Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ly. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261367. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261367 - https://vuldb.com/?ctiid.261367 - https://vuldb.com/?submit.313847 - https://github.com/ggfzx/OCP-Security-Misconfiguration/tree/main
CVE ID: CVE-2024-3929 State: PUBLISHED Published: 2024-04-25T07:33:58.101Z Last Updated: 2024-08-01T20:26:57.105Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pt-guy Products: Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Widget Post Overlay block in all versions up to, and including, 3.7.0 due to
ble to Stored Cross-Site Scripting via the Widget Post Overlay block in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5666da4a-ffb6-47ed-8b48-a80f09dd2501?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3074758%40content-views-q
?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3074758%40content-views-query-and-display-post-page&new=3074758%40content-views-query-and-display-post-page&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3930 State: PUBLISHED Published: 2024-07-30T18:36:18.443Z Last Updated: 2024-09-09T20:31:37.770Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Akana Products: Akana API Platform Problem Types: CWE-611 Description: In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://portal.perforce.com/s/detail/a91PA000001SUKLYA4
CVE ID: CVE-2024-3931 State: PUBLISHED Published: 2024-04-18T00:00:04.983Z Last Updated: 2025-06-10T05:14:33.471Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C) Vendors: Totara Products: LMS Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Totara LMS up to 18.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file admin/roles/check.php of the component User Selector. The manipulation of the argument ID Number leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 13.46, 14.38, 15.33, 16.27, 17.21 and 18.8 is a
t has been disclosed to the public and may be used. Upgrading to version 13.46, 14.38, 15.33, 16.27, 17.21 and 18.8 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261368 - https://vuldb.com/?ctiid.261368 - https://totara.community/mod/forum/discuss.php?d=27644
CVE ID: CVE-2024-3932 State: PUBLISHED Published: 2024-04-18T00:00:06.007Z Last Updated: 2025-06-11T13:59:27.426Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C) Vendors: Totara Products: LMS Problem Types: CWE-352, CWE-862 Description: A vulnerability classified as problematic has been found in Totara LMS up to 18.7. This affects an unknown part of the component User Selector. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 13.46, 14.
y is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 13.46, 14.38, 15.33, 16.27, 17.21 and 18.8 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.261369 - https://vuldb.com/?ctiid.261369 - https://vuldb.com/?submit.314381 - https://totara.community/mod/forum/discuss.php?d=27644
CVE ID: CVE-2024-3933 State: PUBLISHED Published: 2024-05-27T06:08:15.898Z Last Updated: 2024-08-01T20:26:57.273Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L) Vendors: Eclipse Foundation Products: Open J9 Problem Types: CWE-805, CWE-125, CWE-787 Description: In Eclipse OpenJ9 release versions prior to 0.44.0 and after 0.13.0, when running with JVM option -Xgc:concurrentScavenge, the sequence generated for System.arrayCopy on the IBM Z platform with hardware and software support for guarded storage [1], could allow access to a buffer with an incorrect length value when executing an arraycopy sequence while the Concurrent Scavenge Garbage Collection cycle is active
rect length value when executing an arraycopy sequence while the Concurrent Scavenge Garbage Collection cycle is active and the source and destination memory regions for arraycopy overlap. This allows read and write to addresses beyond the end of the array range. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.eclipse.org/security/cve-assignement/-/issues/21 - https://github.com/eclipse/omr/pull/7275
CVE ID: CVE-2024-3934 State: PUBLISHED Published: 2024-07-20T03:20:31.151Z Last Updated: 2024-08-01T20:26:57.162Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: claudiosanches Products: Mercado Pago payments for WooCommerce Problem Types: CWE-22 Description: The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to Path Traversal in versions 7.3.0 to 7.5.1 via the mercadopagoDownloadLog function. This makes it possible for authenticated attackers, with subscriber-level access and above, to download and read the contents of arbitrary files on the server, which can contain sensitive information. The arbitrary file download was patched in
ts of arbitrary files on the server, which can contain sensitive information. The arbitrary file download was patched in 7.5.1, while the missing authorization was corrected in version 7.6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1674e81e-6a75-436c-b219-8ec0a484a134?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-mercadopago/trunk/src/Admin/Settings.php#L663 - https://plugins.trac.wordpress.org/changeset/3098023/woocommerce-mercadopago/trunk/src/IO/Downloader.php?old=3078706&old_path=woocommerce-mercadopago%2Ftrunk%2Fsrc%2FIO%2FDownloader.php - https://plugins.tra
IO/Downloader.php?old=3078706&old_path=woocommerce-mercadopago%2Ftrunk%2Fsrc%2FIO%2FDownloader.php - https://plugins.trac.wordpress.org/changeset/3119214/woocommerce-mercadopago/tags/7.6.2/src/IO/Downloader.php?old=3108278&old_path=woocommerce-mercadopago%2Ftags%2F7.6.1%2Fsrc%2FIO%2FDownloader.php
CVE ID: CVE-2024-3935 State: PUBLISHED Published: 2024-10-30T11:45:23.506Z Last Updated: 2025-11-03T20:38:15.605Z Vendors: Eclipse Foundation Products: mosquitto Problem Types: CWE-415 Description: In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.eclipse.org/security/vulnerab
lyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/197 - https://mosquitto.org/blog/2024/10/version-2-0-19-released/ - https://github.com/eclipse-mosquitto/mosquitto/commit/ae7a804dadac8f2aaedb24336df8496a9680fda9
CVE ID: CVE-2024-3936 State: PUBLISHED Published: 2024-05-02T16:52:51.888Z Last Updated: 2024-08-01T20:26:57.209Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: techlabpro1 Products: The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid Problem Types: CWE-862 Missing Authorization Description: The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtTPGSaveSettings function in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with subscriber access or h
ll versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with subscriber access or higher, to change the plugin's settings and invoke other functions hooked by AJAX actions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f4ef2ced-3c82-4379-8b14-1cf11482fd35?source=cve - https://plugins.trac.wordpress.org/browser/the-post-grid/trunk/app/Controllers/AjaxController.php#L130 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3078599%40the-post-grid%2Ftrunk&old=3061874%40the-post-grid%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3937 State: PUBLISHED Published: 2024-05-29T06:00:02.324Z Last Updated: 2025-03-14T00:59:35.490Z Vendors: Unknown Products: Playlist for Youtube Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Playlist for Youtube WordPress plugin through 1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/0cd5b288-05b3-48b7-9245-f59ce7377861/
CVE ID: CVE-2024-3938 State: PUBLISHED Published: 2024-07-25T21:17:49.359Z Last Updated: 2024-08-01T20:26:57.098Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: dotCMS Products: dotCMS core Problem Types: CWE-20 Description: The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a http://localhost:8082/dotAdmin/#/public/login?resetEmailSent=true&resetEmail=%3Ch1%3E%3Ca%20href%3D%22https:%2F%2Fgoogle.com%22%3ECLICK%20ME%3C%2Fa%3E%3C%2Fh1%3E This will result in a view along these lin
E%3Ca%20href%3D%22https:%2F%2Fgoogle.com%22%3ECLICK%20ME%3C%2Fa%3E%3C%2Fh1%3E This will result in a view along these lines: * OWASP Top 10 - A03: Injection * CVSS Score: 5.4 * AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator * https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N&... https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dotcms.com/security/SI-71
CVE ID: CVE-2024-3939 State: PUBLISHED Published: 2024-05-27T06:00:01.202Z Last Updated: 2025-03-14T00:56:04.887Z Vendors: Unknown Products: Ditty Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ditty WordPress plugin before 3.1.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/80a9eb3a-2cb1-4844-9004-ba2554b2d46c/
CVE ID: CVE-2024-3940 State: PUBLISHED Published: 2024-05-10T06:00:02.589Z Last Updated: 2025-03-24T16:30:46.012Z Vendors: Unknown Products: reCAPTCHA Jetpack Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/bb0245e5-8e94-4f11-9003-d6208945056c/
CVE ID: CVE-2024-3941 State: PUBLISHED Published: 2024-05-10T06:00:02.776Z Last Updated: 2025-03-28T19:17:28.423Z Vendors: Unknown Products: reCAPTCHA Jetpack Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged-in admin add Stored XSS payloads via a CSRF attack. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/6e09e922-983c-4406-8053-747d839995d1/
CVE ID: CVE-2024-3942 State: PUBLISHED Published: 2024-05-02T16:52:11.285Z Last Updated: 2024-08-01T20:26:57.163Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: stylemix Products: MasterStudy LMS WordPress Plugin – for Online Courses and Education Problem Types: CWE-862 Missing Authorization Description: The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on several functions in versions up to, and including, 3.3.8. This makes it possible for authenticated attackers, with subscriber level permissions and above, to r
including, 3.3.8. This makes it possible for authenticated attackers, with subscriber level permissions and above, to read and modify content such as course questions, post titles, and taxonomies. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/64eb3d67-7056-4a03-ba3b-a04c2e96648d?source=cve - https://plugins.trac.wordpress.org/changeset/3078394/
CVE ID: CVE-2024-3943 State: PUBLISHED Published: 2024-05-30T04:31:55.047Z Last Updated: 2024-08-01T20:26:57.039Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: delower186 Products: WP To Do Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodo_addcomment function. This makes it possible for unauthenticated attackers to add comments to to do items via a forged request granted they can trick a site administrator into performing an action such as clicking o
o do items via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/406f6bd7-f57f-4725-a36f-9846ac04f945?source=cve - https://plugins.trac.wordpress.org/browser/wp-todo/trunk/inc/Base/Model.php#L225
CVE ID: CVE-2024-3944 State: PUBLISHED Published: 2024-08-29T05:30:56.826Z Last Updated: 2024-08-29T14:04:25.099Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: delower186 Products: WP To Do Problem Types: CWE-79 Description: The WP To Do plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations
scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b36b9b8a-41b0-4b57-92c7-5acebe2b0bae?source=cve - https://plugins.trac.wordpress.org/browser/wp-todo/trunk/inc/Base/Model.php#L225
CVE ID: CVE-2024-3945 State: PUBLISHED Published: 2024-05-30T04:31:55.582Z Last Updated: 2024-08-01T20:26:57.231Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: delower186 Products: WP To Do Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodo_manage() function. This makes it possible for unauthenticated attackers to add new todo items via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. A
via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/69475bec-1f27-4793-8697-1132ac701c62?source=cve - https://plugins.trac.wordpress.org/browser/wp-todo/trunk/inc/Base/Model.php#L273
CVE ID: CVE-2024-3946 State: PUBLISHED Published: 2024-05-30T04:31:57.099Z Last Updated: 2024-08-01T20:26:57.215Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: delower186 Products: WP To Do Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP To Do plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will e
nticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - ADP Container: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/de648bea-35c5-4611-aa2f-79e37a0299bb?source=cve - https://plugins.trac.wordpress.org/browser/wp-todo/trunk/inc/Base/Model.php#L304
CVE ID: CVE-2024-3947 State: PUBLISHED Published: 2024-05-30T04:31:56.647Z Last Updated: 2024-08-01T20:26:57.161Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: delower186 Products: WP To Do Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodo_settings() function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking
's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c132cfc1-03b3-4616-9a66-871e88c857cb?source=cve - https://plugins.trac.wordpress.org/browser/wp-todo/trunk/inc/Base/Model.php#L304
CVE ID: CVE-2024-3948 State: PUBLISHED Published: 2024-04-18T11:00:05.499Z Last Updated: 2024-08-08T19:39:32.956Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Home Clean Service System Problem Types: CWE-434 Description: A vulnerability was found in SourceCodester Home Clean Service System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file \admin\student.add.php of the component Photo Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261440. Additional Ana
oit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261440. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.261440 - https://vuldb.com/?ctiid.261440 - https://vuldb.com/?submit.318722 - https://github.com/xuanluansec/vul/issues/5
CVE ID: CVE-2024-3951 State: PUBLISHED Published: 2024-05-08T14:38:31.791Z Last Updated: 2024-08-01T20:26:57.164Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: PTC Products: Codebeamer Problem Types: CWE-79 Description: PTC Codebeamer is vulnerable to a cross site scripting vulnerability that could allow an attacker to inject and execute malicious code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-128-01
CVE ID: CVE-2024-3952 State: PUBLISHED Published: 2024-05-09T20:03:26.219Z Last Updated: 2024-08-01T20:26:57.147Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: monetizemore Products: Advanced Ads – Ad Manager & AdSense Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Ad widget in all versions up to, and including, 1.52.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with co
anitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4ea634b5-72db-428c-96b4-15ef6025ab1d?source=cve - https://plugins.trac.wordpress.org/browser/advanced-ads/tags/1.52.1/modules/gutenberg/includes/class-gutenberg.php#L224 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3081914%40advanced-ads&new=3081914%40advanc
s://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3081914%40advanced-ads&new=3081914%40advanced-ads&sfp_email=&sfph_mail=#file4
CVE ID: CVE-2024-3953 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:33.107Z Description: No description available.