Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12395 State: PUBLISHED Published: 2024-12-17T11:10:18.505Z Last Updated: 2024-12-17T17:29:15.806Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: amitwpdeveloper Products: WooCommerce Additional Fees On Checkout (Free) Problem Types: CWE-79 Description: The WooCommerce Additional Fees On Checkout (Free) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘number’ parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user
or unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b09dc4dc-d2b9-452a-b005-b69feffdbecf?source=cve - https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-admin.php#L28 - https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-admin.php#L31 - https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes
t-cst-admin.php#L31 - https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-admin.php#L38 - https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-admin.php#L47 - https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-admin.php#L53 - https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-admin.php#L59 - https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-admin.php#L66 - https://plugins.trac.wordpress.org/browser/
itional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-admin.php#L66 - https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-admin.php#L76 - https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-admin.php#L90 - https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-admin.php#L96 - https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-admin.php#L117 - https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-adm
117 - https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-admin.php#L127 - https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-admin.php#L138 - https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-admin.php#L149 - https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-admin.php#L173 - https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-admin.php#L200 - https://plugins.trac.wordpress.org/changeset/3208205/
CVE ID: CVE-2024-12397 State: PUBLISHED Published: 2024-12-12T09:05:28.451Z Last Updated: 2025-11-11T16:11:24.359Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Cryostat 4 on RHEL 9, HawtIO HawtIO 4.2.0, Red Hat build of Quarkus 3.15.3, Cryostat 3, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apicurio Registry 2, Red Hat Build of Keycloak, Red Hat build of OptaPlanner 8, Red Hat Fuse 7, Red Hat Integration Camel K 1, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Process Automation 7, streams for Apache Kafka Problem Types: CWE-444 Description: A flaw
atform Expansion Pack, Red Hat Process Automation 7, streams for Apache Kafka Problem Types: CWE-444 Description: A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:0900 - https://access.redhat.com/errata/RHSA-2025:3018 - https://access.red
- https://access.redhat.com/errata/RHSA-2025:0900 - https://access.redhat.com/errata/RHSA-2025:3018 - https://access.redhat.com/errata/RHSA-2025:8761 - https://access.redhat.com/security/cve/CVE-2024-12397 - https://bugzilla.redhat.com/show_bug.cgi?id=2331298
CVE ID: CVE-2024-12398 State: PUBLISHED Published: 2025-01-14T01:39:04.348Z Last Updated: 2025-01-14T15:26:24.681Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: WBE530 firmware, WBE660S firmware Problem Types: CWE-269 Description: An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00(ACLE.3) and WBE660S firmware versions through 6.70(ACGG.2) could allow an authenticated user with limited privileges to escalate their privileges to that of an administrator, enabling them to upload configuration files to a vulnerable device. Additional Analyst Notes: - CISA ADP Vulnrichm
ator, enabling them to upload configuration files to a vulnerable device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-improper-privilege-management-vulnerability-in-aps-and-security-router-devices-01-14-2025
CVE ID: CVE-2024-12399 State: PUBLISHED Published: 2025-01-17T09:37:35.734Z Last Updated: 2025-09-09T20:41:23.793Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H) Vendors: Schneider Electric Products: Pro-face GP-Pro EX, Pro-face Remote HMI Problem Types: CWE-924 Description: CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause partial loss of confidentiality, loss of integrity and availability of the HMI when attacker performs man in the middle attack by intercepting the communication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.c
he communication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-02.pdf
CVE ID: CVE-2024-12400 State: PUBLISHED Published: 2025-01-30T06:00:09.161Z Last Updated: 2025-01-30T15:49:07.509Z Vendors: Unknown Products: tourmaster Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3542315c-93c3-41dd-a99e-02a38cfd58fb/
CVE ID: CVE-2024-12401 State: PUBLISHED Published: 2024-12-12T09:06:03.612Z Last Updated: 2025-11-21T06:28:17.721Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: cert-manager Operator for Red Hat OpenShift, Cryostat 3, Multicluster Engine for Kubernetes, OpenShift Serverless, Red Hat Connectivity Link 1, Red Hat OpenShift Container Platform 4, Red Hat Openshift Data Foundation 4, Red Hat OpenShift GitOps Problem Types: CWE-20 Description: A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-m
odify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the cert-manager controller pod to effectively create a denial-of-service (DoS) vector for the cert-manager in the cluster. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-12401 - https://bugzilla.redhat.com/show_bug.cgi?id=2327929 - https://github.com/cert-manager/cert-manager/pull/7400 - https://github.com/cert-manager/cert-manager/pull/7401 - https://github.com/cert-manager/cert-manager/pull/7402 - https://github.com/cert-manager/cert-manager/pull/7403 - https://github.com/cert-manager/cert-manager/security/advisorie
https://github.com/cert-manager/cert-manager/pull/7403 - https://github.com/cert-manager/cert-manager/security/advisories/GHSA-r4pg-vg54-wxx4 - https://go.dev/issue/50116
CVE ID: CVE-2024-12402 State: PUBLISHED Published: 2025-01-07T03:21:53.748Z Last Updated: 2025-01-07T16:29:41.573Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: themescoder Products: Themes Coder – Create Android & iOS Apps For Your Woocommerce Site Problem Types: CWE-288 Description: The Themes Coder – Create Android & iOS Apps For Your Woocommerce Site plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.4. This is due to the plugin not properly validating a user's identity prior to updating their password through the update_user_profile() function. This makes it possible for unauthen
dentity prior to updating their password through the update_user_profile() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1ec14b1e-6d1a-4451-9fce-ac064623d92f?source=cve - https://plugins.trac.wordpress.org/browser/tc-ecommerce/trunk/controller/app_user.php#L338
CVE ID: CVE-2024-12403 State: PUBLISHED Published: 2025-01-15T09:25:55.266Z Last Updated: 2025-01-15T14:29:06.768Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: realwebcare Products: Awesome Responsive Photo Gallery – Image & Video Lightbox Gallery Problem Types: CWE-79 Description: The Image Gallery – Responsive Photo Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'awsmgallery' parameter in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfull
it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ca11e840-04bd-4731-bfa9-3bf8ed98e155?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3221064%40awesome-responsive-photo-gallery&new=3221064%40awesome-responsive-photo-gallery&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/browser/awesome-responsive-photo-gallery/trunk/inc/arpg-process-options.php?rev=1877314
CVE ID: CVE-2024-12404 State: PUBLISHED Published: 2025-01-11T02:20:53.175Z Last Updated: 2025-01-13T19:55:05.750Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: crowdfavorite Products: CF Internal Link Shortcode Problem Types: CWE-89 Description: The CF Internal Link Shortcode plugin for WordPress is vulnerable to SQL Injection via the 'post_title' parameter in all versions up to, and including, 1.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to ext
ble for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1661bb28-e5b4-4319-84bb-6cbeac266147?source=cve - https://plugins.trac.wordpress.org/browser/internal-link-shortcode/trunk/internal-link-shortcode.php#L82
CVE ID: CVE-2024-12405 State: PUBLISHED Published: 2024-12-24T05:23:45.377Z Last Updated: 2024-12-24T15:26:19.660Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: fahadmahmood Products: Export Customers Data Problem Types: CWE-79 Description: The Export Customers Data plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 't' parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Add
ts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ed61c037-a73c-477e-a5b5-3b4781cec130?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3210666%40export-customers-data&new=3210666%40export-customers-data&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12406 State: PUBLISHED Published: 2024-12-12T04:23:09.132Z Last Updated: 2024-12-12T15:06:31.111Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: owthub Products: Library Management System – Manage e-Digital Books Library Problem Types: CWE-89 Description: The Library Management System – Manage e-Digital Books Library plugin for WordPress is vulnerable to SQL Injection via the 'owt7_borrow_books_id' parameter in all versions up to, and including, 3.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-le
sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0b4cb873-77b7-44f9-820c-38e5d43393f3?source=cve - https://plugins.trac.wordpress.org/browser/library-management-system/trunk/admin/class-library-management-system-admin.php#L1882
CVE ID: CVE-2024-12407 State: PUBLISHED Published: 2025-01-11T07:21:54.994Z Last Updated: 2025-01-13T17:06:46.248Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: murali-indiacitys Products: Push Notification for Post and BuddyPress Problem Types: CWE-79 Description: The Push Notification for Post and BuddyPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pushnotificationid' parameter in all versions up to, and including, 2.06 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a u
e for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/de7be653-4d5b-4cbe-ad9c-6c2748f533bb?source=cve - https://plugins.trac.wordpress.org/browser/push-notification-for-post-and-buddypress/trunk/admin/pnfpb_admin_ondemand_notification_settings.php#L711
CVE ID: CVE-2024-12408 State: PUBLISHED Published: 2024-12-21T09:23:54.816Z Last Updated: 2024-12-28T00:49:14.567Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wpseahorse Products: WP on AWS Problem Types: CWE-79 Description: The WP on AWS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_POST data in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA AD
can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8c82dc37-0b9a-48c2-a8a6-fbee6182003f?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3209870%40wp-migrate-2-aws&new=3209870%40wp-migrate-2-aws&sfp_email=&sfph_mail=#file2
CVE ID: CVE-2024-12409 State: PUBLISHED Published: 2025-01-30T11:10:19.927Z Last Updated: 2025-02-18T19:05:26.947Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: simplepress Products: Simple:Press Forum Problem Types: CWE-79 Description: The Simple:Press Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 6.10.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Addition
pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b9ebeb96-2f39-488e-aef6-d5af0a37c24a?source=cve - https://plugins.trac.wordpress.org/browser/simplepress/trunk/admin/panel-plugins/forms/spa-plugins-list-form.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3230289%40simplepress&new=3230289%40simplepress&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12410 State: PUBLISHED Published: 2025-04-02T09:21:44.350Z Last Updated: 2025-04-02T14:43:59.241Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: rustaurius Products: Front End Users Problem Types: CWE-89 Description: The Front End Users plugin for WordPress is vulnerable to SQL Injection via the 'UserSearchField' parameter in all versions up to, and including, 3.2.32 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive in
icated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/975ddadd-12f8-4ace-9c1a-489114a2da6a?source=cve - https://plugins.trac.wordpress.org/browser/front-end-only-users/trunk/html/UsersPage.php#L55
CVE ID: CVE-2024-12411 State: PUBLISHED Published: 2024-12-14T04:23:44.482Z Last Updated: 2024-12-16T17:49:55.939Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: onetarek Products: WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More Problem Types: CWE-79 Description: The WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will
utput escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aa9edf84-7ba0-488c-93ca-ed0b2ee435d5?source=cve - https://plugins.trac.wordpress.org/browser/wp-ad-guru/trunk/includes/admin/zone-manager/zone-manager-page.php#L16
CVE ID: CVE-2024-12412 State: PUBLISHED Published: 2025-01-11T07:21:53.135Z Last Updated: 2025-01-13T17:12:46.562Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: magepeopleteam Products: Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently | WordPress plugin Problem Types: CWE-79 Description: The Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently | WordPress plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘active_tab’ parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This mak
rameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b0cde64f-2533-46e0-9268-b9d100fb0a82?source=cve - https://plugins.trac.wordpress.org/browser/booking-and-rental-manager-for-woocommerce/trunk/templates/template_segment/resort_info.php
CVE ID: CVE-2024-12413 State: PUBLISHED Published: 2024-12-25T03:21:31.601Z Last Updated: 2024-12-27T15:17:35.716Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: webwizardsdev Products: MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution Problem Types: CWE-862 Description: The MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions like 'marketking_delete_team_member', 'marketkingrejectuser', 'marketking_save_profile_settings', and many more in all versions up to, and including, 2.0.00. This makes it possible for unauthen
_save_profile_settings', and many more in all versions up to, and including, 2.0.00. This makes it possible for unauthenticated attackers to delete users, update settings, approve users, and more. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3cb809c9-7167-4333-969f-0141c96342bd?source=cve - https://plugins.trac.wordpress.org/changeset/3212032/marketking-multivendor-marketplace-for-woocommerce/trunk/includes/class-marketking-core.php
CVE ID: CVE-2024-12414 State: PUBLISHED Published: 2024-12-13T08:24:48.670Z Last Updated: 2024-12-16T20:07:46.915Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: themifyme Products: Themify Store Locator Problem Types: CWE-352 Description: The Themify Store Locator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the setting_page() function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.