Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-13683 State: PUBLISHED Published: 2025-01-24T07:04:09.519Z Last Updated: 2025-02-12T20:41:30.347Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: sperse Products: Automate Hub Free by Sperse.IO Problem Types: CWE-352 Description: The Automate Hub Free by Sperse.IO plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.0. This is due to missing or incorrect nonce validation on the 'automate_hub' page. This makes it possible for unauthenticated attackers to update an activation status via a forged request granted they can trick a site administrator into performing an action such as clicking o
ion status via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f6d90ca3-dc24-4634-9f98-83a909e3e093?source=cve - https://wordpress.org/plugins/automate-hub-free-by-sperse-io/ - https://plugins.trac.wordpress.org/browser/automate-hub-free-by-sperse-io/trunk/apps/s/sperse/sperse.php#L141
CVE ID: CVE-2024-13684 State: PUBLISHED Published: 2025-02-18T04:21:12.101Z Last Updated: 2025-02-18T19:27:47.406Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: shubhamgrover7256 Products: Reset Problem Types: CWE-352 Description: The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the reset_db_page() function. This makes it possible for unauthenticated attackers to reset several tables in the database like comments, themes, plugins, and more via a forged request granted they can trick a site administrator into performing an action such a
mes, plugins, and more via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2335533d-c38a-450c-9fa1-0e236b5e92e6?source=cve - https://plugins.trac.wordpress.org/browser/reset/tags/1.6/delete_comments.php
CVE ID: CVE-2024-13685 State: PUBLISHED Published: 2025-03-04T06:00:04.054Z Last Updated: 2025-03-04T14:32:08.168Z Vendors: Unknown Products: Admin and Site Enhancements (ASE) Problem Types: CWE-290 Authentication Bypass by Spoofing Description: The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate their value to bypass the login limit feature in the Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/72c61904-253d-42d1-9edd-7ea2162a2f85/
CVE ID: CVE-2024-13686 State: PUBLISHED Published: 2025-03-04T03:37:58.615Z Last Updated: 2025-03-04T16:27:02.834Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: vowelweb Products: VW Storefront Problem Types: CWE-862 Description: The VW Storefront theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vw_storefront_reset_all_settings() function in all versions up to, and including, 0.9.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the themes settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/th
reset the themes settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/299ed515-ba64-413a-a03a-2db801520ae0?source=cve - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=261535%40vw-storefront&new=261535%40vw-storefront&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13687 State: PUBLISHED Published: 2025-02-18T04:21:18.316Z Last Updated: 2025-02-18T15:43:54.231Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: labibahmed42 Products: Team Builder – Meet the Team Problem Types: CWE-862 Description: The Team Builder – Meet the Team plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_team_builder_options() function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
evel access and above, to update the plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7c35e20f-bfb0-4de0-9f8f-6e04fbbe138a?source=cve - https://plugins.trac.wordpress.org/browser/team-display/tags/1.3/plugin.class.php#L34
CVE ID: CVE-2024-13688 State: PUBLISHED Published: 2025-04-28T06:00:01.714Z Last Updated: 2025-08-27T12:00:43.055Z Vendors: Unknown Products: Admin and Site Enhancements (ASE) Problem Types: CWE-259 Use of Hard-coded Password Description: The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 uses a hardcoded password in its Password Protection feature, allowing attacker to bypass the protection offered via a crafted request Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/19051d08-16b0-466c-976b-be7b076e8e92/
CVE ID: CVE-2024-13689 State: PUBLISHED Published: 2025-02-18T14:22:15.092Z Last Updated: 2025-02-18T14:44:51.344Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: undsgn Products: Uncode Core Problem Types: CWE-94 Description: The Uncode Core plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.9.1.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment:
h Subscriber-level access and above, to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c0a61e11-1137-4da0-8580-0a44300b1542?source=cve - https://support.undsgn.com/hc/en-us/articles/213454129-Change-Log
CVE ID: CVE-2024-13690 State: PUBLISHED Published: 2025-03-25T08:22:16.138Z Last Updated: 2025-03-25T13:13:23.208Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: ashishajani Products: WP Church Donation Problem Types: CWE-79 Description: The WP Church Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several donation form submission parameters in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA AD
ry web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/de8ac20f-d6ae-4e55-9337-4fb5ebd4f24a?source=cve - http://plugins.svn.wordpress.org/wp-church-donation/tags/1.7/includes/church-donation-form-display.php - http://plugins.svn.wordpress.org/wp-church-donation/tags/1.7/includes/church-donation-listings.php - https://wordpress.org/plugins/wp-church-donation/
CVE ID: CVE-2024-13691 State: PUBLISHED Published: 2025-02-18T11:10:21.006Z Last Updated: 2025-02-18T14:17:30.451Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: undsgn Products: Uncode Problem Types: CWE-20 Description: The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncode_recordMedia' function in all versions up to, and including, 2.9.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary files on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d592141d-191b-4739-bc0a-07549ef2f31b?source=cve - https://support.undsgn.com/hc/en-us/articles/213454129-Change-Log
CVE ID: CVE-2024-13692 State: PUBLISHED Published: 2025-02-14T05:22:44.354Z Last Updated: 2025-02-14T15:46:13.565Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: wpswings Products: Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features Problem Types: CWE-285 Description: The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.4.5 via several functions due to missing validation on a user controlled key. This makes it possi
p to, and including, 4.4.5 via several functions due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite linked refund image attachments, overwrite refund request message, overwrite order messages, and read order messages of other users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dafbf6e2-1160-4551-a987-5e94c9157ff2?source=cve - https://plugins.trac.wordpress.org/browser/woo-refund-and-exchange-lite/trunk/common/class-woo-refund-and-exchange-lite-common.php#L127 - https://plugins.trac.wordpress.org/browser/woo-refund-and-exchange-lite/trunk/common/clas
xchange-lite-common.php#L127 - https://plugins.trac.wordpress.org/browser/woo-refund-and-exchange-lite/trunk/common/class-woo-refund-and-exchange-lite-common.php#L186 - https://plugins.trac.wordpress.org/browser/woo-refund-and-exchange-lite/trunk/common/class-woo-refund-and-exchange-lite-common.php#L374 - https://plugins.trac.wordpress.org/browser/woo-refund-and-exchange-lite/trunk/public/class-woo-refund-and-exchange-lite-public.php#L381 - https://plugins.trac.wordpress.org/changeset/3236486/
CVE ID: CVE-2024-13693 State: PUBLISHED Published: 2025-02-25T09:21:33.130Z Last Updated: 2025-02-25T14:37:21.976Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Kriesi Products: Enfold - Responsive Multi-Purpose Theme Problem Types: CWE-284 Description: The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check in avia-export-class.php in all versions up to, and including, 6.0.9. This makes it possible for unauthenticated attackers to export all avia settings which may included sensitive information such as the Mailchimp API Key, reCAPTCHA Secret Key, or Envato private token if they are set. Additional Ana
information such as the Mailchimp API Key, reCAPTCHA Secret Key, or Envato private token if they are set. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/61a9ad18-28d4-488c-b3a7-e35745f9c83e?source=cve - https://themeforest.net/item/enfold-responsive-multipurpose-theme/4519990#item-description__changelog
CVE ID: CVE-2024-13694 State: PUBLISHED Published: 2025-01-30T08:21:26.437Z Last Updated: 2025-01-30T15:06:26.871Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: moreconvert Products: WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features) Problem Types: CWE-285 Description: The WooCommerce Wishlist (High customization, fast setup,Free Elementor Wishlist, most features) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.7 via the download_pdf_file() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers
ile() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to extract data from wishlists that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/59fe7630-ab94-419f-aca5-39b74d86ae4e?source=cve - https://wordpress.org/plugins/smart-wishlist-for-more-convert/#developers - https://plugins.trac.wordpress.org/browser/smart-wishlist-for-more-convert/trunk/includes/class-wlfmc-form-handler.php#L607 - https://plugins.trac.wordpress.org/browser/smart-wishlist-for-more-convert/trunk/includes/class-wlfmc-wishlist.php#L529 - https://plugins
rac.wordpress.org/browser/smart-wishlist-for-more-convert/trunk/includes/class-wlfmc-wishlist.php#L529 - https://plugins.trac.wordpress.org/changeset/3229758/
CVE ID: CVE-2024-13695 State: PUBLISHED Published: 2025-02-25T09:21:33.873Z Last Updated: 2025-02-25T14:37:13.976Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Kriesi Products: Enfold - Responsive Multi-Purpose Theme Problem Types: CWE-918 Description: The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachment_id' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional
originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b55722f9-a0b9-4484-bd3b-c21dbe5716ee?source=cve - https://themeforest.net/item/enfold-responsive-multipurpose-theme/4519990#item-description__changelog
CVE ID: CVE-2024-13696 State: PUBLISHED Published: 2025-01-29T07:21:26.507Z Last Updated: 2025-02-12T19:51:15.083Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdesk Products: Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later Problem Types: CWE-79 Description: The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wishlist_name’ parameter in all versions up to, and including, 1.2.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that w
nd output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/112456a9-8bb6-4007-87da-6d0fba912498?source=cve - https://wordpress.org/plugins/flexible-wishlist/#developers - https://plugins.trac.wordpress.org/browser/flexible-wishlist/trunk/assets/js/front.js - https://plugins.trac.wordpress.org/changeset/3230370/
CVE ID: CVE-2024-13697 State: PUBLISHED Published: 2025-03-01T08:23:21.239Z Last Updated: 2025-03-03T20:56:21.813Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: wordplus Products: Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss Problem Types: CWE-918 Description: The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.4 via the 'nice_links'. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web applicatio
t possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Successful exploitation requires the "Enable link previews" to be enabled (default). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b67710d7-976b-4a65-bad3-091a97aceb00?source=cve - https://plugins.trac.wordpress.org/changeset/3243180/bp-better-messages
CVE ID: CVE-2024-13698 State: PUBLISHED Published: 2025-01-24T15:21:43.913Z Last Updated: 2025-02-12T20:01:20.154Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Astoundify Products: Jobify - Job Board WordPress Theme Problem Types: CWE-862 Description: The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'download_image_via_ai' and 'generate_image_via_ai' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application to upload file
nauthenticated attackers to make web requests to arbitrary locations originating from the web application to upload files in an image format, and to generate AI images using the site's OpenAI key. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/393811e4-71dd-4359-80fa-5a3d146439bb?source=cve - https://themeforest.net/item/jobify-wordpress-job-board-theme/5247604
CVE ID: CVE-2024-13699 State: PUBLISHED Published: 2025-02-04T12:22:21.237Z Last Updated: 2025-02-12T20:51:26.422Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: qodeinteractive Products: Qi Addons For Elementor Problem Types: CWE-79 Description: The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cursor’ parameter in all versions up to, and including, 1.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page
l access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in versions 1.8.5, 1.8.6, and 1.8.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/add39d28-4070-44e2-8dff-0371e0c58453?source=cve - https://plugins.trac.wordpress.org/browser/qi-addons-for-elementor/trunk/inc/shortcodes/typeout-text/class-qiaddonsforelementor-typeout-text-shortcode.php - https://plugins.trac.wordpress.org/changeset/3230342/ - https://plugins.trac.wordpress.org/changeset/3231980/ - https://plugins.trac.wordpress.org/changeset/3232550/ - htt
2/ - https://plugins.trac.wordpress.org/changeset/3231980/ - https://plugins.trac.wordpress.org/changeset/3232550/ - https://plugins.trac.wordpress.org/changeset/3234136/
CVE ID: CVE-2024-13700 State: PUBLISHED Published: 2025-01-30T13:41:56.104Z Last Updated: 2025-01-30T14:54:02.110Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: spanrig Products: Embed Swagger UI Problem Types: CWE-79 Description: The Embed Swagger UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsgui' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a
ontributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/20e2454f-f49b-413f-ae45-8b628b30a780?source=cve - https://wordpress.org/plugins/embed-swagger-ui/
CVE ID: CVE-2024-13701 State: PUBLISHED Published: 2025-02-12T03:21:39.621Z Last Updated: 2025-02-12T20:10:34.548Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: stklcode Products: Liveticker (by stklcode) Problem Types: CWE-79 Description: The Liveticker (by stklcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'liveticker' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whene
ted attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c4edf78c-cd17-42dd-90dc-10946e79d57b?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3234940%40stklcode-liveticker&new=3234940%40stklcode-liveticker&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13702 State: PUBLISHED Published: 2025-03-26T08:21:52.086Z Last Updated: 2025-03-26T13:53:26.461Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: vcita Products: CRM and Lead Management by vcita Problem Types: CWE-79 Description: The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vCitaMeetingScheduler' and 'vCitaSchedulingCalendar' shortcodes in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject
plied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e5d3239b-0f65-46f7-977b-9995542a6eb9?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3256449%40crm-customer-relationship-management-by-vcita&new=3256449%40crm-customer-relationship-management-by-vcita&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13703 State: PUBLISHED Published: 2025-03-13T01:45:27.946Z Last Updated: 2025-03-14T13:54:28.543Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: vcita Products: CRM and Lead Management by vcita Problem Types: CWE-862 Description: The CRM and Lead Management by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_ajax_toggle_ae() function in all versions up to, and including, 2.7.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable and disable plugin widgets. Additional Analyst Notes: - CISA ADP Vulnrichment: References
el access and above, to enable and disable plugin widgets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8e8c2aa5-5770-4b88-b415-40c2aff69d84?source=cve - https://plugins.trac.wordpress.org/browser/crm-customer-relationship-management-by-vcita/trunk/vcita-ajax-function.php#L6