Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-1507 State: PUBLISHED Published: 2025-03-14T08:23:04.440Z Last Updated: 2025-03-14T13:11:55.574Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: sharethis Products: ShareThis Dashboard for Google Analytics Problem Types: CWE-862 Description: The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_actions() function in all versions up to, and including, 3.2.1. This makes it possible for unauthenticated attackers to disable all features. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-in
sable all features. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/314b8638-15e7-461d-a705-3858fe6813e7?source=cve - https://plugins.trac.wordpress.org/changeset/3255511/googleanalytics/trunk/class/core/class-ga-controller-core.php
CVE ID: CVE-2025-1508 State: PUBLISHED Published: 2025-03-12T03:21:27.735Z Last Updated: 2025-03-12T13:31:16.173Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: themeum Products: WP Crowdfunding Problem Types: CWE-862 Description: The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_data action in all versions up to, and including, 2.1.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to download all of a site's post content when WooCommerce is installed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www
post content when WooCommerce is installed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/70a93afa-9801-41d2-8923-ca4ae6ae974f?source=cve - https://wordpress.org/plugins/wp-crowdfunding/
CVE ID: CVE-2025-1509 State: PUBLISHED Published: 2025-02-22T03:20:59.817Z Last Updated: 2025-02-22T15:29:47.834Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: versluis Products: Show Me The Cookies Problem Types: CWE-94 Description: The The Show Me The Cookies plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://w
ed attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/65d15ceb-ab39-4088-a289-7244063aedf8?source=cve - https://wordpress.org/plugins/show-me-the-cookies/
CVE ID: CVE-2025-1510 State: PUBLISHED Published: 2025-02-22T03:21:00.228Z Last Updated: 2025-02-22T15:27:34.620Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: keesiemeijer Products: Custom Post Type Date Archives Problem Types: CWE-94 Description: The The Custom Post Type Date Archives plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.7.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichm
t possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/996ade9c-2531-4f43-87f6-eddb2ce98a12?source=cve - https://wordpress.org/plugins/custom-post-type-date-archives/
CVE ID: CVE-2025-1511 State: PUBLISHED Published: 2025-02-28T05:23:14.432Z Last Updated: 2025-02-28T15:07:11.850Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wpeverest Products: User Registration & Membership – Custom Registration Form, Login Form, and User Profile Problem Types: CWE-79 Description: The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w
cient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0e0bee7c-8dce-421c-af16-7e5152797e6c?source=cve - https://plugins.trac.wordpress.org/browser/user-registration/tags/4.0.2/modules/membership/includes/Admin/Membership/ListTable.php#L246 - https://plugins.trac.wordpress.org/changeset/3246826/user-registration/tags/4.1.0/modules/membership/includes/Admin/Membership/ListTable.php
CVE ID: CVE-2025-1512 State: PUBLISHED Published: 2025-04-01T06:52:05.756Z Last Updated: 2025-04-01T14:23:47.059Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ideaboxcreations Products: PowerPack Elementor Addons (Free Widgets, Extensions and Templates) Problem Types: CWE-79 Description: The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Cursor Extension in all versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inje
nd output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/90579442-b05c-459e-93cb-f4883b6472ff?source=cve - https://plugins.trac.wordpress.org/changeset/3262339/powerpack-lite-for-elementor/trunk/assets/js/pp-custom-cursor.js
CVE ID: CVE-2025-1513 State: PUBLISHED Published: 2025-02-28T05:23:15.197Z Last Updated: 2025-02-28T15:04:27.491Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: contest-gallery Products: Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons Problem Types: CWE-79 Description: The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Name and Comment field when commenting on photo gallery entries in all versions up
Stored Cross-Site Scripting via the Name and Comment field when commenting on photo gallery entries in all versions up to, and including, 26.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1b5cf360-0163-4a7c-8979-ec89ec80ad62?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3245199%40contest-gallery&new=3245199%40contest-gallery&sfp_email=&sfph_mail=
CVE ID: CVE-2025-1514 State: PUBLISHED Published: 2025-03-26T08:21:51.303Z Last Updated: 2025-03-26T14:12:17.566Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: realmag777 Products: Active Products Tables for WooCommerce. Use constructor to create tables Problem Types: CWE-20 Description: The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to unauthorized filter calling due to insufficient restrictions on the get_smth() function in all versions up to, and including, 1.0.6.7. This makes it possible for unauthenticated attackers to call arbitrary WordPress filters with a single parameter. Additional An
kes it possible for unauthenticated attackers to call arbitrary WordPress filters with a single parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6edf91de-9553-4aa1-a29f-89771c8e852e?source=cve - https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L1753 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3257043%40profit-products-tables-for-woocommerce&new=3257043%40profit-products-tables-for-woocommerce&sfp_email=&sfph_mail=
CVE ID: CVE-2025-1515 State: PUBLISHED Published: 2025-03-05T09:21:47.916Z Last Updated: 2025-03-05T14:21:10.735Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Chimpstudio Products: WP Real Estate Manager Problem Types: CWE-288 Description: The WP Real Estate Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.8. This is due to insufficient identity verification on the LinkedIn login request process. This makes it possible for unauthenticated attackers to bypass official authentication and log in as any user on the site, including administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: Re
tion and log in as any user on the site, including administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/84f08111-d116-46f9-9765-28966e338753?source=cve - https://themeforest.net/item/home-villa-real-estate-wordpress-theme/19446059
CVE ID: CVE-2025-1516 State: PUBLISHED Published: 2025-06-12T10:02:45.134Z Last Updated: 2025-06-12T13:38:08.165Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 8.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper input validation in Tokens Names could be used to trigger a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/520553 - https://hackerone.com/reports/2991435
CVE ID: CVE-2025-1517 State: PUBLISHED Published: 2025-02-26T08:21:56.971Z Last Updated: 2025-02-26T15:32:27.665Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: shaonsina Products: Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) Problem Types: CWE-79 Description: The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text, Countdown Widget, and Login Form shortcodes in all versions up to, and including, 3.
ipting via the plugin's Fancy Text, Countdown Widget, and Login Form shortcodes in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e699f521-9133-41b0-b667-528da78fec06?source=cve - https://wordpress.org/plugins/sina-extension-for-elementor/#developers - https://plugins.trac.wordpress.org/browser/sina
https://wordpress.org/plugins/sina-extension-for-elementor/#developers - https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/widgets/basic/sina-fancytext.php - https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/widgets/advanced/sina-countdown.php - https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/widgets/advanced/sina-login-form.php - https://github.com/shaonsina/sina-extension-for-elementor/commit/5cb89db08b15a3011800ee0f6ad68c69c5a256d5 - https://plugins.trac.wordpress.org/changeset/3246221/
CVE ID: CVE-2025-1520 State: PUBLISHED Published: 2025-04-23T16:45:19.536Z Last Updated: 2025-04-23T18:13:52.561Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PostHog Products: PostHog Problem Types: CWE-89 Description: PostHog ClickHouse Table Functions SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PostHog. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the SQL parser. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL qu
rser. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the database account. Was ZDI-CAN-25350. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-099/ - https://github.com/PostHog/posthog/commit/6e8f035f9acd339c5ba87ba6ea40fc1ab3053d42
CVE ID: CVE-2025-1521 State: PUBLISHED Published: 2025-04-23T16:45:32.855Z Last Updated: 2025-04-23T18:10:39.906Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: PostHog Products: PostHog Problem Types: CWE-918 Description: PostHog slack_incoming_webhook Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PostHog. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of the slack_incoming_webhook parameter. The issue results from the lack of proper validation of a URI prior to accessing resou
slack_incoming_webhook parameter. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-25352. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-096/ - https://github.com/PostHog/posthog/commit/6e8f035f9acd339c5ba87ba6ea40fc1ab3053d42
CVE ID: CVE-2025-1522 State: PUBLISHED Published: 2025-04-23T16:45:44.643Z Last Updated: 2025-04-23T18:30:31.914Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: PostHog Products: PostHog Problem Types: CWE-918 Description: PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PostHog. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the database_schema method. The issue results from the lack of proper validation of a URI prior to accessing resources. An atta
abase_schema method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-25358. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-097/ - https://github.com/PostHog/posthog/commit/3732c0fd9551ed29521b58611bf1e44d918c1032
CVE ID: CVE-2025-1523 State: PUBLISHED Published: 2025-04-17T06:00:09.950Z Last Updated: 2025-04-17T19:08:15.827Z Vendors: Unknown Products: Ultimate Dashboard Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5a20768f-3128-4b0a-a06b-2247f3e02c99/
CVE ID: CVE-2025-1524 State: PUBLISHED Published: 2025-04-17T06:00:10.239Z Last Updated: 2025-04-17T19:07:37.307Z Vendors: Unknown Products: Ultimate Dashboard Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/36aed1e4-05cb-42d2-b835-f6336f1a82cd/
CVE ID: CVE-2025-1525 State: PUBLISHED Published: 2025-04-17T06:00:10.575Z Last Updated: 2025-04-17T19:05:43.294Z Vendors: Unknown Products: Ultimate Dashboard Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d457733f-72e9-45e2-ac07-4e1b94e46102/
CVE ID: CVE-2025-1526 State: PUBLISHED Published: 2025-03-14T07:23:20.308Z Last Updated: 2025-03-14T14:51:29.289Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: detheme Products: DethemeKit for Elementor Problem Types: CWE-79 Description: The DethemeKit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the De Product Display Widget (countdown feature) in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acces
ith Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6e01ae00-0d07-4e9a-928e-e10cf679df2e?source=cve - https://plugins.trac.wordpress.org/browser/dethemekit-for-elementor/trunk/assets/frontend/js/dethemekit-addons.js#L815 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3255121%40dethemekit-for-elementor&new=3255121%40dethemekit-for-elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2025-1527 State: PUBLISHED Published: 2025-03-12T11:13:32.596Z Last Updated: 2025-03-12T14:10:20.904Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: devitemsllc Products: ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) Problem Types: CWE-79 Description: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to a Stored DOM-Based Cross-Site Scripting via the plugin's Flash Sale Countdown module in all versions up to, and including, 3.1.0 due to insufficient input sanitization and outpu
Flash Sale Countdown module in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d3405b50-a3f0-4280-8a34-ed86ce3d4db4?source=cve - https://plugins.trac.wordpress.org/changeset/3253711/woolentor-addons/trunk/includes/modules/flash-sale/assets/js/flash-sale.js
CVE ID: CVE-2025-1528 State: PUBLISHED Published: 2025-03-14T04:22:32.521Z Last Updated: 2025-03-14T14:10:46.412Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Search & Filter Products: Search & Filter Pro Problem Types: CWE-862 Description: The Search & Filter Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_meta_values' function in all versions up to, and including, 2.5.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the values of arbitrary post meta. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfe
d the values of arbitrary post meta. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/47adb5fe-534f-48a9-81a3-883e1d2cda7f?source=cve - https://searchandfilter.com/search-filter-2-5-20-security-release/
CVE ID: CVE-2025-1529 State: PUBLISHED Published: 2025-05-01T11:11:40.903Z Last Updated: 2025-05-01T13:59:01.687Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: johanaarstein Products: AM LottiePlayer Problem Types: CWE-79 Description: The AM LottiePlayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded lottie files in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Note
ject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0f44fcc8-c5e0-44f5-92c3-6603b19a06fe?source=cve - https://plugins.trac.wordpress.org/changeset/3278523/am-lottieplayer
CVE ID: CVE-2025-1530 State: PUBLISHED Published: 2025-03-15T11:13:28.584Z Last Updated: 2025-03-17T21:27:38.567Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: tripetto Products: WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto Problem Types: CWE-352 Description: The Tripetto plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.0.9. This is due to missing nonce validation. This makes it possible for unauthenticated attackers to delete arbitrary results via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Addit
a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dd80abd9-3f41-414a-a781-9bff7d85ec4b?source=cve - https://plugins.trac.wordpress.org/browser/tripetto/trunk/lib/capabilities.php - https://wordpress.org/plugins/tripetto/#developers - https://plugins.trac.wordpress.org/changeset/3251202/tripetto/trunk/admin/results/list.php - https://plugins.trac.wordpress.org/changeset/3251202/ - https://plugins.trac.wordpress.org/changeset/3251202/tripetto/trunk/admin/results/results.php