Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6476 State: PUBLISHED Published: 2024-01-09T21:32:03.407Z Last Updated: 2025-11-20T18:05:55.102Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 3.11 Problem Types: CWE-770 Description: A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node. Additional Analyst Notes: - CVE Program Contain
scheduler and potentially resulting in a denial of service in the node. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:0195 - https://access.redhat.com/errata/RHSA-2024:0207 - https://access.redhat.com/security/cve/CVE-2023-6476 - https://bugzilla.redhat.com/show_bug.cgi?id=2253994
CVE ID: CVE-2023-6477 State: PUBLISHED Published: 2024-02-21T23:31:09.811Z Last Updated: 2025-11-20T04:11:23.261Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-266 Description: An issue has been discovered in GitLab EE affecting all versions starting from 16.5 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. When a user is assigned a custom role with admin_group_member permission, they may be able to make a group, other members or themselves Owners of that group, which may lead to privilege escalation. Additional Analyst Notes: - CVE Program Container: -
lves Owners of that group, which may lead to privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/433463 - https://hackerone.com/reports/2270898
CVE ID: CVE-2023-6478 State: PUBLISHED Published: 2023-12-13T06:27:41.017Z Last Updated: 2025-11-20T07:07:30.871Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for
upport, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 6 Problem Types: CWE-190 Description: A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information. Additional Analyst Notes: - CVE Program Container: Re
overflow which may lead to a disclosure of sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:7886 - https://access.redhat.com/errata/RHSA-2024:0006 - https://access.redhat.com/errata/RHSA-2024:0009 - https://access.redhat.com/errata/RHSA-2024:0010 - https://access.redhat.com/errata/RHSA-2024:0014 - https://access.redhat.com/errata/RHSA-2024:0015 - https://access.redhat.com/errata/RHSA-2024:0016 - https://access.redhat.com/errata/RHSA-2024:0017 - https://access.redhat.com/errata/RHSA-2024:0018 - https://access.redhat.com/errata/RHSA-2024:0020 - https://access.redhat.com/errata/RHSA-2024:2169 - https://access.red
- https://access.redhat.com/errata/RHSA-2024:0020 - https://access.redhat.com/errata/RHSA-2024:2169 - https://access.redhat.com/errata/RHSA-2024:2170 - https://access.redhat.com/errata/RHSA-2024:2995 - https://access.redhat.com/errata/RHSA-2024:2996 - https://access.redhat.com/errata/RHSA-2025:12751 - https://access.redhat.com/security/cve/CVE-2023-6478 - https://bugzilla.redhat.com/show_bug.cgi?id=2253298 - https://gitlab.freedesktop.org/xorg/xserver/-/commit/14f480010a93ff962fef66a16412fafff81ad632 - https://lists.x.org/archives/xorg-announce/2023-December/003435.html
CVE ID: CVE-2023-6481 State: PUBLISHED Published: 2023-12-04T08:35:44.396Z Last Updated: 2024-08-02T08:28:21.829Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: QOS.CH Sarl Products: logback Problem Types: Denial-of-service using poisoned data Description: A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data. Additional Analyst Notes: - CVE Program Container: References: - https://logback.qos.ch/news.html#1.3.12 - https://logback.qos.ch/news.html#1.3.14
CVE ID: CVE-2023-6482 State: PUBLISHED Published: 2024-01-27T00:19:15.351Z Last Updated: 2024-10-18T14:42:11.060Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: Synaptics Products: Synaptics Fingerprint Driver Problem Types: CWE-321 Description: Use of encryption key derived from static information in Synaptics Fingerprint Driver allows an attacker to set up a TLS session with the fingerprint sensor and send restricted commands to the fingerprint sensor. This may allow an attacker, who has physical access to the sensor, to enroll a fingerprint into the template database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
rint into the template database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.synaptics.com/sites/default/files/2024-01/fingerprint-driver-encryption-key-security-brief-2024-01-26.pdf
CVE ID: CVE-2023-6483 State: PUBLISHED Published: 2023-12-18T08:04:54.658Z Last Updated: 2025-05-07T20:38:23.422Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: ADiTaaS Products: Allied Digital Integrated Tool-as-a-Service Problem Types: CWE-287 Description: The vulnerability exists in ADiTaaS (Allied Digital Integrated Tool-as-a-Service) version 5.1 due to an improper authentication vulnerability in the ADiTaaS backend API. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable platform. Successful exploitation of this vulnerability could allow the attacker to gain full access to t
the vulnerable platform. Successful exploitation of this vulnerability could allow the attacker to gain full access to the customers’ data and completely compromise the targeted platform. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0365
CVE ID: CVE-2023-6484 State: PUBLISHED Published: 2024-04-25T15:58:18.169Z Last Updated: 2025-11-21T06:23:04.949Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Red Hat Products: Red Hat build of Keycloak 22, Red Hat build of Keycloak 22.0.10, Red Hat Single Sign-On 7, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, RHEL-8 based Middleware Containers, RHSSO 7.6.8 Problem Types: CWE-117 Description: A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the l
through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:0798 - https://access.redhat.com/errata/RHSA-2024:0799 - https://access.redhat.com/errata/RHSA-2024:0800 - https://access.redhat.com/errata/RHSA-2024:0801 - https://access.redhat.com/errata/RHSA-2024:0804 - https://access.redhat.com/errata/RHSA-2024:1860 - https://access.redhat.com/errata/RHSA-2024:1861 - https://access.redhat.com/errata/RHSA-2024:1862 - https://access.redhat.com/errata/RHSA-2024:1864 - https://access.redhat.com
://access.redhat.com/errata/RHSA-2024:1862 - https://access.redhat.com/errata/RHSA-2024:1864 - https://access.redhat.com/errata/RHSA-2024:1865 - https://access.redhat.com/errata/RHSA-2024:1866 - https://access.redhat.com/errata/RHSA-2024:1867 - https://access.redhat.com/errata/RHSA-2024:1868 - https://access.redhat.com/security/cve/CVE-2023-6484 - https://bugzilla.redhat.com/show_bug.cgi?id=2248423
CVE ID: CVE-2023-6485 State: PUBLISHED Published: 2024-01-01T14:18:55.845Z Last Updated: 2025-06-18T14:58:44.693Z Vendors: Unknown Products: Html5 Video Player Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against high privilege users like admins Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/759b3866-c619-42cc-94a8-0af
E Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/759b3866-c619-42cc-94a8-0af6d199cc81
CVE ID: CVE-2023-6486 State: PUBLISHED Published: 2024-04-09T18:59:24.878Z Last Updated: 2024-08-02T08:28:21.812Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: brainstormforce Products: Spectra – WordPress Gutenberg Blocks Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS metabox in all versions up to and including 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above
ization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d4933a30-974f-487d-9444-b0ea1283a09c?source=cve - https://youtu.be/t5K745dBsT0 - https://advisory.abay.sh/cve-2023-6486 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3042670%40ultimate-addons-for-gutenberg%2Ftrunk&old=3037142%40ultimate-addons-for-gutenberg%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6487 State: PUBLISHED Published: 2024-05-22T07:37:23.741Z Last Updated: 2024-08-02T08:28:21.848Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: theluckywp Products: LuckyWP Table of Contents Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Header Title' field in all versions up to and including 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web s
escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/88075c15-079f-4de2-8e15-374eb7b8c77b?source=cve - https://wordpress.org/plugins/luckywp-table-of-contents/
CVE ID: CVE-2023-6488 State: PUBLISHED Published: 2023-12-19T01:58:59.593Z Last Updated: 2024-08-02T08:28:21.818Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: gn_themes Products: WP Shortcodes Plugin — Shortcodes Ultimate Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_button', 'su_members', and 'su_tabs' shortcodes in all versions up to, and including, 7.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This ma
to, and including, 7.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/50a89ad1-a3d0-49e3-8d2e-4cb81ac115ba?source=cve - https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/button.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3007660%40shortcodes-ultimate&new
php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3007660%40shortcodes-ultimate&new=3007660%40shortcodes-ultimate&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6489 State: PUBLISHED Published: 2024-04-12T00:53:41.230Z Last Updated: 2025-11-20T04:11:28.262Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-1333 Description: A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows an attacker to spike the GitLab instance resources usage resulting in service degradation via chat integration feature. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/433520 - https://hackerone.
chment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/433520 - https://hackerone.com/reports/2262450
CVE ID: CVE-2023-6491 State: PUBLISHED Published: 2024-06-07T05:33:46.516Z Last Updated: 2024-08-02T08:28:21.857Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpchill Products: Strong Testimonials Problem Types: CWE-284 Improper Access Control Description: The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the wpmtst_save_view_sticky function in all versions up to, and including, 3.1.12. This makes it possible for authenticated attackers, with contributor access and above, to modify favorite views. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container:
access and above, to modify favorite views. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c3277d93-4f47-445b-a193-ff990b55d054?source=cve - https://plugins.trac.wordpress.org/changeset/3097409/strong-testimonials/tags/3.1.13/admin/views.php
CVE ID: CVE-2023-6492 State: PUBLISHED Published: 2024-06-14T03:35:41.577Z Last Updated: 2024-08-02T08:35:13.244Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: dgwyer Products: Simple Sitemap – Create a Responsive HTML Sitemap Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Simple Sitemap – Create a Responsive HTML Sitemap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.13. This is due to missing or incorrect nonce validation in the 'admin_notices' hook found in class-settings.php. This makes it possible for unauthenticated attackers to reset the plugin options to a defaul
ound in class-settings.php. This makes it possible for unauthenticated attackers to reset the plugin options to a default state via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a228e60c-c91b-4a82-8b05-a0ffaed82524?source=cve - https://plugins.trac.wordpress.org/changeset/3099425/simple-sitemap/trunk/lib/classes/plugin-admin-pages/class-settings.php
CVE ID: CVE-2023-6493 State: PUBLISHED Published: 2024-01-05T02:02:20.669Z Last Updated: 2025-06-17T17:52:59.719Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: averta Products: Depicter Slider – Responsive Image Slider, Video Slider & Post Slider Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Depicter Slider – Responsive Image Slider, Video Slider & Post Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to modify the plugin's settings v
alidation on the 'save' function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2023-51491 appears to be a duplicate of this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c9c907ea-3ab4-4674-8945-ade4f6ff2679?source=cve - https://plugins.trac.wordpress.org/changeset/3013596/depicter/trunk/app/src/WordPress/Settings/Settings.php
CVE ID: CVE-2023-6494 State: PUBLISHED Published: 2024-04-13T08:41:15.619Z Last Updated: 2024-08-02T08:35:13.218Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: wpclever Products: WPC Smart Quick View for WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above
and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/45ac52e1-9f0e-499e-9125-2581940f5bdd?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3069323%40woo-smart-quick-view&new=3069323%40woo-smart-quick-view&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6495 State: PUBLISHED Published: 2024-06-19T08:33:57.218Z Last Updated: 2024-08-02T08:35:13.171Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: jeffparker Products: YARPP – Yet Another Related Posts Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 5.30.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions
itization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d586e455-c73f-4916-a926-4d53699bb434?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037032%40yet-another-related-posts-plugin%2Ftrunk&old=2999784%40yet-another-related-p
p_email=&sfph_mail=&reponame=&new=3037032%40yet-another-related-posts-plugin%2Ftrunk&old=2999784%40yet-another-related-posts-plugin%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6496 State: PUBLISHED Published: 2024-01-11T08:32:26.648Z Last Updated: 2025-06-17T21:09:13.113Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: virgial Products: Manage Notification E-mails Problem Types: CWE-285 Improper Authorization Description: The Manage Notification E-mails plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.8.5 via the card_famne_export_settings function. This makes it possible for unauthenticated attackers to obtain plugin settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabi
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/048bc117-88df-44b3-a30c-692bad23050f?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3007199%40manage-notification-emails%2Ftrunk&old=2920034%40manage-notification-emails%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6497 State: PUBLISHED Published: 2024-01-27T03:32:45.914Z Last Updated: 2025-06-17T21:29:16.015Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: wptipsntricks Products: WordPress Simple Shopping Cart Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automatic redirect URL setting in all versions up to and including 4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permission
anitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ac6201a1-7ca9-461b-b9ad-16407120dfae?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3007737%40wordpress-simple-paypal-shopping-cart&new=3007737%40wordpress-simple-paypa
sfp_email=&sfph_mail=&reponame=&old=3007737%40wordpress-simple-paypal-shopping-cart&new=3007737%40wordpress-simple-paypal-shopping-cart&sfp_email=&sfph_mail=