Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-49669 State: PUBLISHED Published: 2024-10-23T15:35:26.441Z Last Updated: 2024-10-23T17:21:36.748Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Alexander De Ridder Products: INK Official Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Alexander De Ridder INK Official allows Upload a Web Shell to a Web Server.This issue affects INK Official: from n/a through 4.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ink-official/wordpress-ink-official-plugin-4-1-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2024-49670 State: PUBLISHED Published: 2024-10-29T11:05:05.295Z Last Updated: 2024-10-29T15:19:32.638Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Sam Glover Products: Client Power Tools Portal Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sam Glover Client Power Tools Portal allows Reflected XSS.This issue affects Client Power Tools Portal: from n/a through 1.8.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/client-power-tools/wordpress-client-power-tools-portal-plugin-1-8-6-reflect
ttps://patchstack.com/database/vulnerability/client-power-tools/wordpress-client-power-tools-portal-plugin-1-8-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-49671 State: PUBLISHED Published: 2024-10-23T15:34:23.381Z Last Updated: 2024-10-23T17:27:17.402Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Dogu Pekgoz Products: AI Image Generator for Your Content & Featured Images – AI Postpix Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Dogu Pekgoz AI Image Generator for Your Content & Featured Images – AI Postpix allows Upload a Web Shell to a Web Server.This issue affects AI Image Generator for Your Content & Featured Images – AI Postpix: from n/a through 1.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchs
es – AI Postpix: from n/a through 1.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ai-postpix/wordpress-ai-postpix-plugin-1-1-8-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2024-49672 State: PUBLISHED Published: 2024-10-29T11:04:02.499Z Last Updated: 2024-10-29T15:20:30.866Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Gifford Cheung, Brian Watanabe, Chongsun Ahn Products: Google Docs RSVP Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Gifford Cheung, Brian Watanabe, Chongsun Ahn Google Docs RSVP allows Stored XSS.This issue affects Google Docs RSVP: from n/a through 2.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/google-docs-rsvp-guestlist/wordpress-google-docs-rsvp-plugin-2-0-1-csrf-to-stored-cross-site-s
om/database/vulnerability/google-docs-rsvp-guestlist/wordpress-google-docs-rsvp-plugin-2-0-1-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-49673 State: PUBLISHED Published: 2024-10-29T11:02:52.703Z Last Updated: 2024-10-29T14:49:54.750Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Van Abel Products: LaTeX2HTML Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Van Abel LaTeX2HTML allows Reflected XSS.This issue affects LaTeX2HTML: from n/a through 2.5.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/latex2html/wordpress-latex2html-plugin-2-5-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-49674 State: PUBLISHED Published: 2024-10-31T10:01:19.117Z Last Updated: 2024-10-31T13:50:38.308Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Lukas Huser Products: EKC Tournament Manager Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Lukas Huser EKC Tournament Manager allows Upload a Web Shell to a Web Server.This issue affects EKC Tournament Manager: from n/a through 2.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ekc-tournament-manager/wordpress-ekc-tournament-manager-plugin-2-2-1-csrf-to-arbitrary-file-upload-vulnerability?_
ility/ekc-tournament-manager/wordpress-ekc-tournament-manager-plugin-2-2-1-csrf-to-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2024-49675 State: PUBLISHED Published: 2024-10-23T15:11:19.531Z Last Updated: 2024-10-23T15:37:57.173Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Vitalii Bryl Products: iBryl Switch User Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Vitalii Bryl iBryl Switch User allows Authentication Bypass.This issue affects iBryl Switch User: from n/a through 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ibryl-switch-user/wordpress-ibryl-switch-user-plugin-1-0-1-account-takeover-vulnerability?_s_id=cve
CVE ID: CVE-2024-49676 State: PUBLISHED Published: 2024-10-23T15:31:36.370Z Last Updated: 2024-10-23T18:21:12.015Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: Michael Bourne Products: Custom Icons for Elementor Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Michael Bourne Custom Icons for Elementor allows Upload a Web Shell to a Web Server.This issue affects Custom Icons for Elementor: from n/a through 0.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/custom-icons-for-elementor/wordpress-custom-icons-for-elementor-plugin-0-3-3-arbitra
tchstack.com/database/vulnerability/custom-icons-for-elementor/wordpress-custom-icons-for-elementor-plugin-0-3-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2024-49677 State: PUBLISHED Published: 2024-12-18T11:38:27.997Z Last Updated: 2024-12-18T14:36:06.994Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: David Cramer Products: Bootstrap Buttons Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Cramer Bootstrap Buttons allows Reflected XSS.This issue affects Bootstrap Buttons: from n/a through 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bootstrap-buttons/vulnerability/wordpress-bootstrap-buttons-plugin-1-2-reflected-cross-site-scripting
e/wordpress/plugin/bootstrap-buttons/vulnerability/wordpress-bootstrap-buttons-plugin-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-49678 State: PUBLISHED Published: 2024-10-29T11:01:41.336Z Last Updated: 2024-10-29T14:50:05.436Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Jinwen Products: js paper Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jinwen js allows Reflected XSS.This issue affects js paper: from n/a through 2.5.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/js-paper/wordpress-js-paper-theme-2-5-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-49679 State: PUBLISHED Published: 2024-10-29T10:58:55.207Z Last Updated: 2024-10-29T14:28:52.351Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: WPKoi Products: WPKoi Templates for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPKoi WPKoi Templates for Elementor allows Stored XSS.This issue affects WPKoi Templates for Elementor: from n/a through 3.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wpkoi-templates-for-elementor/wordpress-wpkoi-templates-for-elementor-plug
https://patchstack.com/database/vulnerability/wpkoi-templates-for-elementor/wordpress-wpkoi-templates-for-elementor-plugin-3-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-49680 State: PUBLISHED Published: 2024-11-19T16:30:40.691Z Last Updated: 2024-11-20T14:36:18.681Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Rextheme Products: WP VR Problem Types: CWE-862 Description: Missing Authorization vulnerability in Rextheme WP VR allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 8.5.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wpvr/wordpress-wpvr-plugin-8-5-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-49681 State: PUBLISHED Published: 2024-10-24T12:09:17.133Z Last Updated: 2024-10-24T13:45:50.507Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: SWIT Products: WP Sessions Time Monitoring Full Automatic Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SWIT WP Sessions Time Monitoring Full Automatic allows SQL Injection.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through 1.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/activitytime/wordpress-wp-sessions-time
SA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/activitytime/wordpress-wp-sessions-time-monitoring-full-automatic-plugin-1-0-9-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-49682 State: PUBLISHED Published: 2024-10-24T11:36:25.222Z Last Updated: 2024-10-24T20:37:48.667Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: smp7, wp.insider Products: Simple Membership Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in smp7, wp.Insider Simple Membership allows Phishing.This issue affects Simple Membership: from n/a through 4.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/simple-membership/wordpress-simple-membership-plugin-4-5-3-open-redirection-vulnerability?_s_id=cve
CVE ID: CVE-2024-49683 State: PUBLISHED Published: 2024-10-24T11:37:48.522Z Last Updated: 2024-10-24T20:38:41.843Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Schema & Structured Data for WP & AMP Products: Schema & Structured Data for WP & AMP Problem Types: CWE-862 Description: Missing Authorization vulnerability in Schema & Structured Data for WP & AMP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Schema & Structured Data for WP & AMP: from n/a through 1.3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/schema-and-structured-data-for-wp/wordpress-sch
ulnrichment: References: - https://patchstack.com/database/vulnerability/schema-and-structured-data-for-wp/wordpress-schema-structured-data-for-wp-amp-plugin-1-3-5-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2024-49684 State: PUBLISHED Published: 2024-10-23T15:13:55.505Z Last Updated: 2024-10-23T18:51:50.168Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Revmakx Products: Backup and Staging by WP Time Capsule Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Revmakx Backup and Staging by WP Time Capsule allows Object Injection.This issue affects Backup and Staging by WP Time Capsule: from n/a through 1.22.21. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-time-capsule/wordpress-backup-and-staging-by-wp-time-capsule-plugin-1-22-21-php-object-injecti
database/vulnerability/wp-time-capsule/wordpress-backup-and-staging-by-wp-time-capsule-plugin-1-22-21-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-49685 State: PUBLISHED Published: 2024-10-31T09:59:49.185Z Last Updated: 2024-10-31T13:00:40.058Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Smash Balloon Products: Custom Twitter Feeds (Tweets Widget) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds (Tweets Widget) allows Cross Site Request Forgery.This issue affects Custom Twitter Feeds (Tweets Widget): from n/a through 2.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/custom-twitter-feeds/wordpress-custom-twitter-feeds-plugin-2-2-3-cross-site-re
s://patchstack.com/database/vulnerability/custom-twitter-feeds/wordpress-custom-twitter-feeds-plugin-2-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-49686 State: PUBLISHED Published: 2024-12-31T13:57:15.311Z Last Updated: 2024-12-31T15:02:01.232Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Fatcat Apps Products: Landing Page Cat Problem Types: CWE-862 Description: Missing Authorization vulnerability in Fatcat Apps Landing Page Cat.This issue affects Landing Page Cat: from n/a through 1.7.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/landing-page-cat/vulnerability/wordpress-landing-page-cat-plugin-1-7-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-49687 State: PUBLISHED Published: 2024-12-31T13:56:30.696Z Last Updated: 2024-12-31T15:02:46.153Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: StoreApps Products: Smart Manager Problem Types: CWE-862 Description: Missing Authorization vulnerability in StoreApps Smart Manager.This issue affects Smart Manager: from n/a through 8.45.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/smart-manager-for-wp-e-commerce/vulnerability/wordpress-smart-manager-plugin-8-45-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-49688 State: PUBLISHED Published: 2025-01-21T13:40:33.140Z Last Updated: 2025-01-21T15:54:14.915Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NotFound Products: ARPrice Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in NotFound ARPrice allows Object Injection. This issue affects ARPrice: from n/a through 4.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/arprice/vulnerability/wordpress-arprice-plugin-4-0-3-unauthenticated-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-49689 State: PUBLISHED Published: 2024-11-19T16:30:40.096Z Last Updated: 2024-11-20T14:36:18.784Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Harmonic Design Products: HD Quiz – Save Results Light Problem Types: CWE-862 Description: Missing Authorization vulnerability in Harmonic Design HD Quiz – Save Results Light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HD Quiz – Save Results Light: from n/a through 0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/hd-quiz-save-results-light/wordpress-hd-quiz-save-results-light-plugin-0-5
https://patchstack.com/database/vulnerability/hd-quiz-save-results-light/wordpress-hd-quiz-save-results-light-plugin-0-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-49690 State: PUBLISHED Published: 2024-10-23T15:16:41.285Z Last Updated: 2024-10-23T18:36:46.215Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Qode Interactive Products: Qi Blocks Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Qode Interactive Qi Blocks.This issue affects Qi Blocks: from n/a through 1.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/qi-blocks/wordpress-qi-blocks-plugin-1-3-2-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-49691 State: PUBLISHED Published: 2024-10-24T12:06:24.675Z Last Updated: 2024-10-24T13:48:24.085Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Woobewoo Products: Product Filter by WBW Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Woobewoo Product Filter by WBW allows SQL Injection.This issue affects Product Filter by WBW: from n/a through 2.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woo-product-filter/wordpress-product-filter-by-wbw-plugin-2-7-0-sql-injection-vulnerability?_s_id=
atabase/vulnerability/woo-product-filter/wordpress-product-filter-by-wbw-plugin-2-7-0-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-49692 State: PUBLISHED Published: 2024-10-29T10:57:20.420Z Last Updated: 2024-10-29T14:32:21.845Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: AffiliateX Products: AffiliateX Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AffiliateX allows Stored XSS.This issue affects AffiliateX: from n/a through 1.2.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/affiliatex/wordpress-affiliatex-plugin-1-2-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-49693 State: PUBLISHED Published: 2024-10-24T12:41:55.270Z Last Updated: 2024-10-24T13:23:13.988Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Kraftplugins Products: Mega Elements Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kraftplugins Mega Elements allows Stored XSS.This issue affects Mega Elements: from n/a through 1.2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mega-elements-addons-for-elementor/wordpress-mega-elements-addons-for-elementor-plugin-1-2-6-cross-site-scri
lnerability/mega-elements-addons-for-elementor/wordpress-mega-elements-addons-for-elementor-plugin-1-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-49694 State: PUBLISHED Published: 2024-12-31T13:55:01.634Z Last Updated: 2024-12-31T15:03:26.990Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: imw3 Products: My Wp Brand – Hide menu & Hide Plugin Problem Types: CWE-862 Description: Missing Authorization vulnerability in imw3 My Wp Brand – Hide menu & Hide Plugin.This issue affects My Wp Brand – Hide menu & Hide Plugin: from n/a through 1.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/my-wp-brand/vulnerability/wordpress-my-wp-brand-hide-menu-hide-plugin-plugin-1-1-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-49695 State: PUBLISHED Published: 2024-10-24T12:38:03.485Z Last Updated: 2024-10-24T13:38:23.198Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Spiffy Plugins Products: WP Flow Plus Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus allows Stored XSS.This issue affects WP Flow Plus: from n/a through 5.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-imageflow2/wordpress-wp-flow-plus-plugin-5-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-49696 State: PUBLISHED Published: 2024-10-24T12:29:28.481Z Last Updated: 2024-10-24T13:40:34.496Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: RoboSoft Products: Robo Gallery Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in RoboSoft Robo Gallery allows Stored XSS.This issue affects Robo Gallery: from n/a through 3.2.21. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/robo-gallery/wordpress-photo-gallery-images-slider-in-rbs-image-gallery-plugin-3-2-21-cross-site-scripting-xss-vulnera
y/robo-gallery/wordpress-photo-gallery-images-slider-in-rbs-image-gallery-plugin-3-2-21-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-49697 State: PUBLISHED Published: 2024-11-19T16:30:39.491Z Last Updated: 2024-11-20T14:36:18.891Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: WP Sunshine Products: Sunshine Photo Cart Problem Types: CWE-862 Description: Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.2.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/sunshine-photo-cart/wordpress-sunshine-photo-cart-plugin-3-2-9-broken-access-control-vulnerability-2?_s_id=
ulnerability/sunshine-photo-cart/wordpress-sunshine-photo-cart-plugin-3-2-9-broken-access-control-vulnerability-2?_s_id=cve
CVE ID: CVE-2024-49698 State: PUBLISHED Published: 2024-12-31T13:53:26.350Z Last Updated: 2024-12-31T15:04:19.818Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: PriceListo Products: Best Restaurant Menu by PriceListo Problem Types: CWE-862 Description: Missing Authorization vulnerability in PriceListo Best Restaurant Menu by PriceListo.This issue affects Best Restaurant Menu by PriceListo: from n/a through 1.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/best-restaurant-menu-by-pricelisto/vulnerability/wordpress-great-restaurant-menu-wp-plugin-1-4-2-broken-access-control-vulnerability?
nt-menu-by-pricelisto/vulnerability/wordpress-great-restaurant-menu-wp-plugin-1-4-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-49699 State: PUBLISHED Published: 2025-01-21T13:40:33.266Z Last Updated: 2025-01-21T15:53:41.733Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NotFound Products: ARPrice Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in NotFound ARPrice allows Object Injection. This issue affects ARPrice: from n/a through 4.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/arprice/vulnerability/wordpress-arprice-plugin-4-0-3-php-object-injection-vulnerability?_s_id=cve