updated: 2024-12-12T14:34:56.060Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: falselight Products: Currency Converter Widget ⚡ PRO Problem Types: CWE-79 Description: The Currency Converter Widget ⚡ PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'currency-converter-widget-pro' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scrip
is makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4f9a0341-5479-4b83-8ce8-eb838a34a448?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3206549%40currency-converter-widget-pro&new=3206549%40currency-converter-widget-pro&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11761 State: PUBLISHED Published: 2024-11-28T08:47:29.472Z Last Updated: 2024-11-28T12:25:17.653Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: legalweb Products: LegalWeb Cloud Problem Types: CWE-79 Description: The LegalWeb Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'legalweb-popup' shortcode in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acces
ith contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/034d3d52-cb77-40dd-85a1-81ca3bfd1f23?source=cve - https://plugins.trac.wordpress.org/changeset/3198065/legalweb-cloud/trunk/includes/shortcodes/class-legalweb-cloud-cookie-popup-shortcode.php
CVE ID: CVE-2024-11763 State: PUBLISHED Published: 2024-12-14T04:23:43.053Z Last Updated: 2024-12-16T17:50:26.690Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: plezi Products: Plezi Problem Types: CWE-79 Description: The Plezi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'plezi' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Addition
nd above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/67768957-45be-48d9-ad5e-147290ef4cd5?source=cve - https://plugins.trac.wordpress.org/browser/plezi/trunk/includes/plz-admin.php#L590
CVE ID: CVE-2024-11764 State: PUBLISHED Published: 2025-01-07T06:40:58.883Z Last Updated: 2025-01-07T16:11:59.110Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: covertcommunication Products: Solar Wizard Lite Problem Types: CWE-79 Description: The Solar Wizard Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'solar_wizard' shortcode in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenev
ed attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/adcab262-08ca-448d-b1fd-295d421b82a3?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3215301%40solar-wizard-lite&new=3215301%40solar-wizard-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11765 State: PUBLISHED Published: 2024-12-12T05:24:21.216Z Last Updated: 2024-12-12T14:51:37.762Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: samdani Products: WordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more Problem Types: CWE-79 Description: The WordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gs_portfolio' shortcode in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. Th
s up to, and including, 1.6.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6e78440d-54ab-400f-a8d2-9cb33f1ec861?source=cve - https://plugins.trac.wordpress.org/browser/gs-portfolio/tags/1.6.3/gsportfolio-files/includes/templates/gs_portfolio_sthree_kira.php#L29 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame
templates/gs_portfolio_sthree_kira.php#L29 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3204631%40gs-portfolio&new=3204631%40gs-portfolio&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11766 State: PUBLISHED Published: 2024-12-12T05:24:23.655Z Last Updated: 2024-12-12T15:46:17.512Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: samdani Products: WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more Problem Types: CWE-79 Description: The WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gs_book_showcase' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for
1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b3b40b73-4dec-4a96-a634-3bd3d74616ba?source=cve - https://plugins.trac.wordpress.org/browser/gs-books-showcase/tags/1.3.1/gs-bookshowcase-files/includes/templates/gs_bookshowcase_structure_1_square.php#L24 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old
okshowcase_structure_1_square.php#L24 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3204642%40gs-books-showcase&new=3204642%40gs-books-showcase&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11767 State: PUBLISHED Published: 2024-12-13T04:23:25.358Z Last Updated: 2024-12-16T20:08:24.592Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: newsmanapp Products: NewsmanApp Problem Types: CWE-79 Description: The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'newsman_subscribe_widget' shortcode in all versions up to, and including, 2.7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user a
s, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/22a02e75-4ab1-48fb-b618-b1dff2fcd97f?source=cve - https://plugins.trac.wordpress.org/browser/newsmanapp/trunk/newsmanapp.php#L1054 - https://plugins.trac.wordpress.org/browser/newsmanapp/trunk/newsmanapp.php#L1075 - https://plugins.trac.wordpress.org/changeset/3205721/newsmanapp/trunk/newsmanapp.php
CVE ID: CVE-2024-11768 State: PUBLISHED Published: 2024-12-19T05:24:56.535Z Last Updated: 2024-12-19T16:38:23.813Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: codename065 Products: Download Manager Problem Types: CWE-285 Description: The Download Manager plugin for WordPress is vulnerable to unauthorized download of password-protected content due to improper password validation on the checkFilePassword function in all versions up to, and including, 3.3.03. This makes it possible for unauthenticated attackers to download password-protected files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulner
ed files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/feb915f4-66d6-4f46-949c-5354e414319b?source=cve - https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/__/Apply.php#L376
CVE ID: CVE-2024-11769 State: PUBLISHED Published: 2024-12-04T07:32:26.609Z Last Updated: 2024-12-04T14:09:09.796Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: floristone Products: Flower Delivery by Florist One Problem Types: CWE-79 Description: The Flower Delivery by Florist One plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'flower-delivery' shortcode in all versions up to, and including, 3.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that w
le for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/93efae1f-1e4a-48ee-8a69-558c38925250?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3201180%40flower-delivery-by-florist-one&new=3201180%40flower-delivery-by-florist-one&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11770 State: PUBLISHED Published: 2024-12-14T04:23:42.330Z Last Updated: 2024-12-16T17:50:39.662Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: tarakpatel18 Products: Post Carousel & Slider Problem Types: CWE-79 Description: The Post Carousel & Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'post-cs' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4cc038af-c4c8-4141-bbe3-81bcf0a2bace?source=cve - https://plugins.trac.wordpress.org/browser/post-types-carousel-slider/trunk/includes/ajax.php#L71 - https://wordpress.org/plugins/post-types-carousel-slider
CVE ID: CVE-2024-11771 State: PUBLISHED Published: 2025-02-11T15:19:11.855Z Last Updated: 2025-02-11T15:35:20.987Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Ivanti Products: Cloud Services Application Problem Types: CWE-22 Description: Path traversal in Ivanti CSA before version 5.0.5 allows a remote unauthenticated attacker to access restricted functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Services-Application-CSA-CVE-2024-47908-CVE-2024-11771
CVE ID: CVE-2024-11772 State: PUBLISHED Published: 2024-12-10T18:55:44.312Z Last Updated: 2024-12-14T04:55:12.912Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Cloud Services Application Problem Types: CWE-77 Description: Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Services-Application-CSA-CVE-2024-11639-CVE-2024-11772-CVE-2024-11773
CVE ID: CVE-2024-11773 State: PUBLISHED Published: 2024-12-10T18:56:08.742Z Last Updated: 2024-12-14T04:55:14.186Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Cloud Services Application Problem Types: CWE-89 Description: SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Services-Application-CSA-CVE-2024-11639-CVE-2024-11772-CVE-2024-11773
CVE ID: CVE-2024-11774 State: PUBLISHED Published: 2024-12-20T06:59:10.356Z Last Updated: 2024-12-20T17:36:57.450Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: outdooractive Products: Outdooractive Embed Problem Types: CWE-79 Description: The Outdooractive Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'list2go' shortcode in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user
ers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d152271f-af5c-4faf-9945-483b69b716f2?source=cve - https://plugins.trac.wordpress.org/browser/outdooractive-embed/trunk/shortcodes.php#L49 - https://wordpress.org/plugins/outdooractive-embed/
CVE ID: CVE-2024-11775 State: PUBLISHED Published: 2024-12-20T06:59:05.368Z Last Updated: 2024-12-20T16:08:23.282Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: aasthasolutions Products: Particle Background Problem Types: CWE-79 Description: The Particle Background plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'particleground' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute when
ated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/42cf84d1-37f5-41c1-838d-67244f17c55d?source=cve - https://plugins.trac.wordpress.org/browser/particle-background/trunk/particleground.php#L59 - https://wordpress.org/plugins/particle-background/
CVE ID: CVE-2024-11776 State: PUBLISHED Published: 2024-12-20T02:24:40.700Z Last Updated: 2024-12-20T17:02:12.830Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: arothman Products: PCRecruiter Extensions Problem Types: CWE-79 Description: The PCRecruiter Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'PCRecruiter' shortcode in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute wheneve
d attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d97e1ec3-321b-4d69-ab69-e3ecab0937b3?source=cve - https://plugins.trac.wordpress.org/browser/pcrecruiter-extensions/trunk/PCRecruiter-Extensions.php#L21
CVE ID: CVE-2024-11777 State: PUBLISHED Published: 2025-01-07T03:21:57.148Z Last Updated: 2025-01-07T16:28:06.912Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: endortrails Products: Sell Media Problem Types: CWE-79 Description: The Sell Media plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sell_media_search_form_gutenberg' shortcode in all versions up to, and including, 2.5.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenev
ed attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8a35f0bb-691f-4acf-a30d-4ddabe3b919c?source=cve - https://plugins.trac.wordpress.org/browser/sell-media/trunk//gutenberg/blocks/sell-media-search-form/sell-media-search-form.php#L219 - https://wordpress.org/plugins/sell-media/
CVE ID: CVE-2024-11778 State: PUBLISHED Published: 2025-02-19T07:32:11.843Z Last Updated: 2025-02-19T16:29:29.584Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: canadahelps Products: CanadaHelps Embedded Donation Form Problem Types: CWE-79 Description: The CanadaHelps Embedded Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embedcdn' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages th
ssible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9f96a607-a655-413d-9faf-304249edefe8?source=cve - https://plugins.trac.wordpress.org/browser/embedded-cdn/trunk/embedded-cdn.php#L32 - https://wordpress.org/plugins/embedded-cdn/
CVE ID: CVE-2024-11779 State: PUBLISHED Published: 2024-12-05T09:23:06.568Z Last Updated: 2024-12-05T11:13:24.571Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: alexvtn Products: WIP WooCarousel Lite Problem Types: CWE-79 Description: The WIP WooCarousel Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wip_woocarousel_products_carousel' shortcode in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will
for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/50721265-dbbf-4032-a8d6-9cf42a986c0d?source=cve - https://plugins.trac.wordpress.org/browser/wip-woocarousel-lite/trunk/shortcode/products_carousel.php#L52 - https://wordpress.org/plugins/wip-woocarousel-lite - https://plugins.trac.wordpress.org/changeset/3199039/wip-woocarousel-lite/trunk/shortcode/products_carousel.php
CVE ID: CVE-2024-11780 State: PUBLISHED Published: 2025-02-01T03:21:11.681Z Last Updated: 2025-02-03T16:38:40.356Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: dsky Products: Site Search 360 Problem Types: CWE-79 Description: The Site Search 360 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ss360-resultblock' shortcode in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acce
with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4af66bb2-febe-4022-9526-39b1ecd8b01d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3232517%40site-search-360&new=3232517%40site-search-360&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11781 State: PUBLISHED Published: 2024-12-12T05:24:19.358Z Last Updated: 2024-12-12T14:56:37.009Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: smartagenda Products: Smart Agenda – Prise de rendez-vous en ligne Problem Types: CWE-79 Description: The Smart Agenda – Prise de rendez-vous en ligne plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'smartagenda' shortcode in all versions up to, and including, 4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary we
tes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1a7bb274-9bbf-4d78-ad81-0e7ac6b7b265?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3201483%40smart-agenda-prise-de-rendez-vous-en-ligne&new=3201483%40smart-agenda-prise-de-rendez-vous-en-ligne&sfp_email=&sfph_mail=