Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-4376 State: PUBLISHED Published: 2024-05-31T05:31:57.913Z Last Updated: 2024-08-01T20:40:46.506Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: leap13 Products: Premium Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Fancy Text widget in all versions up to, and including, 4.10.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-l
and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. While 4.10.32 is patched, it is recommended to update to 4.10.33 because 4.10.32 caused a fatal error. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b49d166f-4df0-4997-a078-0be8fcd92576?source=cve - https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/widgets/premium-fancytext.php#L924 - https://plugins.trac.wordpress.org/brow
/browser/premium-addons-for-elementor/trunk/widgets/premium-fancytext.php#L924 - https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/assets/frontend/js/typed.js - https://plugins.trac.wordpress.org/changeset/3090037/premium-addons-for-elementor/trunk/widgets/premium-fancytext.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3090609%40premium-addons-for-elementor&new=3090609%40premium-addons-for-elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2024-4377 State: PUBLISHED Published: 2024-06-21T06:00:03.210Z Last Updated: 2024-10-27T21:50:50.807Z Vendors: Unknown Products: DOP Shortcodes Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The DOP Shortcodes WordPress plugin through 1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/778cebec-bdbb-4538-9518-c5bd50f76961/
CVE ID: CVE-2024-4378 State: PUBLISHED Published: 2024-05-23T11:02:39.369Z Last Updated: 2024-08-01T20:40:47.228Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: leap13 Products: Premium Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's menu and shape widgets in all versions up to, and including, 4.10.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contribu
ation and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f891a6c8-3d06-432e-8651-bb689015af1c?source=cve - https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/includes/pa-nav-menu-walker.php#L394 - https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/modules/premium-shape-divider/module.php#L1047 - https://
.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/modules/premium-shape-divider/module.php#L1047 - https://plugins.trac.wordpress.org/changeset/3090037
CVE ID: CVE-2024-4379 State: PUBLISHED Published: 2024-05-31T05:31:58.375Z Last Updated: 2024-08-01T20:40:47.164Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: leap13 Products: Premium Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Global Tooltip widget in all versions up to, and including, 4.10.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contribut
tion and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cb0261c6-0477-4769-b92a-b49a192df4bb?source=cve - https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/tags/4.10.31/modules/premium-global-tooltips/module.php#L1247 - https://plugins.trac.wordpress.org/changeset/3090037/premium-addons-for-elementor/trunk/modules/premium-global-toolti
- https://plugins.trac.wordpress.org/changeset/3090037/premium-addons-for-elementor/trunk/modules/premium-global-tooltips/module.php
CVE ID: CVE-2024-4381 State: PUBLISHED Published: 2024-06-21T06:00:03.795Z Last Updated: 2025-03-13T18:08:54.770Z Vendors: Unknown Products: CB (legacy) Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The CB (legacy) WordPress plugin through 0.9.4.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/9b3cda9a-17a7-4173-93a2-d552a874fae9/
CVE ID: CVE-2024-4382 State: PUBLISHED Published: 2024-06-21T06:00:04.138Z Last Updated: 2025-03-26T16:38:03.855Z Vendors: Unknown Products: CB (legacy) Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The CB (legacy) WordPress plugin through 0.9.4.18 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting codes, timeframes, and bookings via CSRF attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/1a67aeab-8145-4c8a-9c18-e6436fa39b63/
CVE ID: CVE-2024-4383 State: PUBLISHED Published: 2024-05-09T20:03:26.695Z Last Updated: 2024-08-01T20:40:47.103Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mra13 Products: Simple Membership Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swpm_paypal_subscription_cancel_link' shortcode in all versions up to, and including, 4.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contrib
zation and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/56fdbf80-8ea2-412a-b166-b7c27de88e70?source=cve - https://plugins.trac.wordpress.org/browser/simple-membership/tags/4.4.3/classes/shortcode-related/class.swpm-shortcodes-handler.php#L228 - https://plugins.trac.wordpress.org/changeset/3081024/simple-membership/trunk/classes/shortcode-related/class.swp
#L228 - https://plugins.trac.wordpress.org/changeset/3081024/simple-membership/trunk/classes/shortcode-related/class.swpm-shortcodes-handler.php?old=3010737&old_path=%2Fsimple-membership%2Ftrunk%2Fclasses%2Fshortcode-related%2Fclass.swpm-shortcodes-handler.php
CVE ID: CVE-2024-4384 State: PUBLISHED Published: 2024-06-21T06:00:04.371Z Last Updated: 2024-08-01T20:40:46.484Z Vendors: Unknown Products: CSSable Countdown Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The CSSable Countdown WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/ad714196-2590-4dc9-b5b9-50808e9e0d26/
CVE ID: CVE-2024-4385 State: PUBLISHED Published: 2024-05-16T11:05:28.188Z Last Updated: 2024-08-01T20:40:47.207Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: envothemes Products: Envo Extra Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 1.8.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that wi
authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/83d78ff7-bd59-431e-b579-156e23ede053?source=cve - https://plugins.trac.wordpress.org/browser/envo-extra/trunk/lib/elementor/widgets/counter/counter.php#L754 - https://plugins.trac.wordpress.org/browser/envo-extra/trunk/lib/elementor/widgets/button/button.php#L679 - https://plugins.trac.wordpress.org/browser/envo-extra/trunk/lib/elementor/widgets/icon-box/icon-box.php#L909 - h
#L679 - https://plugins.trac.wordpress.org/browser/envo-extra/trunk/lib/elementor/widgets/icon-box/icon-box.php#L909 - https://plugins.trac.wordpress.org/browser/envo-extra/trunk/lib/elementor/widgets/team/team.php#L1189 - https://plugins.trac.wordpress.org/browser/envo-extra/trunk/lib/elementor/widgets/testimonial/testimonial.php#L899 - https://plugins.trac.wordpress.org/changeset/3080715/
CVE ID: CVE-2024-4386 State: PUBLISHED Published: 2024-05-09T20:03:23.835Z Last Updated: 2024-08-01T20:40:47.218Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: tigroumeow Products: Gallery Block (Meow Gallery) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Gallery Block (Meow Gallery) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data_atts’ parameter in versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inje
tput escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/477b41a5-b2ff-4b94-9622-824146a0e2ed?source=cve - https://plugins.trac.wordpress.org/browser/meow-gallery/trunk/classes/core.php#L273 - https://plugins.trac.wordpress.org/changeset/3082976/
CVE ID: CVE-2024-4387 State: REJECTED Published: N/A Last Updated: 2024-06-11T09:43:22.209Z Description: No description available.
CVE ID: CVE-2024-4388 State: PUBLISHED Published: 2024-05-23T06:00:03.466Z Last Updated: 2024-08-01T20:40:47.248Z Vendors: Unknown Products: cas Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: This does not validate a path generated with user input when downloading files, allowing unauthenticated user to download arbitrary files from the server Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/5c791747-f60a-40a7-94fd-e4b9bb5ea2b0/
CVE ID: CVE-2024-4389 State: PUBLISHED Published: 2024-08-14T08:29:44.236Z Last Updated: 2024-08-14T13:24:49.540Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: averta Products: Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel Problem Types: CWE-434 Description: The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadFile function in all versions up to, and including, 3.1.1. This makes it possible for authenticated attackers, with contributor access or higher, to upload arbit
including, 3.1.1. This makes it possible for authenticated attackers, with contributor access or higher, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/81f025da-c28c-4a80-8b4f-27dae07b2b04?source=cve - https://plugins.trac.wordpress.org/browser/depicter/trunk/app/src/WordPress/FileUploaderService.php#L28 - https://plugins.trac.wordpress.org/changeset/3108589/depicter/trunk/app/src/WordPress/FileUploaderService.php
CVE ID: CVE-2024-4390 State: PUBLISHED Published: 2024-06-20T03:37:22.655Z Last Updated: 2024-08-01T20:40:47.063Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: averta Products: Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel Problem Types: CWE-863 Incorrect Authorization Description: The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to Arbitrary Nonce Generation in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers with contributor access and above, to generate a valid nonce for any WordPress actio
ossible for authenticated attackers with contributor access and above, to generate a valid nonce for any WordPress action/function. This could be used to invoke functionality that is protected only by nonce checks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dd7c3a5d-b8aa-45cb-983c-55ba7e3d72f3?source=cve - https://plugins.trac.wordpress.org/browser/depicter/trunk/app/src/Controllers/Ajax/SecurityAjaxController.php#L14 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3103357%40depicter%2Ftrunk&old=3090538%40depicter%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-4391 State: PUBLISHED Published: 2024-05-16T08:32:50.995Z Last Updated: 2024-08-01T20:40:47.122Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: thehappymonster Products: Happy Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Event Calendar widget in all versions up to, and including, 3.10.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contr
tization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e75f7e1a-f3bb-4b24-bf04-b83d0e572551?source=cve - https://plugins.trac.wordpress.org/browser/happy-elementor-addons/trunk/widgets/event-calendar/widget.php#L1811 - https://plugins.trac.wordpress.org/changeset/3083138/happy-elementor-addons/trunk/widgets/event-calendar/widget.php
CVE ID: CVE-2024-4392 State: PUBLISHED Published: 2024-05-14T08:32:31.906Z Last Updated: 2024-08-01T20:40:47.361Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: automattic Products: Jetpack – WP Security, Backup, Speed, & Growth Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpvideo shortcode in all versions up to, and including, 13.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for auth
due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/11dceac7-7ff8-4384-9046-919c38947c32?source=cve - https://plugins.trac.wordpress.org/browser/jetpack/tags/13.3.1/modules/videopress/class.videopress-player.php#L335
CVE ID: CVE-2024-4393 State: PUBLISHED Published: 2024-05-08T03:02:42.014Z Last Updated: 2024-08-01T20:40:47.142Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: thenbrent Products: Social Connect Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2. This is due to insufficient verification on the OpenID server being supplied during the social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have
ossible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2882d9dd-0c73-4c9a-99cb-d10900503103?source=cve - https://plugins.trac.wordpress.org/browser/social-connect/tags/1.2/openid/openid.php#L575
CVE ID: CVE-2024-4395 State: PUBLISHED Published: 2024-06-27T21:28:35.198Z Last Updated: 2024-08-01T20:40:47.140Z Vendors: JAMF Products: Jamf Compliance Editor Description: The XPC service within the audit functionality of Jamf Compliance Editor before version 1.3.1 on macOS can lead to local privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://khronokernel.com/macos/2024/05/01/CVE-2024-4395.html - https://github.com/Jamf-Concepts/jamf-compliance-editor/raw/v1.3.1/Jamf%20Compliance%20Editor%20-%20User%20Guide.pdf - https://trusted.jamf.com/docs/establishing-compliance-baselines#support - https://github.com/Jamf-Concepts/jamf
de.pdf - https://trusted.jamf.com/docs/establishing-compliance-baselines#support - https://github.com/Jamf-Concepts/jamf-compliance-editor/releases/download/v1.3.1/JamfComplianceEditor.v1.3.1.pkg
CVE ID: CVE-2024-4397 State: PUBLISHED Published: 2024-05-09T20:03:41.532Z Last Updated: 2024-08-01T20:40:47.202Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: thimpress Products: LearnPress – WordPress LMS Plugin Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_post_materials' function in versions up to, and including, 4.2.6.5. This makes it possible for authenticated attackers, with Instructor-level permissions and above, to upload arbitrary files on the affected site's server
nticated attackers, with Instructor-level permissions and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ec20d5c4-4c41-4ec9-8d0a-ec8f03634f7d?source=cve - https://plugins.trac.wordpress.org/browser/learnpress/tags/4.2.6.5/inc/rest-api/v1/frontend/class-lp-rest-material-controller.php#L98 - https://plugins.trac.wordpress.org/changeset/3083657/
CVE ID: CVE-2024-4398 State: PUBLISHED Published: 2024-05-10T07:33:39.311Z Last Updated: 2024-08-01T20:40:47.155Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: abuhayat Products: HTML5 Audio Player- Best WordPress Audio Player Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The HTML5 Audio Player- Best WordPress Audio Player Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.2.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for
2.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ca646202-b9e2-4272-b0e2-d39cd748fb8e?source=cve - https://plugins.trac.wordpress.org/browser/html5-audio-player/trunk/inc/Elementor/Widgets/Simple.php#L237 - https://plugins.trac.wordpress.org/browser/html5-audio-player/trunk/inc/elementor-widgets/fusion-audio-pla
le.php#L237 - https://plugins.trac.wordpress.org/browser/html5-audio-player/trunk/inc/elementor-widgets/fusion-audio-player.php#L275 - https://plugins.trac.wordpress.org/browser/html5-audio-player/trunk/inc/elementor-widgets/stamp-audio-player.php#L286 - https://plugins.trac.wordpress.org/browser/html5-audio-player/trunk/inc/elementor-widgets/playlist.php#L541
CVE ID: CVE-2024-4399 State: PUBLISHED Published: 2024-05-23T06:00:03.650Z Last Updated: 2024-08-01T20:40:47.185Z Vendors: Unknown Products: cas Problem Types: CWE-918 Server-Side Request Forgery (SSRF) Description: The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/0690327e-da60-4d71-8b3c-ac9533d82302/