Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/59d9ff2e-4b0b-4096-91ca-1a029f31796b?source=cve - https://plugins.trac.wordpress.org/browser/simplebooklet/trunk/simplebooklet.php - https://wordpress.org/plugins/simplebooklet/
CVE ID: CVE-2024-13589 State: PUBLISHED Published: 2025-02-19T07:32:06.136Z Last Updated: 2025-02-19T21:19:39.105Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: johnnya23 Products: YouTube Playlists with Schema Problem Types: CWE-79 Description: The YouTube Playlists with Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yt_grid' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execu
thenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/29ef6956-aeb7-4a72-9f51-b5c5b05c1425?source=cve - https://plugins.trac.wordpress.org/browser/jma-youtube-playlists-with-schema/trunk/youtube-playlists-with-schema.php#L557
CVE ID: CVE-2024-13590 State: PUBLISHED Published: 2025-01-22T03:21:31.885Z Last Updated: 2025-01-22T14:12:23.593Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ayecode Products: Ketchup Shortcodes Problem Types: CWE-79 Description: The Ketchup Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spacer' shortcode in all versions up to, and including, 0.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user access
th contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4d25e292-b62b-493e-976c-a5eb95505065?source=cve - https://plugins.trac.wordpress.org/changeset/3222176/
CVE ID: CVE-2024-13591 State: PUBLISHED Published: 2025-02-19T07:32:13.935Z Last Updated: 2025-02-19T14:35:01.930Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: labibahmed42 Products: Team Builder For WPBakery Page Builder(Formerly Visual Composer) Problem Types: CWE-79 Description: The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'team-builder-vc' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-l
and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e6b1e4d9-03dc-47e8-ab41-ae9c04dc0132?source=cve - https://plugins.trac.wordpress.org/browser/team-builder-for-wpbakery-page-builder/tags/1.0/includes/style10.php#L2 - https://plugins.trac.wordpress.org/browser/team-builder-for-wpbakery-page-builder/tags/1.0/plugin.class.php#L55
CVE ID: CVE-2024-13592 State: PUBLISHED Published: 2025-02-19T07:32:14.735Z Last Updated: 2025-02-19T15:19:12.465Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: labibahmed42 Products: Team Builder For WPBakery Page Builder(Formerly Visual Composer) Problem Types: CWE-98 Description: The Team Builder For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0 via the 'team-builder-vc' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of an
h Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ee7e8d76-a461-4b0b-a312-c6ea4b8ac375?source=cve - https://plugins.trac.wordpress.org/browser/team-builder-for-wpbakery-page-builder/tags/1.0/plugin.class.php#L55
CVE ID: CVE-2024-13593 State: PUBLISHED Published: 2025-01-23T09:21:09.348Z Last Updated: 2025-01-23T14:44:15.202Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: otrok7 Products: BMLT Meeting Map Problem Types: CWE-98 Description: The BMLT Meeting Map plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.0 via the 'bmlt_meeting_map' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or ac
g the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c22e5765-54bd-4677-947c-8a7c48bdf65b?source=cve - https://plugins.trac.wordpress.org/browser/bmlt-meeting-map/trunk/meeting_map.php#L510 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3226454%40bmlt-meeting-map&new=3226454%40bmlt-meeting-map&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13594 State: PUBLISHED Published: 2025-01-24T11:07:31.734Z Last Updated: 2025-01-27T14:55:44.354Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: neofix Products: Simple Downloads List Problem Types: CWE-89 Description: The Simple Downloads List plugin for WordPress is vulnerable to SQL Injection via the 'category' attribute of the 'neofix_sdl' shortcode in all versions up to, and including, 1.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries
akes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/49f5bb21-d18f-453b-bef4-e3b234d162c8?source=cve - https://plugins.trac.wordpress.org/browser/simple-downloads-list/trunk/lists/list_1/download_list_1.php#L20 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3226486%40simple-downloads-list&new=3226486%40simple-downloads-list&sfp_email=&sfph_mail=#file14
CVE ID: CVE-2024-13595 State: PUBLISHED Published: 2025-02-18T04:21:12.975Z Last Updated: 2025-02-18T15:17:52.719Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: pantherius Products: Simple Signup Form Problem Types: CWE-89 Description: The Simple Signup Form plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'ssf' shortcode in all versions up to, and including, 1.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already ex
e for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/26c4008a-9043-4293-aaf3-8e72de667ad8?source=cve - https://plugins.trac.wordpress.org/browser/simple-signup-form/trunk/simple_signup_form.php#L120
CVE ID: CVE-2024-13596 State: PUBLISHED Published: 2025-01-30T13:42:06.916Z Last Updated: 2025-01-30T14:37:38.240Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: pantherius Products: WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress Problem Types: CWE-89 Description: The WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'survey' shortcode in all versions up to, and including, 1.7.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticat
supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/996cb291-692d-4892-a3ab-ffad960ba732?source=cve - https://plugins.trac.wordpress.org/browser/wp-survey-and-poll/trunk/wordpress-survey-and-poll.php#L1457
CVE ID: CVE-2024-13597 State: PUBLISHED Published: 2025-04-14T12:04:46.650Z Last Updated: 2025-04-14T12:55:07.679Z Vendors: SoftCOM Products: iKSORIS Problem Types: CWE-79 Description: Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. An attacker might trick a user into filling a form sent to login panel at /softcom/ with a malicious script, what causes the script to run in user's context. This vulnerability has been patched in version 79.0 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/04/CVE-2024-10087 - https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.h
https://cert.pl/en/posts/2025/04/CVE-2024-10087 - https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html
CVE ID: CVE-2024-13598 State: PUBLISHED Published: 2025-04-14T12:05:16.363Z Last Updated: 2025-04-14T12:54:38.952Z Vendors: SoftCOM Products: iKSORIS Problem Types: CWE-79 Description: Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Reflected XSS (Cross-site Scripting) attacks. Using a functionality of creating new form fields one creates new parameters vulnerable to XSS attacks. A user tricked into filling such a form with a malicious script will run the code in their's context. This vulnerability has been patched in version 79.0 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/04/CVE-2024-10087 - https://www.iksoris.pl
t Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2025/04/CVE-2024-10087 - https://www.iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html
CVE ID: CVE-2024-13599 State: PUBLISHED Published: 2025-01-25T07:24:15.533Z Last Updated: 2025-01-27T14:54:05.784Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: thimpress Products: LearnPress – WordPress LMS Plugin Problem Types: CWE-79 Description: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.2.7.5 due to insufficient input sanitization and output escaping of a lesson name. This makes it possible for authenticated attackers, with LP Instructor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injec
tor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/67709117-8912-4c09-afcb-0c07345d00e0?source=cve - https://wordpress.org/plugins/learnpress/#developers - https://plugins.trac.wordpress.org/changeset/3226650/
CVE ID: CVE-2024-13600 State: PUBLISHED Published: 2025-02-12T05:28:40.506Z Last Updated: 2025-02-12T16:08:40.582Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ahmadmj Products: Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin Problem Types: CWE-200 Description: The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.5 via the 'majesticsupportdata' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/majesticsupportdata direc
authenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/majesticsupportdata directory which can contain file attachments included in support tickets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c5a8fd90-49dd-4a5e-88f2-cd6b338da2d6?source=cve - https://plugins.trac.wordpress.org/browser/majestic-support/tags/1.0.5/includes/classes/uploads.php - https://plugins.trac.wordpress.org/changeset/3231938/
CVE ID: CVE-2024-13601 State: PUBLISHED Published: 2025-02-12T05:28:40.901Z Last Updated: 2025-02-12T19:35:17.765Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: ahmadmj Products: Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin Problem Types: CWE-639 Description: The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.5 via the 'exportusereraserequest' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above,
n on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export ticket data for any user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ebf5537d-d80e-4844-8ed4-480f4a533439?source=cve - https://plugins.trac.wordpress.org/browser/majestic-support/tags/1.0.5/modules/gdpr/controller.php#L110 - https://plugins.trac.wordpress.org/changeset/3231938/
CVE ID: CVE-2024-13602 State: PUBLISHED Published: 2025-03-16T06:00:07.086Z Last Updated: 2025-03-17T15:17:11.712Z Vendors: Unknown Products: Poll Maker Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Poll Maker WordPress plugin before 5.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/05d5010b-94eb-4fd3-b962-e2a16c032b71/
CVE ID: CVE-2024-13603 State: PUBLISHED Published: 2025-02-17T06:00:01.478Z Last Updated: 2025-02-19T14:07:16.133Z Vendors: Unknown Products: Wise Forms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Wise Forms WordPress plugin through 1.2.0 does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks via malicious form submissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/234a8d22-e6c6-4819-9ac0-434a96b3462d/
CVE ID: CVE-2024-13604 State: PUBLISHED Published: 2025-04-05T01:44:44.761Z Last Updated: 2025-04-07T14:12:23.960Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: logoninc Products: KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin Problem Types: CWE-200 Description: The KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.4 via the 'kbs' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/kbs directory which can cont
henticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/kbs directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 1.7.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a058d6-ca9e-4241-b6dd-307efa7689ab?source=cve - https://plugins.trac.wordpress.org/browser/kb-support/trunk/includes/files.php - https://plugins.trac.wordpress.org/changeset/3231596/
CVE ID: CVE-2024-13605 State: PUBLISHED Published: 2025-02-24T06:00:03.899Z Last Updated: 2025-02-24T11:29:49.644Z Vendors: Unknown Products: Form Maker by 10Web Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d5543b3b-1c28-481b-aba4-9a07d160e1f2/
CVE ID: CVE-2024-13606 State: PUBLISHED Published: 2025-02-13T09:21:47.088Z Last Updated: 2025-02-13T14:28:06.922Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: rabilal Products: JS Help Desk – The Ultimate Help Desk & Support Plugin Problem Types: CWE-200 Description: The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'jssupportticketdata' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/jssupportticketdata directory which can contain file attach
sensitive data stored insecurely in the /wp-content/uploads/jssupportticketdata directory which can contain file attachments included in support tickets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e8ed5d5d-86b0-40ac-a093-31392dea13a2?source=cve - https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.8/includes/classes/uploads.php
CVE ID: CVE-2024-13607 State: PUBLISHED Published: 2025-02-04T06:41:53.947Z Last Updated: 2025-02-04T15:43:09.510Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: rabilal Products: JS Help Desk – The Ultimate Help Desk & Support Plugin Problem Types: CWE-639 Description: The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.8.8 via the 'exportusereraserequest' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level permissions and above, to export ticket data for any user. Ad
ossible for authenticated attackers, with Subscriber-level permissions and above, to export ticket data for any user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3f57fbbc-ed5a-4452-bd8a-6fc0a4536d76?source=cve - https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.8/modules/gdpr/controller.php#L110 - https://plugins.trac.wordpress.org/changeset/3230977/
CVE ID: CVE-2024-13608 State: PUBLISHED Published: 2025-02-17T06:00:03.464Z Last Updated: 2025-02-19T18:31:39.753Z Vendors: Unknown Products: Track Logins Problem Types: CWE-89 SQL Injection Description: The Track Logins WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/408e6cad-f02d-455a-9943-32da77537da1/
CVE ID: CVE-2024-13609 State: PUBLISHED Published: 2025-02-18T04:21:20.833Z Last Updated: 2025-02-18T15:53:20.163Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: 1clickmigration Products: 1 Click WordPress Migration Plugin – 100% FREE for a limited time Problem Types: CWE-200 Description: The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data including usernames and their respective password hashes during a short window of tim
ttackers to extract sensitive data including usernames and their respective password hashes during a short window of time in which the backup is in process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d33199ea-7c96-4c60-a7b8-5c7e9835e231?source=cve - https://plugins.trac.wordpress.org/browser/1-click-migration/trunk/inc/backup/class-ocm-backup.php
CVE ID: CVE-2024-13610 State: PUBLISHED Published: 2025-04-15T06:00:10.252Z Last Updated: 2025-04-15T13:12:56.018Z Vendors: Unknown Products: Simple Social Media Share Buttons Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Simple Social Media Share Buttons WordPress plugin before 6.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/85229528-1110-4d45-b972-8bbcba003a1f/
CVE ID: CVE-2024-13611 State: PUBLISHED Published: 2025-03-01T08:23:20.219Z Last Updated: 2025-03-03T20:56:28.933Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: wordplus Products: Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss Problem Types: CWE-200 Description: The Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via the 'bp-better-messages' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-conte