Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11873 State: PUBLISHED Published: 2024-12-14T04:23:38.207Z Last Updated: 2024-12-16T17:51:06.294Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: glomex Products: glomex oEmbed Problem Types: CWE-79 Description: The glomex oEmbed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'glomex_integration' shortcode in all versions up to, and including, 0.9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acces
ith contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0e57cf85-eec0-4cf6-a800-ceb2b46e2bcd?source=cve - https://plugins.trac.wordpress.org/browser/glomex-oembed/tags/0.9.1/internals/OembedGlomexIntegrationShortcode.php#L98
CVE ID: CVE-2024-11874 State: PUBLISHED Published: 2025-01-11T07:21:51.502Z Last Updated: 2025-01-13T17:16:35.557Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bqworks Products: Grid Accordion Lite Problem Types: CWE-79 Description: The Grid Accordion Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'grid_accordion' shortcode in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a u
ackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7fc20069-5c1d-481a-b0fd-6f29ed6b41ee?source=cve - https://plugins.trac.wordpress.org/browser/grid-accordion-lite/tags/1.5.1/public/class-grid-accordion.php#L98 - https://plugins.trac.wordpress.org/browser/grid-accordion-lite/tags/1.5.1/public/class-grid-accordion.php#L445 - https://plugins.trac.wordpress.org/browser/grid-accordion-lite/tags/1.5.1/public/class-grid-accordion.php#L310 - https://plugins.trac.wordpress.org/bro
org/browser/grid-accordion-lite/tags/1.5.1/public/class-grid-accordion.php#L310 - https://plugins.trac.wordpress.org/browser/grid-accordion-lite/tags/1.5.1/public/class-accordion-renderer.php#L172
CVE ID: CVE-2024-11875 State: PUBLISHED Published: 2024-12-12T04:23:10.997Z Last Updated: 2024-12-12T15:00:14.889Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: hage Products: Add infos to The Events Calendar Problem Types: CWE-79 Description: The Add infos to the events calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fuss' shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute
enticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2f335839-73bc-4ede-9d86-6d8ff93cbecc?source=cve - https://plugins.trac.wordpress.org/browser/add-infos-to-the-events-calendar/tags/1.5.0/add-infos-to-the-events-calendar.php?rev=3205090#L94 - https://plugins.trac.wordpress.org/browser/add-infos-to-the-events-calendar/tags/1.4.1/add_shortcode_to_tec.php?rev=3205090
CVE ID: CVE-2024-11876 State: PUBLISHED Published: 2024-12-14T04:23:41.609Z Last Updated: 2024-12-16T20:06:22.357Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: yoannr35 Products: Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site Problem Types: CWE-79 Description: The Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kredeum_opensky' shortcode in all versions up to, and including, 1.6.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated a
ufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3eb74ac2-ac5d-477b-8142-3e42953f859b?source=cve - https://plugins.trac.wordpress.org/browser/kredeum-nfts/trunk/common/shortcode/shortcode.php#L34
CVE ID: CVE-2024-11877 State: PUBLISHED Published: 2024-12-14T04:23:47.163Z Last Updated: 2024-12-16T20:05:34.802Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpscore Products: Cricket Live Score Problem Types: CWE-79 Description: The Cricket Live Score plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cricket_score' shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user
ers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d9fe750f-5d8f-4c47-9d75-d928f1367fa8?source=cve - https://plugins.trac.wordpress.org/browser/cricket-score/tags/2.0.2/src/connectFscore.php#L19
CVE ID: CVE-2024-11878 State: PUBLISHED Published: 2024-12-20T06:59:11.219Z Last Updated: 2024-12-20T17:36:44.236Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gbsdeveloper Products: Category Post Slider Problem Types: CWE-79 Description: The Category Post Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'category-post-slider' shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute w
ticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e312e3eb-0da9-4ecf-aec6-86bfe08417f5?source=cve - https://plugins.trac.wordpress.org/browser/category-post-slider/tags/1.4/category-post-slider.php#L189
CVE ID: CVE-2024-11879 State: REJECTED Published: 2024-12-14T04:23:40.550Z Last Updated: 2025-03-16T14:46:33.264Z Description: No description available.
CVE ID: CVE-2024-11880 State: PUBLISHED Published: 2024-12-04T08:22:47.289Z Last Updated: 2024-12-04T14:09:09.014Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bplugins Products: B Testimonial – Testimonial plugin for WP Problem Types: CWE-79 Description: The B Testimonial – testimonial plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'b_testimonial' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scr
This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ea251110-02fa-4f4e-a578-855d3331b200?source=cve - https://plugins.trac.wordpress.org/browser/b-testimonial/tags/1.2.2/inc/theme/one.php#L18 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3200155%40b-testimonial&new=3200155%40b-testimonial&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset/3200155/b-testimonial/trunk/inc/theme/
-testimonial&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset/3200155/b-testimonial/trunk/inc/theme/one.php
CVE ID: CVE-2024-11881 State: PUBLISHED Published: 2024-12-18T02:24:11.813Z Last Updated: 2024-12-18T16:36:25.228Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: tymotey Products: Easy Waveform Player Problem Types: CWE-79 Description: The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easywaveformplayer' shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenev
ed attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/17a0d8b3-e54d-4af4-8915-e8b192cc138b?source=cve - https://plugins.trac.wordpress.org/browser/easy-waveform-player/trunk/includes/class-easywaveformplayer.php#L263 - https://plugins.trac.wordpress.org/changeset/3208124/easy-waveform-player/trunk/includes/class-easywaveformplayer.php
CVE ID: CVE-2024-11882 State: PUBLISHED Published: 2024-12-12T05:24:18.791Z Last Updated: 2024-12-12T16:04:18.322Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bplugins Products: FAQ And Answers – Create Frequently Asked Questions Area on WP Sites Problem Types: CWE-79 Description: The FAQ And Answers – Create Frequently Asked Questions Area on WP Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'faq' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level a
utput escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0f7f19fa-f3d9-41e9-94f5-9d817330f1ef?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3206469%40faq-and-answers&new=3206469%40faq-and-answers&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11883 State: PUBLISHED Published: 2024-12-14T04:23:43.765Z Last Updated: 2024-12-16T17:50:10.781Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: connatix Products: Connatix Video Embed Problem Types: CWE-79 Description: The Connatix Video Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cnx_script_code' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/89512190-a0fe-495a-9dda-8d8540a5325c?source=cve - https://plugins.trac.wordpress.org/browser/connatix-video-embed/tags/1.0.5/connatix-video-embed.php#L219
CVE ID: CVE-2024-11884 State: PUBLISHED Published: 2024-12-14T04:23:48.591Z Last Updated: 2024-12-16T17:49:19.175Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gopiplus Products: Wp photo text slider 50 Problem Types: CWE-79 Description: The Wp photo text slider 50 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-photo-slider' shortcode in all versions up to, and including, 8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute when
ated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f98f11da-b0ae-4c00-9708-88d6044abda2?source=cve - https://plugins.trac.wordpress.org/browser/wp-photo-text-slider-50/trunk/wp-photo-text-slider-50.php#L250 - https://wordpress.org/plugins/wp-photo-text-slider-50/
CVE ID: CVE-2024-11885 State: PUBLISHED Published: 2024-12-24T05:23:43.176Z Last Updated: 2024-12-24T16:35:45.433Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ninjateam Products: NinjaTeam Chat for Telegram Problem Types: CWE-79 Description: The NinjaTeam Chat for Telegram plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'njtele_button shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execut
henticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/338d9348-da24-44b9-ac97-a7a8a7376815?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3209678%40ninjateam-telegram&new=3209678%40ninjateam-telegram
CVE ID: CVE-2024-11886 State: PUBLISHED Published: 2025-01-31T05:22:33.829Z Last Updated: 2025-01-31T16:50:15.673Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: vcita Products: Contact Form and Calls To Action by vcita Problem Types: CWE-79 Description: The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vCitaMeetingScheduler ' shortcode in all versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary w
utes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4a9021b4-54f8-4ba3-bc81-49271dde1b44?source=cve - https://plugins.trac.wordpress.org/browser/lead-capturing-call-to-actions-by-vcita/trunk/lead-capturing-call-to-actions.php#L44 - https://plugins.trac.wordpress.org/browser/lead-capturing-call-to-actions-by-vcita/trunk/vcita-widgets-functions.php#L63 - https://plugins.trac.wordpress.org/browser/lead-capturing-call-to-actions
-vcita/trunk/vcita-widgets-functions.php#L63 - https://plugins.trac.wordpress.org/browser/lead-capturing-call-to-actions-by-vcita/trunk/vcita-widgets-functions.php#L104
CVE ID: CVE-2024-11887 State: PUBLISHED Published: 2025-01-07T05:23:58.661Z Last Updated: 2025-01-07T16:13:42.839Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: geotargetly Products: Geo Content Problem Types: CWE-79 Description: The Geo Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'geotargetlygeocontent' shortcode in all versions up to, and including, 6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acc
with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c52cdb58-c97a-43a6-a3ff-be084ceee085?source=cve - https://plugins.trac.wordpress.org/browser/geo-targetly-geo-content/trunk/geotargetly-geo-content.php#L157 - https://wordpress.org/plugins/geo-targetly-geo-content/
CVE ID: CVE-2024-11888 State: PUBLISHED Published: 2024-12-14T04:23:47.883Z Last Updated: 2024-12-16T17:49:33.828Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ider Products: IDer Login for WordPress Problem Types: CWE-79 Description: The IDer Login for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ider_login_button' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute when
ated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/de602cf8-cc02-4459-aa23-5d8236048bca?source=cve - https://plugins.trac.wordpress.org/browser/ider-login/trunk/includes/IDER_Shortcodes.php#L49 - https://wordpress.org/plugins/ider-login
CVE ID: CVE-2024-11889 State: PUBLISHED Published: 2024-12-14T04:23:38.658Z Last Updated: 2024-12-16T17:50:59.194Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: homeasap Products: My IDX Home Search Problem Types: CWE-79 Description: The My IDX Home Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-idx-search' shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/172b6b54-d1de-48f9-ad2f-00d62d7e91fd?source=cve - https://plugins.trac.wordpress.org/browser/my-idx-home-search/trunk/includes/class-homeasap-search-loader.php#L133 - https://wordpress.org/plugins/my-idx-home-search
CVE ID: CVE-2024-11890 State: REJECTED Published: N/A Last Updated: 2025-02-11T00:05:12.567Z Description: No description available.
CVE ID: CVE-2024-11891 State: PUBLISHED Published: 2024-12-12T04:23:09.623Z Last Updated: 2024-12-12T15:05:44.274Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kaushik07 Products: Perfect Font Awesome Integration Problem Types: CWE-79 Description: The Perfect Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pfai' shortcode in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will exec
uthenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/11aac185-191b-4f7b-8472-84d3decd582f?source=cve - https://wordpress.org/plugins/perfect-font-awesome-integration/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3202640%40perfect-font-awesome-integration&new=3202640%40perfect-font-awesome-integration&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11892 State: PUBLISHED Published: 2025-01-11T07:21:53.872Z Last Updated: 2025-01-13T17:11:40.960Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bqworks Products: Accordion Slider Lite Problem Types: CWE-79 Description: The Accordion Slider Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'accordion_slider' shortcode in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenev
ed attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bb386ab5-1fb9-4649-99a6-0e3f971a02f8?source=cve - https://plugins.trac.wordpress.org/browser/accordion-slider-lite/tags/1.5.1/public/class-accordion-slider.php#L98 - https://plugins.trac.wordpress.org/browser/accordion-slider-lite/tags/1.5.1/public/class-accordion-slider.php#L445 - https://plugins.trac.wordpress.org/browser/accordion-slider-lite/tags/1.5.1/public/class-accordion-slider.php#L310 - https://plugins.trac
rac.wordpress.org/browser/accordion-slider-lite/tags/1.5.1/public/class-accordion-slider.php#L310 - https://plugins.trac.wordpress.org/browser/accordion-slider-lite/tags/1.5.1/public/class-accordion-renderer.php#L93 - https://plugins.trac.wordpress.org/browser/accordion-slider-lite/tags/1.5.1/public/class-accordion-renderer.php#L172
CVE ID: CVE-2024-11893 State: PUBLISHED Published: 2024-12-20T06:59:09.145Z Last Updated: 2024-12-20T17:37:17.541Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: spoki Products: Spoki – Chat Buttons and WooCommerce Notifications Problem Types: CWE-79 Description: The Spoki – Chat Buttons and WooCommerce Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spoki_button' shortcode in all versions up to, and including, 2.15.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a