Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-9584 State: PUBLISHED Published: 2024-10-25T17:32:19.756Z Last Updated: 2024-10-25T17:51:31.535Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: imagemappro Products: Image Map Pro – Drag-and-drop Builder for Interactive Images Problem Types: CWE-862 Description: The Image Map Pro plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the AJAX functions in versions up to, and including, 6.0.20. This makes it possible for authenticated attackers with contributor-level privileges or above, to add, update or delete map projects. Additional Analyst Notes: - CISA ADP Vulnrichm
ributor-level privileges or above, to add, update or delete map projects. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7c632452-8b13-4f78-aa8a-3c92bef5907f?source=cve - https://imagemappro.com/change-log/
CVE ID: CVE-2024-9585 State: PUBLISHED Published: 2024-10-25T17:32:19.112Z Last Updated: 2024-10-25T17:56:19.266Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: imagemappro Products: Image Map Pro – Drag-and-drop Builder for Interactive Images Problem Types: CWE-79 Description: The Image Map Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'save_project' function with an arbitrary shortcode in versions up to, and including, 6.0.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitra
butes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/22245bb5-a310-4cd2-98e3-6611e71ff7fa?source=cve - https://imagemappro.com/change-log/
CVE ID: CVE-2024-9586 State: PUBLISHED Published: 2024-10-11T05:33:12.640Z Last Updated: 2024-10-11T13:51:36.176Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: vittor1o Products: Linkz.ai – Automatic link previews on hover Problem Types: CWE-862 Description: The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_auth' and 'check_logout' functions in versions up to, and including, 1.1.8. This makes it possible for unauthenticated attackers to update plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilit
gs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b4b4ca5b-c806-4b68-acb8-6b63d6ca5728?source=cve - https://plugins.trac.wordpress.org/browser/linkz-ai/tags/1.1.8/init.php#L142 - https://plugins.trac.wordpress.org/browser/linkz-ai/tags/1.1.8/init.php#L159
CVE ID: CVE-2024-9587 State: PUBLISHED Published: 2024-10-11T05:33:12.113Z Last Updated: 2024-10-11T13:52:08.117Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: vittor1o Products: Linkz.ai – Automatic link previews on hover Problem Types: CWE-862 Description: The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_linkz' function in versions up to, and including, 1.1.8. This makes it possible for authenticated attackers with contributor-level privileges or above, to update plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/thr
o update plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b1faa178-e4b1-4d2e-85f1-b852fbf3ab17?source=cve - https://plugins.trac.wordpress.org/browser/linkz-ai/tags/1.1.8/init.php#L252
CVE ID: CVE-2024-9588 State: PUBLISHED Published: 2024-10-22T07:36:33.189Z Last Updated: 2024-10-22T13:16:51.552Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: amu02aftab Products: Category and Taxonomy Meta Fields Problem Types: CWE-352 Description: The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the 'wpaft_option_page' function. This makes it possible for unauthenticated attackers to add and delete taxonomy meta, granted they can trick a site administrator into performing an action such as clicking on a l
and delete taxonomy meta, granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2dc9c744-6ffb-4d7a-94ce-ba576d7b6d47?source=cve - https://plugins.trac.wordpress.org/browser/wp-custom-taxonomy-meta/trunk/includes/options.php?rev=1196908#L103
CVE ID: CVE-2024-9589 State: PUBLISHED Published: 2024-10-22T07:36:34.831Z Last Updated: 2024-10-22T13:14:55.129Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: amu02aftab Products: Category and Taxonomy Meta Fields Problem Types: CWE-79 Description: The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_meta_name' parameter in the 'wpaft_option_page' function in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbi
ibutes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9d879fc6-97ec-4ecb-99c8-7fc0b91692ef?source=cve - https://plugins.trac.wordpress.org/browser/wp-custom-taxonomy-meta/trunk/includes/options.php?rev=1196908#L232
CVE ID: CVE-2024-9590 State: PUBLISHED Published: 2024-10-22T07:36:33.856Z Last Updated: 2024-10-22T13:16:14.961Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: amu02aftab Products: Category and Taxonomy Meta Fields Problem Types: CWE-79 Description: The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image meta field value in the 'wpaft_add_meta_textinput' function in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with editor-level and above permissions to inject arbitra
attributes. This makes it possible for authenticated attackers with editor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3f6d9c23-53e9-4393-beff-2f996c279ad8?source=cve - https://plugins.trac.wordpress.org/browser/wp-custom-taxonomy-meta/trunk/wp-texonomy-meta.php?rev=1454207#L631
CVE ID: CVE-2024-9591 State: PUBLISHED Published: 2024-10-22T07:36:34.342Z Last Updated: 2024-10-22T13:15:34.232Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: amu02aftab Products: Category and Taxonomy Image Problem Types: CWE-79 Description: The Category and Taxonomy Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_category_image' parameter in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with editor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever
ed attackers with editor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5760933b-30e6-465b-9b94-c913b21f07fd?source=cve - https://plugins.trac.wordpress.org/browser/wp-custom-taxonomy-image/trunk/wp-custom-taxonomy-image.php?rev=1454210#L47
CVE ID: CVE-2024-9592 State: PUBLISHED Published: 2024-10-12T02:05:40.133Z Last Updated: 2024-10-15T17:52:34.553Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: scottpaterson Products: Easy PayPal Gift Certificate Problem Types: CWE-352 Description: The Easy PayPal Gift Certificate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.3. This is due to missing or incorrect nonce validation on the 'wpppgc_plugin_options' function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request, granted they can trick a site administrator
the plugin's settings and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/72880e44-b0e0-47f4-82f0-c36c81091ba8?source=cve - https://plugins.trac.wordpress.org/browser/paypal-gift-certificate/tags/1.2.3/paypal-gift-certificate.php#L200
CVE ID: CVE-2024-9593 State: PUBLISHED Published: 2024-10-18T17:32:30.648Z Last Updated: 2024-10-18T18:56:31.697Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Scott Paterson, scottpaterson Products: Time Clock Pro, Time Clock – A WordPress Employee & Volunteer Time Clock Plugin Problem Types: CWE-94 Description: The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwp_load_function_callback' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters ca
ack' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters cannot be specified. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/247e599a-74e2-41d5-a1ba-978a807e6544?source=cve - https://plugins.trac.wordpress.org/browser/time-clock/tags/1.2.2/includes/admin/ajax_functions_admin.php#L58 - https://plugins.trac.wordpress.org/changeset/3171046/time-clock#file40
CVE ID: CVE-2024-9594 State: PUBLISHED Published: 2024-10-15T20:37:01.308Z Last Updated: 2024-10-16T16:21:56.147Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Kubernetes Products: Image Builder Problem Types: CWE-798 Description: A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process when using the Nutanix, OVA, QEMU or raw providers. The credentials can be used to gain root access. The credentials are disabled at the conclusion of the image build process. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project
build process. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project. Because these images were vulnerable during the image build process, they are affected only if an attacker was able to reach the VM where the image build was happening and used the vulnerability to modify the image at the time the image build was occurring. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/kubernetes/kubernetes/issues/128007 - https://github.com/kubernetes-sigs/image-builder/pull/1596 - https://groups.google.com/g/kubernetes-security-announce/c/UKJG-oZogfA/m/Lu1hcnHmAQAJ
CVE ID: CVE-2024-9595 State: PUBLISHED Published: 2024-10-12T08:41:06.715Z Last Updated: 2024-10-15T01:32:55.981Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: tobiasbg Products: TablePress – Tables in WordPress made easy Problem Types: CWE-79 Description: The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the table cell content in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user
tackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ffa3b85c-7d08-4f6a-889e-b75620f72a1a?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3165531%40tablepress%2Ftrunk&old=3149006%40tablepress%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-9596 State: PUBLISHED Published: 2024-10-10T10:02:01.165Z Last Updated: 2024-10-10T13:55:09.715Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-540 Description: An issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. It was possible for an unauthenticated attacker to determine the GitLab version number for a GitLab instance. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/493355
CVE ID: CVE-2024-9597 State: PUBLISHED Published: 2025-03-20T10:09:32.788Z Last Updated: 2025-03-20T18:37:46.276Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: parisneo Products: parisneo/lollms Problem Types: CWE-22 Description: A Path Traversal vulnerability exists in the `/wipe_database` endpoint of parisneo/lollms version v12, allowing an attacker to delete any directory on the system. The vulnerability arises from improper validation of the `key` parameter, which is used to construct file paths. An attacker can exploit this by sending a specially crafted HTTP request to delete arbitrary directories. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
a specially crafted HTTP request to delete arbitrary directories. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/1f6c8908-d486-4141-be55-25bd29933d8b
CVE ID: CVE-2024-9598 State: PUBLISHED Published: 2024-10-25T07:37:59.702Z Last Updated: 2024-10-25T18:54:09.874Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: mohammed_kaludi Products: AMP for WP – Accelerated Mobile Pages Problem Types: CWE-352 Description: The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.99.1. This is due to missing or incorrect nonce validation on the 'proxy' function. This makes it possible for unauthenticated attackers to send the logged in user's cookies to their own server via a forged request granted they can trick a site administrato
to send the logged in user's cookies to their own server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6b155ec8-d69d-40cf-8bea-201629bc9ca6?source=cve - https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.0.98/includes/options/redux-core/inc/class.p.php#L16 - https://plugins.trac.wordpress.org/changeset/3174071/
CVE ID: CVE-2024-9599 State: PUBLISHED Published: 2025-05-15T20:07:21.676Z Last Updated: 2025-05-16T20:37:17.878Z Vendors: Unknown Products: Popup Box Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Popup Box WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9e8a2659-7a6c-4528-b0b2-64d462485b43/
CVE ID: CVE-2024-9600 State: PUBLISHED Published: 2024-11-21T06:00:09.466Z Last Updated: 2024-11-21T18:06:29.050Z Vendors: Unknown Products: Ditty Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d1c78389-29eb-4dce-848c-e0eab85ff5cd/
CVE ID: CVE-2024-9601 State: PUBLISHED Published: 2025-02-14T06:40:11.635Z Last Updated: 2025-02-14T14:39:42.735Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: themeum Products: Qubely – Advanced Gutenberg Blocks Problem Types: CWE-79 Description: The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ and 'UniqueID' parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a us
ckers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/58387a60-ef68-4911-9349-97b0f7e7726f?source=cve - https://plugins.trac.wordpress.org/browser/qubely/trunk/core/blocks/postgrid.php#L1419 - https://plugins.trac.wordpress.org/changeset/3235188/
CVE ID: CVE-2024-9602 State: PUBLISHED Published: 2024-10-08T23:02:17.443Z Last Updated: 2025-11-20T18:46:29.454Z Vendors: Google Products: Chrome Problem Types: CWE-843 Description: Type Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_8.html - https://issues.chromium.org/issues/368241697
CVE ID: CVE-2024-9603 State: PUBLISHED Published: 2024-10-08T23:02:17.756Z Last Updated: 2024-10-09T16:08:12.429Z Vendors: Google Products: Chrome Problem Types: CWE-843 Description: Type Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_8.html - https://issues.chromium.org/issues/367818758
CVE ID: CVE-2024-9606 State: PUBLISHED Published: 2025-03-20T10:09:24.180Z Last Updated: 2025-03-20T18:55:27.073Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: berriai Products: berriai/litellm Problem Types: CWE-117 Description: In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount of the secret key. The issue affects version v1.44.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.c
key. The issue affects version v1.44.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/4a03796f-a8d4-4293-84ef-d3959456223a - https://github.com/berriai/litellm/commit/9094071c4782183e84f10630e2450be3db55509a
CVE ID: CVE-2024-9607 State: PUBLISHED Published: 2024-10-25T06:51:26.121Z Last Updated: 2024-10-25T20:15:42.641Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: 10web Products: 10Web Social Post Feed Problem Types: CWE-79 Description: The 10Web Social Post Feed plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Please note this i
t execute if they can successfully trick a user into performing an action such as clicking on a link. Please note this is only exploitable when the leave a review notice is present. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/be151552-827c-43a6-a0e0-da19884448fd?source=cve - https://plugins.trac.wordpress.org/browser/wd-facebook-feed/trunk/wd/includes/notices.php#L204
CVE ID: CVE-2024-9608 State: PUBLISHED Published: 2024-12-13T11:23:44.065Z Last Updated: 2024-12-13T16:21:40.319Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: richardperdaan Products: MyParcel Problem Types: CWE-79 Description: The MyParcel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.24.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Please note this is only exploitable
can successfully trick a user into performing an action such as clicking on a link. Please note this is only exploitable when the WooCommerce store is set to Belgium. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d6c85f2b-965d-477f-9d9a-4a3f315c4904?source=cve - https://plugins.trac.wordpress.org/changeset/3206928/woocommerce-myparcel/tags/4.24.2/includes/admin/settings/class-wcmypa-settings.php
CVE ID: CVE-2024-9609 State: PUBLISHED Published: 2024-11-15T04:29:05.635Z Last Updated: 2024-11-15T18:10:39.859Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: thimpress Products: LearnPress Export Import – WordPress extension for LearnPress Problem Types: CWE-79 Description: The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpress_import_form_server' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that