Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-13314 State: PUBLISHED Published: 2025-02-21T06:00:05.306Z Last Updated: 2025-02-21T17:40:55.494Z Vendors: Unknown Products: Carousel, Slider, Gallery by WP Carousel Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.7.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ae234bbe-a4af-49f5-8e0a-4fb960821e05/
CVE ID: CVE-2024-13315 State: PUBLISHED Published: 2025-02-18T05:22:27.675Z Last Updated: 2025-02-18T15:52:13.942Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: shopwarden Products: Shopwarden – Automated WooCommerce monitoring & testing Problem Types: CWE-352 Description: The Shopwarden – Automated WooCommerce monitoring & testing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.11. This is due to missing or incorrect nonce validation on the save_setting() function. This makes it possible for unauthenticated attackers to update arbitrary options and achieve privilege escalation via a forged request g
ssible for unauthenticated attackers to update arbitrary options and achieve privilege escalation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b11ed628-f736-4262-80a2-62b32948a3a4?source=cve - https://plugins.trac.wordpress.org/browser/shopwarden/trunk/shopwarden.php#L112 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3238978%40shopwarden&new=3238978%40shopwarden&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13316 State: PUBLISHED Published: 2025-02-18T08:21:43.110Z Last Updated: 2025-02-18T14:34:29.923Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: akashmalik Products: Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more Problem Types: CWE-862 Description: The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the apmswn_create_discount() function in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated att
n_create_discount() function in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to create coupons. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/95103830-9009-48df-ab15-476402b59e3f?source=cve - https://plugins.trac.wordpress.org/browser/scratch-win-giveaways-for-website-facebook/tags/2.7.0/socialscratchwin.php#L492 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3239997%40scratch-win-giveaways-for-website-facebook&new=3239997%40scratch-win-giveaways-for-website-facebook&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/change
w=3239997%40scratch-win-giveaways-for-website-facebook&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3212730%40scratch-win-giveaways-for-website-facebook&new=3212730%40scratch-win-giveaways-for-website-facebook&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13317 State: PUBLISHED Published: 2025-01-18T07:05:07.700Z Last Updated: 2025-01-21T21:26:42.237Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: advancedcreation Products: ShipWorks Connector for Woocommerce Problem Types: CWE-352 Description: The ShipWorks Connector for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.5. This is due to missing or incorrect nonce validation on the 'shipworks-wordpress' page. This makes it possible for unauthenticated attackers to update the services username and password via a forged request granted they can trick a site administrator int
ackers to update the services username and password via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/503c00f5-59e5-4ca2-ac3d-a3f38a993f0d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3223835%40shipworks-e-commerce-bridge&new=3223835%40shipworks-e-commerce-bridge&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13318 State: PUBLISHED Published: 2025-01-10T11:10:45.380Z Last Updated: 2025-01-10T14:50:09.317Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: smartdatasoft Products: Essential WP Real Estate Problem Types: CWE-463 Description: The Essential WP Real Estate plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cl_delete_listing_func() function in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to delete arbitrary pages and posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/i
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6a1a9e22-d174-43fc-aab6-f6968067a290?source=cve - https://plugins.trac.wordpress.org/browser/essential-wp-real-estate/trunk/src/Common/Ajax/Ajax.php#L724
CVE ID: CVE-2024-13319 State: PUBLISHED Published: 2025-01-22T07:29:40.540Z Last Updated: 2025-01-22T14:24:12.834Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: themifyme Products: Themify Builder Problem Types: CWE-79 Description: The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.6.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: -
if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/69ac1e37-4e31-4dce-a2d6-07a4299995c5?source=cve - https://plugins.trac.wordpress.org/changeset/3224684/themify-builder/trunk/themify/themify-admin.php
CVE ID: CVE-2024-13320 State: PUBLISHED Published: 2025-03-07T06:40:04.043Z Last Updated: 2025-03-07T15:51:09.666Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: villatheme Products: CURCY - WooCommerce Multi Currency - Currency Switcher Problem Types: CWE-89 Description: The CURCY - WooCommerce Multi Currency - Currency Switcher plugin for WordPress is vulnerable to SQL Injection via the 'wc_filter_price_meta[where]' parameter in all versions up to, and including, 2.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additi
sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6d359a5c-db11-416e-a329-c3ed67b1a925?source=cve - https://codecanyon.net/item/woocommerce-multi-currency/20948446
CVE ID: CVE-2024-13321 State: PUBLISHED Published: 2025-03-14T07:23:20.937Z Last Updated: 2025-03-14T13:30:26.440Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Solid Plugins Products: AnalyticsWP Problem Types: CWE-89 Description: The AnalyticsWP plugin for WordPress is vulnerable to SQL Injection via the 'custom_sql' parameter in all versions up to, and including, 2.0.0 due to insufficient authorization checks on the handle_get_stats() function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - C
eady existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f6507318-92c0-457c-8c87-2d023428a77f?source=cve - https://analyticswp.com/
CVE ID: CVE-2024-13322 State: PUBLISHED Published: 2025-05-02T03:21:19.226Z Last Updated: 2025-05-02T14:53:16.726Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: scripteo Products: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager Problem Types: CWE-89 Description: The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the 'a_id' parameter in all versions up to, and including, 4.88 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queri
eparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3bcb60a8-220f-45a4-a9a9-10f64acf470c?source=cve - https://codecanyon.net/item/ads-pro-plugin-multipurpose-wordpress-advertising-manager/10275010
CVE ID: CVE-2024-13323 State: PUBLISHED Published: 2025-01-14T05:24:39.032Z Last Updated: 2025-01-14T15:25:00.965Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevelop Products: WP Booking Calendar Problem Types: CWE-79 Description: The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'booking' shortcode in all versions up to, and including, 10.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user
rs, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/37731e51-33ce-4ef3-8a13-976c005dc983?source=cve - https://plugins.trac.wordpress.org/browser/booking/trunk/js/client.js#L270 - https://plugins.trac.wordpress.org/changeset/3220625/
CVE ID: CVE-2024-13324 State: REJECTED Published: N/A Last Updated: 2025-01-13T20:43:52.377Z Description: No description available.
CVE ID: CVE-2024-13325 State: PUBLISHED Published: 2025-02-04T06:00:03.948Z Last Updated: 2025-02-04T18:25:42.782Z Vendors: Unknown Products: Glossy Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Glossy WordPress plugin through 2.3.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/49bddf87-c578-47b7-a8fb-4dc550bbaa47/
CVE ID: CVE-2024-13326 State: PUBLISHED Published: 2025-02-04T06:00:08.250Z Last Updated: 2025-02-04T18:25:34.129Z Vendors: Unknown Products: iBuildApp Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The iBuildApp WordPress plugin through 0.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/dc1f755e-63f2-4f5d-a50e-9e2c589e6e4f/
CVE ID: CVE-2024-13327 State: PUBLISHED Published: 2025-02-04T06:00:08.869Z Last Updated: 2025-02-04T18:25:25.085Z Vendors: Unknown Products: Musicbox Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Musicbox WordPress plugin through 2.0.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/abc8f3e1-2aee-44f0-8ecd-0ea424c0540a/
CVE ID: CVE-2024-13328 State: PUBLISHED Published: 2025-02-04T06:00:09.212Z Last Updated: 2025-02-04T18:25:16.884Z Vendors: Unknown Products: Giga Messenger Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Giga Messenger WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/543a209b-c43c-46fc-8369-edb3b7e0ca98/
CVE ID: CVE-2024-13329 State: PUBLISHED Published: 2025-02-04T06:00:09.485Z Last Updated: 2025-02-04T16:37:57.005Z Vendors: Unknown Products: Solidres Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Solidres WordPress plugin through 0.9.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f923e557-dc3c-43b7-9545-9e92751c9783/
CVE ID: CVE-2024-13330 State: PUBLISHED Published: 2025-02-04T06:00:09.884Z Last Updated: 2025-02-04T16:36:42.430Z Vendors: Unknown Products: JustRows free Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The JustRows free WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b0360650-8c7a-4e17-8618-b5ef1c71ccbf/
CVE ID: CVE-2024-13331 State: PUBLISHED Published: 2025-02-04T06:00:10.352Z Last Updated: 2025-02-04T18:25:08.243Z Vendors: Unknown Products: WP Dream Carousel Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Dream Carousel WordPress plugin through 1.0.1b does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6425ccff-2e18-4498-b8b1-d493286efc7b/
CVE ID: CVE-2024-13332 State: PUBLISHED Published: 2025-02-04T06:00:10.855Z Last Updated: 2025-02-04T18:24:59.436Z Vendors: Unknown Products: TransFinanz Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The TransFinanz WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/35b53a2d-9a8b-49e7-9553-ea09c9c50d66/
CVE ID: CVE-2024-13333 State: PUBLISHED Published: 2025-01-17T05:29:27.068Z Last Updated: 2025-02-12T17:18:56.728Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: saadiqbal Products: Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin Problem Types: CWE-434 Description: The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fma_local_file_system' function in versions 5.2.12 to 5.2.13. This makes it possible for authenticated attackers, with Subscriber-level access and above and upload permissions granted by an administrator, to upload arbitrary files on
with Subscriber-level access and above and upload permissions granted by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. The function can be exploited only if the "Display .htaccess?" setting is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1c8bcbf8-1848-4f7a-89d8-5894de0bb18b?source=cve - https://plugins.trac.wordpress.org/browser/file-manager-advanced/trunk/application/class_fma_connector.php?rev=3200092#L78 - https://plugins.trac.wordpress.org/changeset/3222740/
CVE ID: CVE-2024-13334 State: PUBLISHED Published: 2025-01-15T03:22:29.099Z Last Updated: 2025-01-15T15:06:42.335Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: theverylastperson Products: Car Demon Problem Types: CWE-79 Description: The Car Demon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_condition' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additio
n pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6d50b1c0-9687-4ce2-bfba-c2d6a2fc28dd?source=cve - https://plugins.trac.wordpress.org/browser/car-demon/trunk/search/search-form.php
CVE ID: CVE-2024-13335 State: PUBLISHED Published: 2025-01-24T11:07:32.551Z Last Updated: 2025-01-27T14:55:26.858Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: templatescoderthemes Products: Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates Problem Types: CWE-862 Description: The Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the tmpcoder_theme_install_func() function in all versions up to, and including, 1.0.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to insta
including, 1.0.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install a theme. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4edc7ef9-33db-4433-8ef2-cd06089ee8d5?source=cve - https://plugins.trac.wordpress.org/changeset/3227353/sastra-essential-addons-for-elementor/trunk/inc/wizard/wizard-ajax-api.php
CVE ID: CVE-2024-13336 State: PUBLISHED Published: 2025-02-19T08:21:46.142Z Last Updated: 2025-02-19T19:48:03.375Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: exeebit Products: Disable Auto Updates Problem Types: CWE-352 Description: The Disable Auto Updates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the 'disable-auto-updates' page. This makes it possible for unauthenticated attackers to disable all auto updates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additi
forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/60413b3b-f9b0-40ca-af0a-f7cf87ab793a?source=cve - https://wordpress.org/plugins/disable-auto-updates/
CVE ID: CVE-2024-13337 State: PUBLISHED Published: 2025-04-12T06:37:18.373Z Last Updated: 2025-04-14T16:22:09.515Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: creativemotion Products: Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer Problem Types: CWE-352 Description: The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.2. This is due to missing or incorrect nonce validation on the 'setup-wbcr_clearfy' page. This makes it possible for unauthenticated attackers to update the plugins settings via a
the 'setup-wbcr_clearfy' page. This makes it possible for unauthenticated attackers to update the plugins settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d7f21dbe-f300-4336-9980-a69d40395f39?source=cve - https://github.dev/WordPressPluginDirectory/clearfy - https://plugins.trac.wordpress.org/changeset/3268278/clearfy/trunk/libs/factory/templates/pages/setup-parts/class-step-form.php
CVE ID: CVE-2024-13338 State: PUBLISHED Published: 2025-04-12T06:37:19.675Z Last Updated: 2025-05-12T15:43:51.782Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: creativemotion Products: Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer Problem Types: CWE-352 Description: The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on the wclearfy_cache_delete functionality . This makes it possible for unauthenticated attackers to clear the cache via a
the wclearfy_cache_delete functionality . This makes it possible for unauthenticated attackers to clear the cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e0a37ce4-9860-415e-bb88-545c30c95fc1?source=cve - https://plugins.trac.wordpress.org/changeset/3268278/clearfy/trunk/components/cache/includes/cache.php
CVE ID: CVE-2024-13339 State: PUBLISHED Published: 2025-02-19T08:21:46.894Z Last Updated: 2025-02-19T19:43:37.266Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: debounce Products: DeBounce Email Validator Problem Types: CWE-352 Description: The DeBounce Email Validator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.6.6. This is due to missing or incorrect nonce validation on the 'debounce_email_validator' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an ac
and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9121ab04-d16b-468b-880f-8f00bcec6489?source=cve - https://wordpress.org/plugins/debounce-io-email-validator/