Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12544 State: PUBLISHED Published: 2025-03-01T07:24:06.268Z Last Updated: 2025-03-03T17:38:21.654Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: devsoftbaltic Products: SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity Problem Types: CWE-862 Description: The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to arbitrary file deletion due to a missing capability check on the callback function of the SurveyJS_DeleteFile class in all versions up to, and including, 1.12.17. This makes it possible for aut
function of the SurveyJS_DeleteFile class in all versions up to, and including, 1.12.17. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This function is still vulnerable to Cross-Site Request Forgery as of 1.12.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e9404fe4-855e-4eb4-81c4-5246f6e9be0c?source=cve - https://plugins.trac.wordpress.org/changeset/3222216/surveyjs/trunk/ajax_handlers/delete_file.php - https://plugins.trac.w
tps://plugins.trac.wordpress.org/changeset/3222216/surveyjs/trunk/ajax_handlers/delete_file.php - https://plugins.trac.wordpress.org/changeset/3214665/
CVE ID: CVE-2024-12545 State: PUBLISHED Published: 2025-01-04T07:24:23.961Z Last Updated: 2025-01-06T16:29:51.035Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: akashmalik Products: Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more Problem Types: CWE-352 Description: The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.1. This is due to missing nonce validation on the reset_installation() function. This makes it possible for unauthent
.7.1. This is due to missing nonce validation on the reset_installation() function. This makes it possible for unauthenticated attackers to reset the plugin’s installation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7cbc157b-4f1b-4212-9e5c-dd10dd443df7?source=cve - https://plugins.trac.wordpress.org/browser/scratch-win-giveaways-for-website-facebook/tags/2.7.0/includes/swin-api.php - https://wordpress.org/plugins/scratch-win-giveaways-for-website-facebook/#developers - https://plugins.trac.wordpre
hp - https://wordpress.org/plugins/scratch-win-giveaways-for-website-facebook/#developers - https://plugins.trac.wordpress.org/changeset/3212730/
CVE ID: CVE-2024-12546 State: REJECTED Published: 2025-03-11T14:02:41.234Z Last Updated: 2025-03-13T02:48:27.217Z Description: No description available.
CVE ID: CVE-2024-12547 State: PUBLISHED Published: 2025-02-11T19:25:23.970Z Last Updated: 2025-02-12T15:29:57.701Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Tungsten Automation Products: Power PDF Problem Types: CWE-787 Description: Tungsten Automation Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPF files. The is
t must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25560. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1681/
CVE ID: CVE-2024-12548 State: PUBLISHED Published: 2025-02-11T19:24:55.823Z Last Updated: 2025-02-12T15:30:16.495Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Tungsten Automation Products: Power PDF Problem Types: CWE-416 Description: Tungsten Automation Power PDF JP2 File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files.The
rget must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files.The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25564. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1680/
CVE ID: CVE-2024-12549 State: PUBLISHED Published: 2025-02-11T19:24:42.751Z Last Updated: 2025-02-12T15:36:51.298Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Tungsten Automation Products: Power PDF Problem Types: CWE-125 Description: Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The iss
must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25565. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1679/
CVE ID: CVE-2024-12550 State: PUBLISHED Published: 2025-02-11T19:24:26.785Z Last Updated: 2025-02-12T15:37:07.137Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Tungsten Automation Products: Power PDF Problem Types: CWE-125 Description: Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files.
e target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25566. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1678/
CVE ID: CVE-2024-12551 State: PUBLISHED Published: 2025-02-11T19:24:15.196Z Last Updated: 2025-02-12T15:37:19.355Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Tungsten Automation Products: Power PDF Problem Types: CWE-125 Description: Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The iss
must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25567. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1677/
CVE ID: CVE-2024-12552 State: PUBLISHED Published: 2024-12-13T22:32:30.382Z Last Updated: 2024-12-16T17:56:19.123Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Wacom Products: Center Problem Types: CWE-59 Description: Wacom Center WTabletServicePro Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Wacom Center. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within WTabletServicePro.exe. By creating a symbolic link, an attacker can abuse the service t
The specific flaw exists within WTabletServicePro.exe. By creating a symbolic link, an attacker can abuse the service to create an arbitrary file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-25359. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1683/ - https://cdn.wacom.com/u/productsupport/drivers/win/professional/releasenotes/Windows_6.4.8-2.html
CVE ID: CVE-2024-12553 State: PUBLISHED Published: 2024-12-13T22:34:23.601Z Last Updated: 2024-12-16T17:55:27.880Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: GeoVision Products: GV-ASManager Problem Types: CWE-862 Description: GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of GeoVision GV-ASManager. Although authentication is required to exploit this vulnerability, default guest credentials may be used. The specific flaw exists within the GV-ASWeb service. The issue results from the lack of authorization prior to all
sed. The specific flaw exists within the GV-ASWeb service. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-25394. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1682/
CVE ID: CVE-2024-12554 State: PUBLISHED Published: 2024-12-18T09:22:39.427Z Last Updated: 2024-12-18T16:30:22.536Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: pkthree Products: Peter’s Custom Anti-Spam Problem Types: CWE-352 Description: The Peter’s Custom Anti-Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missing nonce validation on the cas_register_post() function. This makes it possible for unauthenticated attackers to blacklist emails via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analy
quest granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3c52ca89-4f13-41da-bc10-80d212c6219c?source=cve - https://plugins.trac.wordpress.org/browser/peters-custom-anti-spam-image/trunk/custom_anti_spam.php#L1081 - https://wordpress.org/plugins/peters-custom-anti-spam-image/#developers - https://plugins.trac.wordpress.org/changeset/3208894/
CVE ID: CVE-2024-12555 State: PUBLISHED Published: 2024-12-14T04:23:37.530Z Last Updated: 2024-12-16T17:51:12.916Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: mgplugin Products: SIP Calculator Problem Types: CWE-352 Description: The SIP Calculator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichme
site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/03afffcc-02fe-4054-8876-6a4e4d9de071?source=cve - https://wordpress.org/plugins/sip-calculator/#developers
CVE ID: CVE-2024-12556 State: PUBLISHED Published: 2025-04-08T20:04:22.103Z Last Updated: 2025-04-10T03:55:27.663Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Elastic Products: Kibana Problem Types: CWE-1321 Description: Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/kibana-8-16-4-and-8-17-2-security-update-esa-2025-02/376918
CVE ID: CVE-2024-12557 State: PUBLISHED Published: 2025-01-07T03:21:54.147Z Last Updated: 2025-01-07T16:29:25.325Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: transportersio Products: Transporters.io Problem Types: CWE-352 Description: The Transporters.io plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.84. This is due to missing nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP
an trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2f79778c-c11a-4d98-bc26-8113c3fef630?source=cve - https://wordpress.org/plugins/transportersio/#developers
CVE ID: CVE-2024-12558 State: PUBLISHED Published: 2024-12-21T09:23:54.011Z Last Updated: 2024-12-28T00:49:21.568Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: puckrobin Products: WP BASE Booking of Appointments, Services and Events Problem Types: CWE-862 Description: The WP BASE Booking of Appointments, Services and Events plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_db function in all versions up to, and including, 4.9.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose sensitive information from the database, such as the hashed admi
kers, with Subscriber-level access and above, to expose sensitive information from the database, such as the hashed administrator password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/09831b2f-8f79-4833-8fc6-f1af56c6abc8?source=cve - https://plugins.trac.wordpress.org/browser/wp-base-booking-of-appointments-services-and-events/tags/4.9.2/includes/freeons/export-import.php - https://plugins.trac.wordpress.org/changeset/3210164/wp-base-booking-of-appointments-services-and-events/tags/5.0.0/includes/freeons/export-import.php?old=3207827&old_path=wp-base-booking-of-appointments-services-and-events%2Ftags%2F4.9.2%2Finc
/freeons/export-import.php?old=3207827&old_path=wp-base-booking-of-appointments-services-and-events%2Ftags%2F4.9.2%2Fincludes%2Ffreeons%2Fexport-import.php
CVE ID: CVE-2024-12559 State: PUBLISHED Published: 2025-01-07T03:21:58.376Z Last Updated: 2025-01-07T16:27:35.705Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: 1clickdesigns Products: ClickDesigns Problem Types: CWE-862 Description: The ClickDesigns plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'clickdesigns_add_api' and the 'clickdesigns_remove_api' functions in all versions up to, and including, 1.8.0. This makes it possible for unauthenticated attackers to modify or remove the plugin's API key. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/th
move the plugin's API key. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c1d19968-dbd8-4433-99a7-b973a59c4653?source=cve - https://plugins.trac.wordpress.org/browser/clickdesigns/tags/1.8.0/includes/clickdesigns-ajax.php#L64 - https://plugins.trac.wordpress.org/browser/clickdesigns/tags/1.8.0/includes/clickdesigns-ajax.php#L79
CVE ID: CVE-2024-12560 State: PUBLISHED Published: 2024-12-19T07:05:47.462Z Last Updated: 2024-12-19T16:38:18.610Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: bplugins Products: Button Block – Get fully customizable & multi-functional buttons Problem Types: CWE-200 Description: The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5 via the 'btn_block_duplicate_post' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract potentially sensitive data from draft, scheduled (fu
ated attackers, with Contributor-level access and above, to extract potentially sensitive data from draft, scheduled (future), private, and password protected posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ac55e988-2b41-459b-9ab1-e5f9fdca203f?source=cve - https://plugins.trac.wordpress.org/changeset/3208482/button-block
CVE ID: CVE-2024-12561 State: PUBLISHED Published: 2025-05-21T09:21:51.804Z Last Updated: 2025-05-21T10:17:10.512Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wecantrack Products: Affiliate Sales in Google Analytics and other tools Problem Types: CWE-601 Description: The Affiliate Sales in Google Analytics and other tools plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.4.9. This is due to insufficient validation on the redirect url supplied via the 'afflink' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into p
or unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a4b205ab-f042-46d9-a331-f18809477384?source=cve - https://plugins.trac.wordpress.org/browser/wecantrack/trunk/WecantrackApp.php#L66
CVE ID: CVE-2024-12562 State: PUBLISHED Published: 2025-02-15T09:24:22.842Z Last Updated: 2025-02-18T21:23:54.081Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WP Sharks Products: s2Member Pro Problem Types: CWE-502 Description: The s2Member Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 241216 via deserialization of untrusted input from the 's2member_pro_remote_op' vulnerable parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the targ
is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/65192fdb-86db-475a-8c61-4db922920cfe?source=cve - https://s2member.com/changelog/
CVE ID: CVE-2024-12563 State: PUBLISHED Published: 2025-03-18T20:21:44.690Z Last Updated: 2025-03-18T20:38:55.295Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: WP Sharks Products: s2Member Pro Problem Types: CWE-98 Description: The s2Member Pro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 250214 via the 'template' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve c
xecution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d3326e9d-504f-444f-baf7-03989594f483?source=cve - https://s2member.com/changelog/
CVE ID: CVE-2024-12564 State: PUBLISHED Published: 2024-12-12T07:41:52.862Z Last Updated: 2025-09-11T14:06:26.560Z Vendors: Open Design Alliance Products: CDE inWEB SDK Problem Types: CWE-200, CWE-276 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability was discovered in Open Design Alliance CDE inWEB SDK before 2025.3. Installing CDE Server with default settings allows unauthorized users to visit prometheus metrics page. This can allow attackers to understand more things about the target application which may help in further investigation and exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.opendesign.com/security-ad
nd exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.opendesign.com/security-advisories
CVE ID: CVE-2024-12566 State: PUBLISHED Published: 2025-01-13T06:00:07.508Z Last Updated: 2025-01-13T14:55:12.169Z Vendors: Unknown Products: Email Subscribers by Icegram Express Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9206064a-d54e-44ad-9670-65520ee166a6/