Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-0067 State: PUBLISHED Published: 2023-02-21T08:50:41.315Z Last Updated: 2025-03-12T15:29:05.483Z Vendors: Unknown Products: Timed Content Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Timed Content WordPress plugin before 2.73 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/92f43da9-9903-4bcf-99e8-0e269072d389
CVE ID: CVE-2023-0068 State: PUBLISHED Published: 2023-03-06T13:34:02.785Z Last Updated: 2025-03-06T15:06:57.475Z Vendors: Unknown Products: Product GTIN (EAN, UPC, ISBN) for WooCommerce Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Product GTIN (EAN, UPC, ISBN) for WooCommerce WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4abd
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4abd1454-380c-4c23-8474-d7da4b2f3b8e
CVE ID: CVE-2023-0069 State: PUBLISHED Published: 2023-03-06T13:34:07.685Z Last Updated: 2025-03-05T19:41:38.889Z Vendors: Unknown Products: WPaudio MP3 Player Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WPaudio MP3 Player WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d9f00bcb-3746-4a9d-a222-4d532e84615f
CVE ID: CVE-2023-0070 State: PUBLISHED Published: 2023-02-06T19:59:13.338Z Last Updated: 2025-03-25T20:45:20.132Z Vendors: Unknown Products: ResponsiveVoice Text To Speech Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The ResponsiveVoice Text To Speech WordPress plugin before 1.7.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0d8fbd1a-9fac-42ac-94e0-f8921deb169
m Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0d8fbd1a-9fac-42ac-94e0-f8921deb1696
CVE ID: CVE-2023-0071 State: PUBLISHED Published: 2023-01-30T20:31:33.172Z Last Updated: 2025-03-27T20:06:57.897Z Vendors: Unknown Products: WP Tabs Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Tabs WordPress plugin before 2.1.17 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3834a162-2cdc-41e9-9c9d-2b576eed4db9
CVE ID: CVE-2023-0072 State: PUBLISHED Published: 2023-02-06T19:59:47.480Z Last Updated: 2025-03-25T17:41:37.201Z Vendors: Unknown Products: WC Vendors Marketplace Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WC Vendors Marketplace WordPress plugin before 2.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/bb2b876f-7216-4f31-9d1f-a45405c545ce
CVE ID: CVE-2023-0073 State: PUBLISHED Published: 2023-03-13T16:03:37.192Z Last Updated: 2025-02-27T15:44:43.170Z Vendors: Unknown Products: Client Logo Carousel Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Client Logo Carousel WordPress plugin through 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e5599968-a435-405a-8829-9840a2144987
CVE ID: CVE-2023-0074 State: PUBLISHED Published: 2023-01-30T20:31:45.765Z Last Updated: 2025-03-27T19:36:05.700Z Vendors: Unknown Products: WP Social Widget Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Social Widget WordPress plugin before 2.2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/82f543e3-9397-4364-9546-af5ea134fcd4
CVE ID: CVE-2023-0075 State: PUBLISHED Published: 2023-02-13T14:32:24.576Z Last Updated: 2025-03-21T19:39:00.907Z Vendors: Unknown Products: Amazon JS Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Amazon JS WordPress plugin through 0.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/097acd6f-3291-4cdc-a054-4432b6350411
CVE ID: CVE-2023-0076 State: PUBLISHED Published: 2023-03-06T13:33:57.963Z Last Updated: 2024-08-02T04:54:32.616Z Vendors: Unknown Products: Download Attachments Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Download Attachments WordPress plugin before 1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a0a44f8a-877c-40df-a3ba-b9b806ffb772/
CVE ID: CVE-2023-0077 State: PUBLISHED Published: 2023-01-05T09:07:22.013Z Last Updated: 2025-04-09T14:23:31.054Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Synology Products: Synology Router Manager (SRM) Problem Types: CWE-190: Integer Overflow or Wraparound Description: Integer overflow or wraparound vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows remote attackers to overflow buffers via unspecified vectors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_22_25
CVE ID: CVE-2023-0078 State: PUBLISHED Published: 2023-03-06T13:34:01.157Z Last Updated: 2025-05-05T16:11:08.870Z Vendors: Unknown Products: Resume Builder Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Resume Builder WordPress plugin through 3.1.1 does not sanitize and escape some parameters related to Resume, which could allow users with a role as low as subscriber to perform Stored XSS attacks against higher privilege users Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e667854f-56f8-4dbe-9573-6652a8aacc2c
CVE ID: CVE-2023-0079 State: PUBLISHED Published: 2024-01-16T15:54:58.622Z Last Updated: 2025-06-02T15:10:16.362Z Vendors: Unknown Products: Customer Reviews for WooCommerce Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Customer Reviews for WooCommerce WordPress plugin before 5.17.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fdaba4d1-950d-4512-95de-cd43fe
rogram Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fdaba4d1-950d-4512-95de-cd43fe9e73e5/
CVE ID: CVE-2023-0080 State: PUBLISHED Published: 2023-02-13T14:32:22.189Z Last Updated: 2025-03-21T15:24:17.363Z Vendors: Unknown Products: Customer Reviews for WooCommerce Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then
ir content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6b0d63ed-e244-4f20-8f10-a6e0c7ccadd4
CVE ID: CVE-2023-0081 State: PUBLISHED Published: 2023-02-06T19:59:38.040Z Last Updated: 2025-03-25T18:06:45.529Z Vendors: Unknown Products: MonsterInsights Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The MonsterInsights WordPress plugin before 8.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/76d2963c-ebff-498f-9484-3c3008750c14
CVE ID: CVE-2023-0082 State: PUBLISHED Published: 2023-02-06T19:59:29.364Z Last Updated: 2025-03-25T20:37:14.666Z Vendors: Unknown Products: ExactMetrics Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The ExactMetrics WordPress plugin before 7.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e1ba5047-0c39-478f-89c7-b0bb638efdff
CVE ID: CVE-2023-0083 State: PUBLISHED Published: 2023-03-10T10:44:22.877Z Last Updated: 2025-02-27T21:02:12.734Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-843 Description: The ArKUI framework subsystem within OpenHarmony-v3.1.5 and prior versions, OpenHarmony-v3.0.7 and prior versions has an Improper Input Validation vulnerability which local attackers can exploit this vulnerability to send malicious data, causing the current application to crash. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/en/security-dis
ram Container: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2023/2023-02.md
CVE ID: CVE-2023-0084 State: PUBLISHED Published: 2023-03-02T18:35:22.201Z Last Updated: 2025-01-13T17:02:38.761Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: xpeedstudio Products: Metform Elementor Contact Form Builder – Flexible and Design-Friendly Contact Form builder plugin for WordPress Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possi
in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, which is the submissions page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/05f7d9fe-e95f-4ddf-9bce-2aeac3c2e946 - https://wordpress.org/plugins/metform/#description - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2845078%40metform&new=2845078%40metform&sfp_email=&sfph_mail=
CVE ID: CVE-2023-0085 State: PUBLISHED Published: 2023-03-02T16:01:14.196Z Last Updated: 2025-01-13T17:03:00.273Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: xpeedstudio Products: Metform Elementor Contact Form Builder – Flexible and Design-Friendly Contact Form builder plugin for WordPress Problem Types: CWE-693 Protection Mechanism Failure Description: The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submission. This makes it possible for unauthenticated attackers to bypa
ng on the captcha value submitted during a form submission. This makes it possible for unauthenticated attackers to bypass Captcha restrictions and for attackers to utilize bots to submit forms. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/69527d4b-49b6-47cd-93b6-39350f881ec9 - https://wordpress.org/plugins/metform/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2868889%40metform&new=2868889%40metform&sfp_email=&sfph_mail=
CVE ID: CVE-2023-0086 State: PUBLISHED Published: 2023-01-05T16:21:28.154Z Last Updated: 2025-01-13T17:15:03.961Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: jetmonsters Products: JetWidgets For Elementor Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This is due to missing nonce validation on the save() function. This makes it possible for unauthenticated attackers to to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as
he plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be used to enable SVG uploads that could make Cross-Site Scripting possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8de3d3c7-bde2-4455-8d60-20307f0a53ee - https://plugins.trac.wordpress.org/browser/jetwidgets-for-elementor/trunk/includes/class-jet-widgets-settings.php#L149
CVE ID: CVE-2023-0087 State: PUBLISHED Published: 2023-01-05T18:13:58.328Z Last Updated: 2025-01-13T17:14:54.457Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: swiftylife Products: Swifty Page Manager Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Swifty Page Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘spm_plugin_options_page_tree_max_width’ parameter in versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and a
tion and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8550a405-9fa2-41a3-b556-05ff9f577ce4 - https://plugins.trac.wordpress.org/browser/swifty-page-manager/trunk/view/page_tree.php?rev=1555394#L174
CVE ID: CVE-2023-0088 State: PUBLISHED Published: 2023-01-05T18:15:34.743Z Last Updated: 2025-01-13T17:14:45.385Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: swiftylife Products: Swifty Page Manager Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Swifty Page Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on several AJAX actions handling page creation and deletion among other things. This makes it possible for unauthenticated attackers to invoke those functions, via forged request granted they can trick a site adm
t possible for unauthenticated attackers to invoke those functions, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/75b8f71d-9f75-4b42-ac5f-c6ffb476aae4 - https://plugins.trac.wordpress.org/browser/swifty-page-manager/trunk/swifty-page-manager.php?rev=1555394#L994
CVE ID: CVE-2023-0089 State: PUBLISHED Published: 2023-03-08T00:27:25.544Z Last Updated: 2025-02-28T16:36:53.420Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: proofpoint Products: enterprise_protection Problem Types: CWE-95 Description: The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to execute remote code through 'eval injection'. This affects all versions 8.20.0 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.proofpoint.com/security/security-advisories/pfpt-sa-2023-0001
CVE ID: CVE-2023-0090 State: PUBLISHED Published: 2023-03-08T00:27:36.914Z Last Updated: 2025-02-28T18:28:42.806Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: proofpoint Products: enterprise_protection Problem Types: CWE-95 Description: The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval injection'. Exploitation requires network access to the webservices API, but such access is a non-standard configuration. This affects all versions 8.20.0 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www
8.20.0 and below. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.proofpoint.com/security/security-advisories/pfpt-sa-2023-0001
CVE ID: CVE-2023-0091 State: PUBLISHED Published: 2023-01-11T20:44:07.553Z Last Updated: 2025-04-09T14:09:36.362Z Vendors: redhat.com Products: Keycloak Problem Types: n/a Description: A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-0091
CVE ID: CVE-2023-0092 State: PUBLISHED Published: 2025-01-31T01:41:46.439Z Last Updated: 2025-02-07T16:10:14.052Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Canonical Ltd. Products: Juju Description: An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/advisories/GHSA-x5rv-w9pm-8qp8 - https://github.com/juju/juju/commit/ef803e2a13692d355b784b7da8b4b1f01dab1556
CVE ID: CVE-2023-0093 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-06T19:42:29.370Z Vendors: Okta Products: Advanced Server Access Problem Types: Command Injection Description: Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need to phish the user to enter an attacker controlled server URL during enrollment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://trust.okta.com/secu
t. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://trust.okta.com/security-advisories/okta-advanced-server-access-client-cve-2023-0093/
CVE ID: CVE-2023-0094 State: PUBLISHED Published: 2024-01-16T15:55:46.407Z Last Updated: 2024-09-17T19:27:50.484Z Vendors: Unknown Products: UpQode Google Maps Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The UpQode Google Maps WordPress plugin through 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1453471f-164d-4487-a736-8cea086212fe/
CVE ID: CVE-2023-0095 State: PUBLISHED Published: 2023-02-06T19:59:23.089Z Last Updated: 2025-03-25T18:11:40.305Z Vendors: Unknown Products: Page View Count Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/009ca72e-e8fa-4fdc-ab2d-4210f8f4710f
CVE ID: CVE-2023-0096 State: PUBLISHED Published: 2023-02-06T19:59:39.682Z Last Updated: 2025-03-25T18:05:04.183Z Vendors: Unknown Products: Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerabili