Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11384 State: PUBLISHED Published: 2024-12-12T04:23:12.332Z Last Updated: 2024-12-12T14:58:25.899Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: arenaim Products: Arena.IM – Live Blogging for real-time events Problem Types: CWE-79 Description: The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'arenablog' shortcode in all versions up to, and including, 0.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web
s. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6bf534ba-1288-4fa5-bdfb-de62e751e5c2?source=cve - https://plugins.trac.wordpress.org/browser/arena-liveblog-and-chat-tool/trunk/shortcode/init.php#L73
CVE ID: CVE-2024-11385 State: PUBLISHED Published: 2024-11-21T02:06:44.368Z Last Updated: 2024-11-21T11:40:09.837Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: safi-mohammad Products: Pure CSS Circle Progress bar Problem Types: CWE-79 Description: The Pure CSS Circle Progress bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'circle_progress' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wi
e for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c098c975-3a9b-4b6c-81e7-c66ca9e3d09c?source=cve - https://plugins.trac.wordpress.org/browser/pure-css-circle-progress-bar/trunk/pure-css-circle-progress-bar.php#L19
CVE ID: CVE-2024-11386 State: PUBLISHED Published: 2025-01-11T07:21:54.598Z Last Updated: 2025-01-13T17:07:09.293Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wow-analytics Products: GatorMail SmartForms Problem Types: CWE-79 Description: The GatorMail SmartForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gatormailsmartform' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute
nticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c96e5939-5b6d-4cf2-83eb-a7b94f032bcb?source=cve - https://wordpress.org/plugins/gatormail-smart-forms/
CVE ID: CVE-2024-11387 State: PUBLISHED Published: 2024-11-23T04:32:20.651Z Last Updated: 2024-11-23T13:18:23.186Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jeffreyvr Products: Easy Liveblogs Problem Types: CWE-79 Description: The Easy Liveblogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elb_liveblog' shortcode in all versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user access
th contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8e721128-2e34-4717-8945-5fd25f2efd7d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3193445%40easy-liveblogs&new=3193445%40easy-liveblogs&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11388 State: PUBLISHED Published: 2024-11-21T02:06:41.518Z Last Updated: 2024-11-21T11:40:10.035Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: tahmidulkarim Products: Dino Game – Embed Google Chrome Dinosaur Game in WordPress Problem Types: CWE-79 Description: The Dino Game – Embed Google Chrome Dinosaur Game in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dino-game' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and
aping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b1acc5f8-bd77-42e0-96d5-636039a533a1?source=cve - https://plugins.trac.wordpress.org/browser/dino-game/trunk/dino-game.php#L41
CVE ID: CVE-2024-11389 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:35.498Z Description: No description available.
CVE ID: CVE-2024-11390 State: PUBLISHED Published: 2025-05-01T13:11:14.142Z Last Updated: 2025-05-01T13:26:43.673Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Elastic Products: Kibana Problem Types: CWE-434 Description: Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.elastic.co/t/kibana-7-17-24-and-8-12-0-security-update-esa-2024-20/377712
CVE ID: CVE-2024-11391 State: PUBLISHED Published: 2024-12-03T14:34:29.866Z Last Updated: 2024-12-03T15:56:04.491Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: modalweb Products: Advanced File Manager Problem Types: CWE-434 Description: The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'class_fma_connector.php' file in all versions up to, and including, 5.2.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to upload arbitrary files on the affected site's server which may make remote code
ted permissions by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f14a658c-1517-4af4-8bd7-c379ac07ab35?source=cve - https://plugins.trac.wordpress.org/changeset/3199242/
CVE ID: CVE-2024-11392 State: PUBLISHED Published: 2024-11-22T21:23:27.024Z Last Updated: 2024-11-26T16:35:26.561Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Hugging Face Products: Transformers Problem Types: CWE-502 Description: Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of configuration files
ust visit a malicious page or open a malicious file. The specific flaw exists within the handling of configuration files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-24322. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1513/
CVE ID: CVE-2024-11393 State: PUBLISHED Published: 2024-11-22T21:23:38.476Z Last Updated: 2024-12-04T21:13:39.209Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Hugging Face Products: Transformers Problem Types: CWE-502 Description: Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of model files. Th
get must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25191. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1514/
CVE ID: CVE-2024-11394 State: PUBLISHED Published: 2024-11-22T21:23:49.302Z Last Updated: 2024-12-04T21:13:16.550Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Hugging Face Products: Transformers Problem Types: CWE-502 Description: Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of model files. The iss
st visit a malicious page or open a malicious file. The specific flaw exists within the handling of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-25012. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1515/
CVE ID: CVE-2024-11395 State: PUBLISHED Published: 2024-11-19T19:11:34.281Z Last Updated: 2024-11-21T04:55:14.001Z Vendors: Google Products: Chrome Problem Types: CWE-843 Description: Type Confusion in V8 in Google Chrome prior to 131.0.6778.85 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_19.html - https://issues.chromium.org/issues/377384894
CVE ID: CVE-2024-11396 State: PUBLISHED Published: 2025-01-13T23:21:40.170Z Last Updated: 2025-01-14T00:16:38.672Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: awordpresslife Products: Event Monster – Event Management, Tickets Booking, Upcoming Event Problem Types: CWE-359 Description: The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file is created in the wp-content folder with a hardcoded filename that is publicly accessible. This makes it possible for unauthenticated atta
wp-content folder with a hardcoded filename that is publicly accessible. This makes it possible for unauthenticated attackers to extract data about event visitors, that includes first and last names, email, and phone number. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0f522dfe-f2c2-4adb-980c-1f03d3c26e12?source=cve - https://plugins.trac.wordpress.org/browser/event-monster/tags/1.4.3/em-ajax-prossesing/em-visitor-ajax.php#L92
CVE ID: CVE-2024-11397 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:12.117Z Description: No description available.
CVE ID: CVE-2024-11398 State: PUBLISHED Published: 2024-12-04T06:59:56.673Z Last Updated: 2024-12-04T14:09:11.756Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Synology Products: Synology Router Manager (SRM) Problem Types: CWE-22 Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in OTP reset functionality in Synology Router Manager (SRM) before 1.3.1-9346-9 allows remote authenticated users to delete arbitrary files via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_03
CVE ID: CVE-2024-11400 State: PUBLISHED Published: 2024-11-19T21:31:51.545Z Last Updated: 2024-11-20T14:16:09.906Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: realmag777 Products: HUSKY – Products Filter Professional for WooCommerce Problem Types: CWE-79 Description: The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the really_curr_tax parameter in all versions up to, and including, 1.3.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfu
es it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f3158e77-39b3-4151-8f10-5824000a585a?source=cve - https://plugins.trac.wordpress.org/changeset/3186438/
CVE ID: CVE-2024-11401 State: PUBLISHED Published: 2024-12-11T09:46:29.398Z Last Updated: 2024-12-11T15:08:28.354Z Vendors: Rapid7 Products: Insight Platform Problem Types: CWE-862 Description: Rapid7 Insight Platform versions prior to November 13th 2024, suffer from a privilege escalation vulnerability whereby, due to a lack of authorization checks, an attacker can successfully update the password policy in the platform settings as a standard user by crafting an API (the functionality was not possible through the platform's User Interface). This vulnerability has been fixed as of November 13th 2024. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/
d as of November 13th 2024. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/862.html
CVE ID: CVE-2024-11402 State: PUBLISHED Published: 2024-11-28T11:00:31.017Z Last Updated: 2024-11-28T12:15:16.256Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: WP-speedup Products: Block Editor Bootstrap Blocks Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP-speedup Block Editor Bootstrap Blocks allows Reflected XSS.This issue affects Block Editor Bootstrap Blocks: from n/a through 6.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/block-editor-bootstrap-blocks/vulnerability/wordpress-block-editor-
: - https://patchstack.com/database/wordpress/plugin/block-editor-bootstrap-blocks/vulnerability/wordpress-block-editor-bootstrap-blocks-plugin-6-6-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-11403 State: PUBLISHED Published: 2024-11-25T13:08:38.280Z Last Updated: 2024-11-25T13:54:29.806Z Vendors: libjxl Products: libjxl Problem Types: CWE-787, CWE-125 Description: There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger stru
ed as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/libjxl/libjxl/commit/9cc451b91b74ba470fd72bd48c121e9f33d24c99
CVE ID: CVE-2024-11404 State: PUBLISHED Published: 2024-11-20T11:55:25.444Z Last Updated: 2025-10-14T12:35:09.027Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: django CMS Association Products: django Filer Problem Types: CWE-434, CWE-80 Description: Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS.This issue affects django Filer: from 3 before 3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1864 - https://www.django-cms.org/
Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1864 - https://www.django-cms.org/en/blog/2024/11/19/security-updates-for-django-filer-and-django-cms-attributes-field/ - https://iltosec.com/blog/post/cve-2024-11404-medium-severity-file-upload-vulnerabilities-in-django-filer-323/ - https://pypi.org/project/django-filer/
CVE ID: CVE-2024-11405 State: PUBLISHED Published: 2025-07-02T03:47:26.444Z Last Updated: 2025-07-02T13:17:33.791Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: hellomohsinkhan Products: WP Front-end login and register Problem Types: CWE-79 Description: The WP Front-end login and register plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the email and wpmp_reset_password_token parameters in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user i
unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e54c1a85-13f6-48c0-9db8-860b4b1f3e45?source=cve - https://plugins.trac.wordpress.org/browser/wp-front-end-login-and-register/trunk/public/partials/wpmp-resetpassword-form.php#L58
CVE ID: CVE-2024-11406 State: PUBLISHED Published: 2024-11-20T12:00:26.845Z Last Updated: 2024-11-20T14:56:21.490Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N) Vendors: django CMS Association Products: django CMS Attributes Fields Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django CMS Attributes Fields allows Stored XSS.This issue affects django CMS Attributes Fields: before 4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1864 - https://www.django-cms.org/en/blog/2024/11/19/security-
ent: References: - https://www.usom.gov.tr/bildirim/tr-24-1864 - https://www.django-cms.org/en/blog/2024/11/19/security-updates-for-django-filer-and-django-cms-attributes-field/ - https://iltosec.com/blog/post/djangocms-attributes-field-300-stored-xss-vulnerability/ - https://github.com/django-cms/djangocms-attributes-field/commit/fe68d29ab78db5885bc31b67cf0537f1f02b33ad - https://pypi.org/project/djangocms-attributes-field/#history
CVE ID: CVE-2024-11407 State: PUBLISHED Published: 2024-11-26T16:59:49.718Z Last Updated: 2024-11-26T21:04:58.031Z Vendors: grpc Products: gRPC-C++ Problem Types: CWE-682 Description: There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the receiver to receive an incorrect set of bytes causing RPC requests to fail. We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791 Additional Analyst Notes: - CISA ADP Vulnric
We recommend upgrading past commit e9046b2bbebc0cb7f5dc42008f807f6c7e98e791 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/grpc/grpc/commit/e9046b2bbebc0cb7f5dc42008f807f6c7e98e791
CVE ID: CVE-2024-11408 State: PUBLISHED Published: 2024-11-23T04:32:20.115Z Last Updated: 2024-11-23T13:18:23.341Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: teonos Products: Slotti Ajanvaraus Problem Types: CWE-79 Description: The Slotti Ajanvaraus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slotti' shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/83f7d9b9-793e-4380-b971-bc13c77a06a8?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3194196%40slotti-ajanvaraus&new=3194196%40slotti-ajanvaraus&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11409 State: PUBLISHED Published: 2024-11-21T02:06:40.252Z Last Updated: 2024-11-21T14:52:58.008Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: priyajain2802 Products: Grid View Gallery Problem Types: CWE-502 Description: The Grid View Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0 via deserialization of untrusted input from cs_all_photos_details parameter. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or the