Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
that execute if they can successfully trick a user into performing an action such as clicking on a link. This required WP_DEBUG to be enabled in order to be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/18e0140e-ac24-48c6-aea0-bb0da203a817?source=cve - https://plugins.trac.wordpress.org/changeset/3139143/string-locator/tags/2.6.6/includes/Extension/SQL/views/editor/sql.php
CVE ID: CVE-2023-6988 State: PUBLISHED Published: 2024-01-11T08:32:30.935Z Last Updated: 2025-06-03T14:10:00.788Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: extendthemes Products: Colibri Page Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's extend_builder_render_js shortcode in all versions up to, and including, 1.0.239 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contrib
ization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/300b24af-10a1-45b9-87ec-7c98dc94e76b?source=cve - https://plugins.svn.wordpress.org/colibri-page-builder/trunk/extend-builder/shortcodes/render-js.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3013337%40colibri-page-builder&new=3013337%40colibri-page-build
dpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3013337%40colibri-page-builder&new=3013337%40colibri-page-builder&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6989 State: PUBLISHED Published: 2024-02-05T21:21:31.299Z Last Updated: 2024-11-07T20:47:06.341Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: paultgoodchild Products: Shield Security – Smart Bot Blocking & Intrusion Prevention Security Problem Types: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Description: The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the render_action_template parameter. This makes it possible for unauthenticated attacke
p to, and including, 18.5.9 via the render_action_template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/063826cc-7ff3-4869-9831-f6a4a4bbe74c?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3013699%40wp-simple-firewall&new=3013699%40wp-simple-firewall&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6990 State: PUBLISHED Published: 2024-01-11T08:32:54.265Z Last Updated: 2025-06-17T21:09:15.266Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: wpweaver Products: Weaver Xtreme Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Weaver Xtreme theme for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta in all versions up to, and including, 6.3.0 due to insufficient input sanitization and output escaping on user supplied meta (page-head-code). This makes it possible for authenticated attackers with contributor-level and above permissions to injec
age-head-code). This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bc7384d7-c2fd-4d63-9b80-bb5bde9a23d5?source=cve - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=212828%40weaver-xtreme&new=212828%40weaver-xtreme&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6991 State: PUBLISHED Published: 2024-01-15T15:10:41.733Z Last Updated: 2025-06-11T16:42:03.110Z Vendors: Unknown Products: JSM file_get_contents() Shortcode Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The JSM file_get_contents() Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a request to it, which could allow users with contributor role and above to perform SSRF attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0b92becb-8a47-48fd-82e8-f7641cf5c9bc
CVE ID: CVE-2023-6992 State: PUBLISHED Published: 2024-01-04T11:11:07.558Z Last Updated: 2024-09-06T18:16:58.376Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Cloudflare Products: zlib Problem Types: CWE-20, CWE-122, CWE-126 Description: Cloudflare version of zlib library was found to be vulnerable to memory corruption issues affecting the deflation algorithm implementation (deflate.c). The issues resulted from improper input validation and heap-based buffer overflow. A local attacker could exploit the problem during compression using a crafted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in co
afted malicious file potentially leading to denial of service of the software. Patches: The issue has been patched in commit 8352d10 https://github.com/cloudflare/zlib/commit/8352d108c05db1bdc5ac3bdf834dad641694c13c . The upstream repository is not affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/zlib - https://github.com/cloudflare/zlib/security/advisories/GHSA-vww9-j87r-4cqh
CVE ID: CVE-2023-6993 State: PUBLISHED Published: 2024-04-09T18:58:39.607Z Last Updated: 2024-08-02T08:50:06.882Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: totalpressorg Products: Custom post types, Custom Fields & more Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Custom post types, Custom Fields & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and custom post meta in all versions up to, and including, 5.0.4 due to insufficient input sanitization and output escaping on user supplied post meta values. This makes it possible f
4 due to insufficient input sanitization and output escaping on user supplied post meta values. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2b1449a9-6c89-4dec-8107-86cf8a295025?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3063871%40custom-post-types&new=3063871%40custom-post-types&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6994 State: PUBLISHED Published: 2024-01-11T08:32:36.170Z Last Updated: 2024-11-06T18:56:25.048Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: fernandobt Products: List category posts Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.89.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above
scaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/611871cc-737f-44e3-baf5-dbaa8bd8eb81?source=cve - https://plugins.svn.wordpress.org/list-category-posts/trunk/include/lcp-wrapper.php - https://plugins.svn.wordpress.org/list-category-posts/trunk/list-category-posts.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3018689%40list
ist-category-posts.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3018689%40list-category-posts&new=3018689%40list-category-posts&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6996 State: PUBLISHED Published: 2024-02-05T21:22:02.792Z Last Updated: 2025-05-08T20:49:21.617Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: josevega Products: Display custom fields in the frontend – Post and User Profile Fields Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Code Injection via the plugin's vg_display_data shortcode in all versions up to, and including, 1.2.1 due to insufficient input validation and restriction on access to that shortcode. This makes it possible for aut
, 1.2.1 due to insufficient input validation and restriction on access to that shortcode. This makes it possible for authenticated attackers with contributor-level and above permissions to call arbitrary functions and execute code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e0662c3a-5b82-4b9a-aa69-147094930d1f?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3021133%40shortcode-to-display-post-and-user-data&new=3021133%40shortcode-to-display-post-and-user-data&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6997 State: REJECTED Published: N/A Last Updated: 2024-06-07T18:17:22.040Z Description: No description available.
CVE ID: CVE-2023-6998 State: PUBLISHED Published: 2023-12-30T18:32:07.452Z Last Updated: 2024-10-10T15:36:12.108Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: CoolKit Technology Products: eWeLink - Smart Home, eWeLink-Smart Home Problem Types: CWE-305 Description: Improper privilege management vulnerability in CoolKit Technology eWeLink on Android and iOS allows application lockscreen bypass.This issue affects eWeLink before 5.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://cert.pl/en/posts/2023/12/CVE-2023-6998/ - https://cert.pl/posts/2023/12/CVE-2023-6998/ - https://ewelink.cc/app/
CVE ID: CVE-2023-6999 State: PUBLISHED Published: 2024-04-09T18:59:26.244Z Last Updated: 2024-08-08T19:46:34.642Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: sc0ttkclark Products: Pods – Custom Content Types and Fields Problem Types: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') Description: The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Remote Code Exxecution via shortcode in all versions up to, and including, 3.0.10 (with the exception of 2.7.31.2, 2.8.23.2, 2.9.19.2). This makes it possible for authenticated attackers, with contributor level access or higher, to execute code
2.9.19.2). This makes it possible for authenticated attackers, with contributor level access or higher, to execute code on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d9108d5f-7b8b-478d-ba9d-f895bdb7dbf2?source=cve - https://plugins.trac.wordpress.org/browser/pods/trunk/classes/PodsView.php#L750 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3039486%40pods%2Ftrunk&old=3039467%40pods%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-7002 State: PUBLISHED Published: 2023-12-23T01:59:51.281Z Last Updated: 2025-04-23T16:16:23.852Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: migrate Products: Backup Migration Problem Types: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Description: The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operating system. Additional Analyst Notes: - CVE Progr
permissions and above, to execute arbitrary commands on the host operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cc49db10-988d-42bd-a9cf-9a86f4c79568?source=cve - https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/ajax.php#L88 - https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/ajax.php#L1518 - https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/ajax.php#L1503 - https://www.linuxquestions.org/questions/linux-security-4/php-function-exec-enabled-how-big-issue-4175508082/ - https://plugins.trac.wordpr
estions.org/questions/linux-security-4/php-function-exec-enabled-how-big-issue-4175508082/ - https://plugins.trac.wordpress.org/changeset/3012745/backup-backup
CVE ID: CVE-2023-7003 State: PUBLISHED Published: 2024-03-15T17:09:14.442Z Last Updated: 2025-11-04T18:22:05.474Z Vendors: Sciener Products: Kontrol Lux Problem Types: CWE-323 Description: The AES key utilized in the pairing process between a lock using Sciener firmware and a wireless keypad is not unique, and can be reused to compromise other locks using the Sciener firmware. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/
CVE ID: CVE-2023-7004 State: PUBLISHED Published: 2024-03-15T17:08:11.547Z Last Updated: 2025-11-04T18:22:06.692Z Vendors: Sciener Products: TTLock App Problem Types: CWE-319 Cleartext Transmission of Sensitive Information Description: The TTLock App does not employ proper verification procedures to ensure that it is communicating with the expected device, allowing for connection to a device that spoofs the MAC address of a lock, which compromises the legitimate locks integrity. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/
CVE ID: CVE-2023-7005 State: PUBLISHED Published: 2024-12-19T17:35:45.594Z Last Updated: 2025-11-04T18:22:07.890Z Vendors: Sciener Products: TTLock App Problem Types: CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') Description: A specially crafted message can be sent to the TTLock App that downgrades the encryption protocol used for communication, and can be utilized to compromise the lock, such as through revealing the unlockKey field. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/
CVE ID: CVE-2023-7006 State: PUBLISHED Published: 2024-03-15T17:08:34.433Z Last Updated: 2025-11-04T18:22:09.047Z Vendors: Sciener Products: Kontrol Lux Problem Types: CWE-799: Improper Control of Interaction Frequency, CWE-307: Improper Restriction of Excessive Authentication Attempts Description: The unlockKey character in a lock using Sciener firmware can be brute forced through repeated challenge requests, compromising the locks integrity. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/
CVE ID: CVE-2023-7007 State: PUBLISHED Published: 2024-03-15T17:08:58.433Z Last Updated: 2025-11-04T18:22:10.299Z Vendors: Sciener Products: Gateway G2 Problem Types: CWE-290 Authentication Bypass by Spoofing, CWE-287 Improper Authentication, CWE-306 Missing Authentication for Critical Function Description: Sciener server does not validate connection requests from the GatewayG2, allowing an impersonation attack that provides the attacker the unlockKey field. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/
CVE ID: CVE-2023-7008 State: PUBLISHED Published: 2023-12-23T13:00:50.515Z Last Updated: 2025-11-06T21:45:35.192Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Cryostat 2 Problem Types: CWE-300 Description: A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:2463 - https://access.redhat.co
Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:2463 - https://access.redhat.com/errata/RHSA-2024:3203 - https://access.redhat.com/security/cve/CVE-2023-7008 - https://bugzilla.redhat.com/show_bug.cgi?id=2222261 - https://bugzilla.redhat.com/show_bug.cgi?id=2222672 - https://github.com/systemd/systemd/issues/25676
CVE ID: CVE-2023-7009 State: PUBLISHED Published: 2024-03-15T17:07:48.318Z Last Updated: 2025-11-04T18:22:11.492Z Vendors: Sciener Products: Kontrol Lux Problem Types: CWE-311 Missing Encryption of Sensitive Data, CWE-319 Cleartext Transmission of Sensitive Information Description: Some Sciener-based locks support plaintext message processing over Bluetooth Low Energy, allowing unencrypted malicious commands to be passed to the lock. These malicious commands, less then 16 bytes in length, will be processed by the lock as if they were encrypted communications. This can be further exploited by an attacker to compromise the lock's integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: -
rther exploited by an attacker to compromise the lock's integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://alephsecurity.com/2024/03/07/kontrol-lux-lock-2/
CVE ID: CVE-2023-7010 State: PUBLISHED Published: 2024-07-16T22:30:26.728Z Last Updated: 2024-08-02T08:50:07.607Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in WebRTC in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html - https://issues.chromium.org/issues/40070891
CVE ID: CVE-2023-7011 State: PUBLISHED Published: 2024-07-16T22:14:00.933Z Last Updated: 2024-08-02T08:50:07.703Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Picture in Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_31.html - https://issues.chromium.org/issues/40066780
CVE ID: CVE-2023-7012 State: PUBLISHED Published: 2024-07-16T22:30:27.095Z Last Updated: 2024-08-02T08:50:08.212Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed an attacker who convinced a user to install a malicious app to potentially perform a sandbox escape via a malicious file. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_12.html - https://issues.chromium.org/issues/40061509
CVE ID: CVE-2023-7013 State: PUBLISHED Published: 2024-07-16T22:14:01.248Z Last Updated: 2024-11-25T18:15:36.868Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially spoof security UI via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-desktop_31.html - https://issues.chromium.org/issues/40071326
CVE ID: CVE-2023-7014 State: PUBLISHED Published: 2024-02-05T21:21:44.351Z Last Updated: 2025-06-17T21:29:25.280Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: molongui Products: Author Box, Guest Author and Co-Authors for Your Posts – Molongui Problem Types: CWE-359 Exposure of Private Information ('Privacy Violation') Description: The Author Box, Guest Author and Co-Authors for Your Posts – Molongui plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.4 via the 'ma_debu' parameter. This makes it possible for unauthenticated attackers to extract sensitive data including post author emails and names
r. This makes it possible for unauthenticated attackers to extract sensitive data including post author emails and names if applicable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/538e9ce3-2d48-44ad-bd08-8eead3ef15c3?source=cve - https://plugins.trac.wordpress.org/changeset/3019084/
CVE ID: CVE-2023-7015 State: PUBLISHED Published: 2024-03-13T15:27:06.039Z Last Updated: 2024-08-02T08:50:07.710Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: File Manager Products: File Manager Pro Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The File Manager Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tb' parameter in all versions up to, and including, 8.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successf
kes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/94750424-bb52-4236-962e-aa8cbdeb1459?source=cve - https://filemanagerpro.io/changelog/