Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/72e1fbce-86ae-4518-a613-7c322193acf4?source=cve - https://github.com/akirk/friends/pull/290 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3036987%40friends&new=3036987%40friends&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1979 State: PUBLISHED Published: 2024-03-13T09:41:25.039Z Last Updated: 2025-11-20T18:21:25.966Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Red Hat Products: Red Hat build of Quarkus 3.2.11.Final, Red Hat build of Quarkus Problem Types: CWE-200 Description: A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:1662 - https://access.redhat.com/security/cve/CVE-2024-1979 - https://bugzi
- https://access.redhat.com/errata/RHSA-2024:1662 - https://access.redhat.com/security/cve/CVE-2024-1979 - https://bugzilla.redhat.com/show_bug.cgi?id=2266690 - https://github.com/quarkusio/quarkus/issues/38055
CVE ID: CVE-2024-1980 State: REJECTED Published: N/A Last Updated: 2024-05-31T14:23:51.906Z Description: No description available.
CVE ID: CVE-2024-1981 State: PUBLISHED Published: 2024-02-29T06:47:57.610Z Last Updated: 2024-08-08T20:09:59.946Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wpvividplugins Products: Migration, Backup, Staging – WPvivid Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to SQL Injection via the 'table_prefix' parameter in version 0.9.68 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers t
ter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ef8bfb38-4f20-4f9f-bb30-a88f3be2d2d3?source=cve - https://research.hisolutions.com/2024/01/multiple-vulnerabilities-in-wordpress-plugin-wpvivid-backup-and-migration/ - https://plugins.trac.wordpress.org/changeset?old_path=%2Fwpvivid-backuprestore%2Ftrunk&old=2667839&new_path=%2Fwpvivid-backuprestore%
ns.trac.wordpress.org/changeset?old_path=%2Fwpvivid-backuprestore%2Ftrunk&old=2667839&new_path=%2Fwpvivid-backuprestore%2Ftrunk&new=2667839
CVE ID: CVE-2024-1982 State: PUBLISHED Published: 2024-02-29T06:47:56.555Z Last Updated: 2024-08-01T18:56:22.658Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: wpvividplugins Products: Migration, Backup, Staging – WPvivid Problem Types: CWE-862 Missing Authorization Description: The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the get_restore_progress() and restore() functions in all versions up to, and including, 0.9.68. This makes it possible for unauthenticated attackers to exploit a SQL injection vulnerability or trigger a DoS. Additional Analyst Notes: - CISA ADP Vu
thenticated attackers to exploit a SQL injection vulnerability or trigger a DoS. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4f17976e-d6b9-40fb-b2fb-d60bcfd68d12?source=cve - https://research.hisolutions.com/2024/01/multiple-vulnerabilities-in-wordpress-plugin-wpvivid-backup-and-migration/ - https://plugins.trac.wordpress.org/changeset?old_path=%2Fwpvivid-backuprestore%2Ftrunk&old=2667839&new_path=%2Fwpvivid-backuprestore%2Ftrunk&new=2667839
CVE ID: CVE-2024-1983 State: PUBLISHED Published: 2024-03-20T05:00:02.910Z Last Updated: 2024-08-01T19:17:11.130Z Vendors: Unknown Products: Simple Ajax Chat Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using the chat, which will be reflected unsanitized to other users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/bf3a31de-a227-4db1-bd18-ce6a78dc96fb/
CVE ID: CVE-2024-1984 State: PUBLISHED Published: 2024-04-09T18:59:29.548Z Last Updated: 2024-08-01T18:56:22.550Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: silverks Products: Graphene Problem Types: CWE-862 Missing Authorization Description: The Graphene theme for WordPress is vulnerable to unauthorized access of data via meta tag in all versions up to, and including, 2.9.2. This makes it possible for unauthenticated individuals to obtain post contents of password protected posts via the generated source. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e
ISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e2f19051-fe80-469c-a514-ec3a848a4015?source=cve - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=221417%40graphene%2F2.9.3&old=164915%40graphene%2F2.9
CVE ID: CVE-2024-1985 State: PUBLISHED Published: 2024-03-13T15:27:03.690Z Last Updated: 2025-04-15T15:20:42.111Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: mra13 Products: Simple Membership Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Display Name' parameter in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a us
makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires social engineering to successfully exploit, and the impact would be very limited due to the attacker requiring a user to login as the user with the injected payload for execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8a6ca886-de4c-4d45-a934-3e90378e7eb3?source=cve - https://plugins.trac.wordpress.org/browser/simple-membership/trunk/views/edit-v2.php#L85 - https://plugins.trac.wordpress.org/browser/simple-mem
dpress.org/browser/simple-membership/trunk/views/edit-v2.php#L85 - https://plugins.trac.wordpress.org/browser/simple-membership/trunk/views/edit-v2.php#L95 - https://plugins.trac.wordpress.org/browser/simple-membership/trunk/views/edit-v2.php#L103 - https://plugins.trac.wordpress.org/browser/simple-membership/trunk/views/edit-v2.php#L112 - https://plugins.trac.wordpress.org/browser/simple-membership/trunk/views/edit-v2.php#L121 - https://plugins.trac.wordpress.org/browser/simple-membership/trunk/views/edit-v2.php#L130 - https://plugins.trac.wordpress.org/browser/simple-membership/trunk/views/edit-v2.php#L139 - https://plugins.trac.wordpress.org/browser/simple-membership/trunk/views/edit-v2.p
ership/trunk/views/edit-v2.php#L139 - https://plugins.trac.wordpress.org/browser/simple-membership/trunk/views/edit-v2.php#L157 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3045036%40simple-membership%2Ftrunk&old=3021218%40simple-membership%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1986 State: PUBLISHED Published: 2024-03-07T20:33:26.566Z Last Updated: 2025-04-16T15:51:53.554Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: pluggabl Products: Booster Elite for WooCommerce Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Booster Elite for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wc_add_new_product() function in all versions up to, and including, 7.1.7. This makes it possible for customer-level attackers, and above, to upload arbitrary files on the affected site's server which may make remote code execution pos
l attackers, and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This is only exploitable when the user product upload functionality is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c9c2fb7f-a05b-4852-97eb-7befe880d703?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/trunk/includes/shortcodes/class-wcj-products-add-form-shortcodes.php#L322 - https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/trunk/includes/shortcodes/class-wcj-products-add-form-shortcodes.php#L333 - https://plugins.t
rowser/woocommerce-jetpack/trunk/includes/shortcodes/class-wcj-products-add-form-shortcodes.php#L333 - https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/trunk/includes/shortcodes/class-wcj-products-add-form-shortcodes.php#L132 - https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/trunk/includes/shortcodes/class-wcj-products-add-form-shortcodes.php#L138 - https://booster.io/ - https://wordpress.org/plugins/woocommerce-jetpack/
CVE ID: CVE-2024-1987 State: PUBLISHED Published: 2024-03-08T05:31:47.330Z Last Updated: 2024-08-01T18:56:22.652Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cbutlerjr Products: WP-Members Membership Plugin Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.4.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and a
ut escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/631e1061-50b1-4df2-b876-37b4cd3e2478?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3047285%40wp-members%2Ftrunk&old=3025452%40wp-members%2Ftrunk&sfp_email=&sfph_mail=#file5
CVE ID: CVE-2024-1988 State: PUBLISHED Published: 2024-06-07T03:21:57.530Z Last Updated: 2024-08-01T18:56:22.433Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pickplugins Products: Gutenberg Blocks, Page Builder – ComboBlocks Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute in blocks in all versions up to, and including, 2.2.80 due to insufficient input sanitization and output escaping. This makes
ocks in all versions up to, and including, 2.2.80 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e49da9e7-26a1-442b-b5d0-1da3bcf0e8c9?source=cve - https://plugins.trac.wordpress.org/changeset/3084503/post-grid/tags/2.2.81/includes/blocks/accordion-nested-item/index.php
CVE ID: CVE-2024-1989 State: PUBLISHED Published: 2024-03-06T05:33:24.390Z Last Updated: 2024-08-01T18:56:22.680Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: heateor Products: Social Sharing Plugin – Sassy Social Share Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Sassy_Social_Share' shortcode in all versions up to, and including, 3.3.58 due to insufficient input sanitization and output escaping on user supplied attributes such as 'url'. This makes it p
58 due to insufficient input sanitization and output escaping on user supplied attributes such as 'url'. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bdceb07a-87d2-4708-b76b-5a8fcfff0818?source=cve - https://plugins.trac.wordpress.org/browser/sassy-social-share/trunk/includes/class-sassy-social-share-shortcodes.php#L228 - https://plugins.trac.wordpress.org/browser/sassy-social-share/trunk/include
ass-sassy-social-share-shortcodes.php#L228 - https://plugins.trac.wordpress.org/browser/sassy-social-share/trunk/includes/class-sassy-social-share-shortcodes.php#L308 - https://plugins.trac.wordpress.org/browser/sassy-social-share/trunk/public/class-sassy-social-share-public.php#L513 - https://plugins.trac.wordpress.org/browser/sassy-social-share/trunk/includes/class-sassy-social-share-sharing-networks.php#L65 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3044857%40sassy-social-share%2Ftrunk&old=3038976%40sassy-social-share%2Ftrunk&sfp_email=&sfph_mail=#file6
CVE ID: CVE-2024-1990 State: PUBLISHED Published: 2024-04-09T18:58:52.047Z Last Updated: 2025-02-26T18:27:30.972Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: metagauss Products: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to blind SQL Injection via the ‘id’ parameter of the RM_Form shortcode in all versions up to, and including, 5.3.1.0 due to insufficient escaping o
the ‘id’ parameter of the RM_Form shortcode in all versions up to, and including, 5.3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6478cdbc-a20e-4fe2-bbd6-8a550e5da895?source=cve - https://plugins.trac.wordpress.org/changeset/3057216/custom-regis
s/id/6478cdbc-a20e-4fe2-bbd6-8a550e5da895?source=cve - https://plugins.trac.wordpress.org/changeset/3057216/custom-registration-form-builder-with-submission-manager/trunk/public/class_rm_public.php - https://plugins.trac.wordpress.org/changeset/3049490/custom-registration-form-builder-with-submission-manager/trunk/public/class_rm_public.php
CVE ID: CVE-2024-1991 State: PUBLISHED Published: 2024-04-09T18:58:59.144Z Last Updated: 2024-08-09T18:51:57.594Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: metagauss Products: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Problem Types: CWE-862 Missing Authorization Description: The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the update_users_role() function in all versions up to, and including, 5.3.0.0. This makes it possible for authenticated attackers, with subscriber-
tion in all versions up to, and including, 5.3.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their privileges to that of an administrator Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/766e3966-157a-4db3-9179-813032343f76?source=cve - https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/trunk//services/class_rm_user_services.php#L1205 - https://plugins.trac.wordpress.org/changeset/3049490/custom-registration-form-builder-with-submission-manager#file24
CVE ID: CVE-2024-1992 State: REJECTED Published: N/A Last Updated: 2024-03-20T16:44:07.699Z Description: No description available.
CVE ID: CVE-2024-1993 State: PUBLISHED Published: 2024-05-02T16:52:14.044Z Last Updated: 2024-08-01T18:56:22.632Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: seothemes Products: Icon Widget Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Icon Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary
tes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7352ab6d-b582-4512-a9fa-4b42b78fa862?source=cve - https://plugins.trac.wordpress.org/browser/icon-widget/trunk/src/Shortcode.php - https://plugins.trac.wordpress.org/changeset/3068501/#file10
CVE ID: CVE-2024-1994 State: PUBLISHED Published: 2024-04-06T01:54:50.208Z Last Updated: 2024-08-01T18:56:22.473Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: dfactory Products: Image Watermark Problem Types: CWE-862 Missing Authorization Description: The Image Watermark plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the watermark_action_ajax() function in all versions up to, and including, 1.7.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to apply and remove watermarks from images. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program
and above, to apply and remove watermarks from images. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/31a66e30-972b-4a7b-9d47-ad7abd574e36?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3064501%40image-watermark&new=3064501%40image-watermark&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1995 State: PUBLISHED Published: 2024-03-20T01:58:04.811Z Last Updated: 2024-08-02T19:22:23.860Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: inc2734 Products: Smart Custom Fields Problem Types: CWE-862 Missing Authorization Description: The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relational_posts_search() function in all versions up to, and including, 4.2.2. This makes it possible for authenticated attackers, with subscrber-level access and above, to retrieve post content that is password protected and/or private. Additional Analyst Notes: - CVE Progra
ss and above, to retrieve post content that is password protected and/or private. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e966a266-4265-4a72-8a50-e872805219a7?source=cve - https://plugins.trac.wordpress.org/browser/smart-custom-fields/trunk/classes/fields/class.field-related-posts.php#L78 - https://github.com/inc2734/smart-custom-fields/commit/67cb6d75bd8189668f721dbd2dc7a3036851be1b - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3052172%40smart-custom-fields&new=3052172%40smart-custom-fields&sfp_email=&sfph_mail=
CVE ID: CVE-2024-1996 State: PUBLISHED Published: 2024-03-13T15:32:38.990Z Last Updated: 2024-08-01T18:56:22.553Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Premium Addons for Elementor Products: Premium Addons Pro for Elementor Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's IHover widget link in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contr
itization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/48fa5f3b-000b-406e-b7ee-51af5720cf72?source=cve - https://premiumaddons.com/change-log/
CVE ID: CVE-2024-1997 State: PUBLISHED Published: 2024-03-13T15:32:39.456Z Last Updated: 2024-08-01T18:56:22.558Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Premium Addons for Elementor Products: Premium Addons Pro for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premium_fbchat_app_id' parameter of the Messenger Chat Widget in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attack
ding, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6ffa6a6b-bbb4-4361-8585-ce2cdb7d1d7e?source=cve - https://premiumaddons.com/change-log/
CVE ID: CVE-2024-1998 State: REJECTED Published: N/A Last Updated: 2024-03-14T17:51:31.834Z Description: No description available.