Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-29431 State: PUBLISHED Published: 2022-05-20T20:47:12.725Z Last Updated: 2025-02-20T20:20:49.174Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: KubiQ Products: Remove CPT base (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in KubiQ CPT base plugin <= 5.8 at WordPress allows an attacker to delete the CPT base. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/remove-cpt-base/#developers - https://patchstack.com/database/vulnerability/remove-cpt-base/wordpress-remove-cpt-base-plugin-5-8-cross-site-request-forgery-csrf
tchstack.com/database/vulnerability/remove-cpt-base/wordpress-remove-cpt-base-plugin-5-8-cross-site-request-forgery-csrf-vulnerability-leading-to-cpt-base-deletion
CVE ID: CVE-2022-29432 State: PUBLISHED Published: 2022-05-20T20:48:20.530Z Last Updated: 2025-02-20T20:20:41.702Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N) Vendors: TMS-Plugins Products: wpDataTables – Tables & Table Charts (WordPress plugin) Problem Types: CWE-79 Description: Multiple Authenticated (administrator or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in TMS-Plugins wpDataTables plugin <= 2.1.27 on WordPress via &data-link-text, &data-link-url, &data, &data-shortcode, &data-star-num vulnerable parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/wpd
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/wpdatatables/#developers - https://patchstack.com/database/vulnerability/wpdatatables/wordpress-wpdatatables-plugin-2-1-27-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities
CVE ID: CVE-2022-29433 State: PUBLISHED Published: 2022-05-13T15:52:41.799Z Last Updated: 2025-02-20T20:23:03.436Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: Nicdark Products: Donations (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (contributor or higher role) Cross-Site Scripting (XSS) vulnerability in Donations plugin <= 1.8 on WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/nd-donations/ - https://patchstack.com/database/vulnerability/nd-donations/wordpress-donations-plugin-1-8-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-29434 State: PUBLISHED Published: 2022-05-20T20:19:54.782Z Last Updated: 2025-02-20T20:21:11.701Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Spiffy Plugins Products: Spiffy Calendar Problem Types: Insecure Direct Object References (IDOR) Description: Insecure Direct Object References (IDOR) vulnerability in Spiffy Plugins Spiffy Calendar <= 4.9.0 at WordPress allows an attacker to edit or delete events. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/spiffy-calendar/#developers - https://patchstack.com/database/vulnerability/spiffy-calendar/wordpress-spiffy-calendar
ns/spiffy-calendar/#developers - https://patchstack.com/database/vulnerability/spiffy-calendar/wordpress-spiffy-calendar-plugin-4-9-0-edit-delete-event-via-idor-vulnerability
CVE ID: CVE-2022-29435 State: PUBLISHED Published: 2022-05-17T19:54:24.442Z Last Updated: 2025-02-20T20:22:40.661Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Alexander Stokmann Products: Code Snippets Extended (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress allows an attacker to delete or to turn on/off snippets. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/code-snippets-extended/#developers - https://patchstack.com/database/vulnerability/code-snippet
://wordpress.org/plugins/code-snippets-extended/#developers - https://patchstack.com/database/vulnerability/code-snippets-extended/wordpress-code-snippets-extended-plugin-1-4-7-cross-site-request-forgery-csrf-vulnerability
CVE ID: CVE-2022-29436 State: PUBLISHED Published: 2022-05-17T19:51:56.700Z Last Updated: 2025-02-20T20:22:48.177Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: Alexander Stokmann Products: Code Snippets Extended (WordPress plugin) Problem Types: CWE-352, CWE-79 Description: Persistent Cross-Site Scripting (XSS) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery (vulnerable parameters &title, &snippet_code). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/code-snippets-extended/#developers - https://patchstack.com/da
Vulnrichment: References: - https://wordpress.org/plugins/code-snippets-extended/#developers - https://patchstack.com/database/vulnerability/code-snippets-extended/wordpress-code-snippets-extended-plugin-1-4-7-cross-site-request-forgery-csrf-vulnerability-leading-to-persistent-cross-site-scripting-xss
CVE ID: CVE-2022-29437 State: PUBLISHED Published: 2022-06-15T15:12:23.946Z Last Updated: 2025-02-20T20:19:32.864Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: NextCode Products: Image Slider by NextCode – Photo & Video SLider (WordPress plugin) Problem Types: CWE-352 Description: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Image Slider by NextCode plugin <= 1.1.2 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/baslider/ - https://patchstack.com/database/vulnerability/baslider/wordpress-image-slider-by-nextcode-plugin-1-1-2-multiple-cross-site-request-f
hstack.com/database/vulnerability/baslider/wordpress-image-slider-by-nextcode-plugin-1-1-2-multiple-cross-site-request-forgery-csrf-vulnerabilities
CVE ID: CVE-2022-29438 State: PUBLISHED Published: 2022-06-15T15:14:43.047Z Last Updated: 2025-02-20T20:19:25.216Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: NextCode Products: Image Slider by NextCode – Photo & Video SLider (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (author or higher user role) Persistent Cross-Site Scripting (XSS) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/baslider/ - https://patchstack.com/database/vulnerability/baslider/wordpress-image-slider-by-nextcode-plugin-
rg/plugins/baslider/ - https://patchstack.com/database/vulnerability/baslider/wordpress-image-slider-by-nextcode-plugin-1-1-2-authenticated-persistent-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-29439 State: PUBLISHED Published: 2022-06-15T15:31:34.790Z Last Updated: 2025-02-20T20:19:11.224Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: NextCode Products: Image Slider by NextCode – Photo & Video SLider (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress allows deleting slides. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/baslider/ - https://patchstack.com/database/vulnerability/baslider/wordpress-image-slider-by-nextcode-plugin-1-1-2-slider-deletion-v
https://patchstack.com/database/vulnerability/baslider/wordpress-image-slider-by-nextcode-plugin-1-1-2-slider-deletion-via-cross-site-request-forgery-csrf-vulnerability
CVE ID: CVE-2022-29440 State: PUBLISHED Published: 2022-06-15T15:33:50.311Z Last Updated: 2025-02-20T20:19:02.805Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Micah Wood Products: Promotion Slider (WordPress plugin) Problem Types: CWE-79 Description: Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Promotion Slider plugin <= 3.3.4 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/promotion-slider/ - https://patchstack.com/database/vulnerability/promotion-slider/wordpress-promotion-slider-plugin-3-3-4-multiple-au
er/ - https://patchstack.com/database/vulnerability/promotion-slider/wordpress-promotion-slider-plugin-3-3-4-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities
CVE ID: CVE-2022-29441 State: PUBLISHED Published: 2022-06-15T15:35:56.597Z Last Updated: 2025-02-20T20:18:52.660Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Rilwis Products: Private Messages For WordPress (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Private Messages For WordPress plugin <= 2.1.10 at WordPress allows attackers to send messages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/private-messages-for-wordpress/ - https://patchstack.com/database/vulnerability/private-messages-for-wordpress/wordpress-private-mess
ges-for-wordpress/ - https://patchstack.com/database/vulnerability/private-messages-for-wordpress/wordpress-private-messages-for-wordpress-plugin-2-1-10-sending-messages-via-cross-site-request-forgery-csrf-vulnerability
CVE ID: CVE-2022-29442 State: PUBLISHED Published: 2022-06-15T15:38:43.691Z Last Updated: 2025-02-20T20:18:44.169Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Rilwis Products: Private Messages For WordPress (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (subscriber or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Messages For WordPress <= 2.1.10 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/private-messages-for-wordpress/ - https://patchstack.com/database/vulnerability/private-messages-for-wordpress/wordpress-private-message
-for-wordpress/ - https://patchstack.com/database/vulnerability/private-messages-for-wordpress/wordpress-private-messages-for-wordpress-plugin-2-1-10-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-29443 State: PUBLISHED Published: 2022-06-15T18:55:15.796Z Last Updated: 2025-02-20T20:18:36.385Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: Nicdark Products: Hotel Booking (WordPress plugin) Problem Types: CWE-79 Description: Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark's Hotel Booking plugin <= 3.0 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/nd-booking/ - https://patchstack.com/database/vulnerability/nd-booking/wordpress-hotel-booking-plugin-3-0-multiple-authenticated-stored
ttps://patchstack.com/database/vulnerability/nd-booking/wordpress-hotel-booking-plugin-3-0-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities
CVE ID: CVE-2022-29444 State: PUBLISHED Published: 2022-05-02T19:03:32.539Z Last Updated: 2025-02-20T20:23:47.562Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Cloudways Products: Breeze (WordPress plugin) Problem Types: CWE-264, CWE-79 Description: Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability in Cloudways Breeze plugin <= 2.0.2 on WordPress allows users with a subscriber or higher user role to execute any of the wp_ajax_* actions in the class Breeze_Configuration which includes the ability to change any of the plugin's settings including CDN setting which could be further used for XSS attack. Additional Analyst Notes: - CVE
the plugin's settings including CDN setting which could be further used for XSS attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/breeze/#developers - https://patchstack.com/database/vulnerability/breeze/wordpress-breeze-plugin-2-0-2-plugin-settings-change-leading-to-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-29445 State: PUBLISHED Published: 2022-05-18T16:39:54.226Z Last Updated: 2025-02-20T20:22:33.657Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Wow-Company Products: Popup Box (WordPress plugin) Problem Types: Local File Inclusion (LFI) Description: Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/popup-box/#developers - https://patchstack.com/database/vulnerability/popup-box/wordpress-popup-box-plugin-2-1-2-authenticated-local-f
elopers - https://patchstack.com/database/vulnerability/popup-box/wordpress-popup-box-plugin-2-1-2-authenticated-local-file-inclusion-lfi-vulnerability
CVE ID: CVE-2022-29446 State: PUBLISHED Published: 2022-05-19T15:14:02.030Z Last Updated: 2025-02-20T20:22:17.668Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Wow-Company Products: Counter Box (WordPress) Problem Types: Local File Inclusion (LFI) Description: Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/counter-box/#developers - https://patchstack.com/database/vulnerability/counter-box/wordpress-counter-box-plugin-1-1-1-authenticated-loca
lopers - https://patchstack.com/database/vulnerability/counter-box/wordpress-counter-box-plugin-1-1-1-authenticated-local-file-inclusion-lfi-vulnerability
CVE ID: CVE-2022-29447 State: PUBLISHED Published: 2022-05-20T20:17:03.216Z Last Updated: 2025-02-20T20:21:18.879Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Wow-Company Products: Hover Effects – easily create any hover effect (WordPress plugin) Problem Types: Local File Inclusion (LFI) Description: Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/hover-effects/#developers - https://patchstack.com/database/vulnerability/hover-effects/wo
https://wordpress.org/plugins/hover-effects/#developers - https://patchstack.com/database/vulnerability/hover-effects/wordpress-hover-effects-plugin-2-1-authenticated-local-file-inclusion-lfi-vulnerability
CVE ID: CVE-2022-29448 State: PUBLISHED Published: 2022-05-20T19:59:37.439Z Last Updated: 2025-02-20T20:21:40.800Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Wow-Company Products: Herd Effects (WordPress plugin) Problem Types: Local File Inclusion (LFI) Description: Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/mwp-herd-effect/#developers - https://patchstack.com/database/vulnerability/mwp-herd-effect/wordpress-herd-effects-plugin-5-2-local-f
ct/#developers - https://patchstack.com/database/vulnerability/mwp-herd-effect/wordpress-herd-effects-plugin-5-2-local-file-inclusion-lfi-vulnerability
CVE ID: CVE-2022-29449 State: PUBLISHED Published: 2022-05-19T15:15:18.465Z Last Updated: 2025-02-20T20:22:10.081Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: wpopal Products: Opal Hotel Room Booking (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Opal Hotel Room Booking plugin <= 1.2.7 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/opal-hotel-room-booking/ - https://patchstack.com/database/vulnerability/opal-hotel-room-booking/wordpress-opal-hotel-room-booking-plug
-booking/ - https://patchstack.com/database/vulnerability/opal-hotel-room-booking/wordpress-opal-hotel-room-booking-plugin-1-2-7-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-29450 State: PUBLISHED Published: 2022-06-15T18:52:31.232Z Last Updated: 2025-04-23T18:14:17.365Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Oliver Schlöbe Products: Admin Management Xtended (WordPress plugin) Problem Types: CWE-352 Description: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Admin Management Xtended plugin <= 2.4.4 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/admin-management-xtended/wordpress-admin-management-xtended-plugin-2-4-4-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cve - htt
wordpress-admin-management-xtended-plugin-2-4-4-multiple-cross-site-request-forgery-csrf-vulnerabilities?_s_id=cve - https://github.com/oliverschloebe/admin-management-xtended/commit/f94732d222414f10ce015e95b5c7c9fba13a8a20
CVE ID: CVE-2022-29451 State: PUBLISHED Published: 2022-04-29T16:58:13.542Z Last Updated: 2025-02-20T20:23:54.784Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Raratheme Products: Rara One Click Demo Import (WordPress plugin) Problem Types: CWE-352, CWE-434 Description: Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin <= 1.2.9 on WordPress allows attackers to trick logged-in admin users into uploading dangerous files into /wp-content/uploads/ directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/rara-one-click-dem
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/rara-one-click-demo-import/#developers - https://patchstack.com/database/vulnerability/rara-one-click-demo-import/wordpress-rara-one-click-demo-import-plugin-1-2-9-cross-site-request-forgery-csrf-leads-to-arbitrary-file-upload-vulnerability
CVE ID: CVE-2022-29452 State: PUBLISHED Published: 2022-06-15T19:52:24.505Z Last Updated: 2025-02-20T20:18:09.016Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N) Vendors: Atlas Gondal Products: Export All URLs (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (editor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Export All URLs plugin <= 4.1 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/export-all-urls/#developers - https://patchstack.com/database/vulnerability/export-all-urls/wordpress-export-all-urls-plugin-4-1-authenticated-stored-cross
://patchstack.com/database/vulnerability/export-all-urls/wordpress-export-all-urls-plugin-4-1-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-29453 State: PUBLISHED Published: 2022-06-15T15:16:40.815Z Last Updated: 2025-02-20T20:19:18.186Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: AyeCode Ltd Products: API KEY for Google Maps Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in API KEY for Google Maps plugin <= 1.2.1 at WordPress leading to Google Maps API key update. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/api-key-for-google-maps/#developers - https://patchstack.com/database/vulnerability/api-key-for-google-maps/wordpress-api-key-for-google-maps-plugin-1-2-1-csr
https://patchstack.com/database/vulnerability/api-key-for-google-maps/wordpress-api-key-for-google-maps-plugin-1-2-1-csrf-vulnerability-leading-to-google-maps-api-key-update
CVE ID: CVE-2022-29454 State: PUBLISHED Published: 2022-07-20T18:36:46.390Z Last Updated: 2025-02-20T20:17:45.347Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WordPlus Products: Better Messages (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress allows attackers to upload files. File attachment to messages must be activated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/bp-better-messages/#developers - https://patchstack.com/database/vulnerability/bp-better-messages/wordpres
s.org/plugins/bp-better-messages/#developers - https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-better-messages-plugin-1-9-9-148-cross-site-request-forgery-csrf-vulnerability
CVE ID: CVE-2022-29455 State: PUBLISHED Published: 2022-06-13T16:09:13.291Z Last Updated: 2025-02-20T20:20:10.272Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: Elementor Products: Elementor Website Builder (WordPress plugin) Problem Types: CWE-79 Description: DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/elementor/#developers - https://rotem-bar.com/hacking-65-million-websites-greater-cve-2022-29455-elementor - https://patchstack.com/database/vulnerability/
em-bar.com/hacking-65-million-websites-greater-cve-2022-29455-elementor - https://patchstack.com/database/vulnerability/elementor/wordpress-elementor-plugin-3-5-5-unauthenticated-dom-based-reflected-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-29457 State: PUBLISHED Published: 2022-04-18T19:47:07 Last Updated: 2024-08-03T06:26:05.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path configuration steps. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/self-service-password/release-notes.html - https://docs.unsafe-inline.com/0day/multiple-manageengine-applications-critical-information-disclosure-vulnerability - http://packetstormsecurity.com/files/167051/ManageEngine-ADSelfService
s-critical-information-disclosure-vulnerability - http://packetstormsecurity.com/files/167051/ManageEngine-ADSelfService-Plus-Build-6118-NTLMv2-Hash-Exposure.html
CVE ID: CVE-2022-29458 State: PUBLISHED Published: 2022-04-18T00:00:00.000Z Last Updated: 2025-06-09T14:53:36.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.gnu.org/archive/html/bug-ncurses/2022-04/msg00014.html - https://lists.gnu.org/archive/html/bug-ncurses/2022-04/msg00016.html - https://support.apple.com/kb/HT213488 - https://lists.debian.org/debian-lts-announce/2022/10/msg00037.html - http://seclists.org/fulldisclosu
.com/kb/HT213488 - https://lists.debian.org/debian-lts-announce/2022/10/msg00037.html - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28