Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/08640d56-fc76-4062-ab08-19415ad77e5e?source=cve - https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/countdown/widgets/countdown.php#L871 - https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/countdown/widgets/countdown.php#L868 - https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/countdown/widgets/countdown.php#L864 - https://plugins.trac.wordpress.org/browser/ea
elementor-addons/tags/2.2.8/modules/countdown/widgets/countdown.php#L864 - https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/image-comparison/widgets/image-comparison.php#L376 - https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/image-comparison/widgets/image-comparison.php#L377
CVE ID: CVE-2025-9046 State: PUBLISHED Published: 2025-08-15T11:02:07.032Z Last Updated: 2025-08-15T13:18:35.050Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC20 Problem Types: CWE-121, CWE-119 Description: A vulnerability was identified in Tenda AC20 16.03.08.12. This issue affects the function sub_46A2AC of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320267 - https://vuldb.com/?ctiid.32
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320267 - https://vuldb.com/?ctiid.320267 - https://vuldb.com/?submit.631932 - https://github.com/ZZ2266/.github.io/blob/main/AC20/formSetMacFilterCfg/readme.md - https://github.com/ZZ2266/.github.io/blob/main/AC20/formSetMacFilterCfg/readme.md#poc-python-exploit-script - https://www.tenda.com.cn/
CVE ID: CVE-2025-9047 State: PUBLISHED Published: 2025-08-15T11:02:08.849Z Last Updated: 2025-08-15T13:08:29.362Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Visitor Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in projectworlds Visitor Management System 1.0. Affected is an unknown function of the file /visitor_out.php. The manipulation of the argument rid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320268 - https://
nd may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320268 - https://vuldb.com/?ctiid.320268 - https://vuldb.com/?submit.631994 - https://github.com/guoma-book/CVE/issues/2
CVE ID: CVE-2025-9048 State: PUBLISHED Published: 2025-08-23T04:25:46.658Z Last Updated: 2025-08-25T17:31:11.349Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: wptobe Products: Wptobe-memberships Problem Types: CWE-73 Description: The Wptobe-memberships plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the del_img_ajax_call() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-confi
ary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/466568c5-33a9-4891-b4ad-9bc6052603cb?source=cve - https://plugins.trac.wordpress.org/browser/wptobe-memberships/trunk/bwlms-fields/bwlms-fields.php#L156 - https://plugins.svn.wordpress.org/wptobe-memberships/trunk/bwlms-fields/bwlms-fields.php
CVE ID: CVE-2025-9050 State: PUBLISHED Published: 2025-08-15T11:32:05.846Z Last Updated: 2025-08-15T13:04:40.025Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Travel Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in projectworlds Travel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /addcategory.php. The manipulation of the argument t1 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320269
e public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320269 - https://vuldb.com/?ctiid.320269 - https://vuldb.com/?submit.632004 - https://github.com/guoma-book/CVE/issues/6
CVE ID: CVE-2025-9051 State: PUBLISHED Published: 2025-08-15T12:02:05.231Z Last Updated: 2025-08-15T13:32:59.361Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Travel Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in projectworlds Travel Management System 1.0. Affected by this issue is some unknown functionality of the file /updatecategory.php. The manipulation of the argument t1 leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.32027
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320270 - https://vuldb.com/?ctiid.320270 - https://vuldb.com/?submit.632021 - https://github.com/guoma-book/CVE/issues/7
CVE ID: CVE-2025-9052 State: PUBLISHED Published: 2025-08-15T12:32:05.863Z Last Updated: 2025-08-15T13:01:13.281Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Travel Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in projectworlds Travel Management System 1.0. This affects an unknown part of the file /updatepackage.php. The manipulation of the argument s1 leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320271 - https://vu
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320271 - https://vuldb.com/?ctiid.320271 - https://vuldb.com/?submit.632022 - https://github.com/guoma-book/CVE/issues/8
CVE ID: CVE-2025-9053 State: PUBLISHED Published: 2025-08-15T13:02:06.618Z Last Updated: 2025-08-15T14:08:29.361Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Travel Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in projectworlds Travel Management System 1.0. This vulnerability affects unknown code of the file /updatesubcategory.php. The manipulation of the argument t1/s1 leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320272 - ht
blic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320272 - https://vuldb.com/?ctiid.320272 - https://vuldb.com/?submit.632023 - https://vuldb.com/?submit.632024 - https://github.com/guoma-book/CVE/issues/9
CVE ID: CVE-2025-9054 State: PUBLISHED Published: 2025-09-24T11:18:32.303Z Last Updated: 2025-09-24T13:01:40.050Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Techspawn Products: MultiLoca - WooCommerce Multi Locations Inventory Management Problem Types: CWE-862 Description: The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'wcmlim_settings_ajax_handler' function in all versions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to update arbitrary options on
rsions up to, and including, 4.2.8. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6a04e6ad-9365-4cb5-a0a0-82e047647d6b?source=cve - https://codecanyon.net/item/woocommerce-multi-locations-inventory-management/28949586#item-description__changelog
CVE ID: CVE-2025-9055 State: PUBLISHED Published: 2025-11-11T07:31:00.808Z Last Updated: 2025-11-12T04:57:48.836Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Axis Communications AB Products: AXIS OS Problem Types: CWE-250 Description: The VAPIX Edge storage API that allowed a privilege escalation, enabling a VAPIX administrator-privileged user to gain Linux Root privileges. This flaw can only be exploited after authenticating with an administrator-privileged service account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/23/a3/00/cve-2025-9055pdf-en-US-504219.pdf
CVE ID: CVE-2025-9057 State: PUBLISHED Published: 2025-09-05T18:23:33.783Z Last Updated: 2025-09-05T18:41:00.237Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Mikado Themes Products: Biagiotti Core Problem Types: CWE-79 Description: The Biagiotti Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Addi
e permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c4e1ce97-c390-4b87-b68d-bbce93d4665f?source=cve - https://themeforest.net/item/biagiotti-beauty-and-cosmetics-shop/24645919
CVE ID: CVE-2025-9058 State: PUBLISHED Published: 2025-09-09T05:25:43.453Z Last Updated: 2025-09-09T19:25:49.859Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Mikado Themes Products: Mikado Core Problem Types: CWE-79 Description: The Mikado Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional
issions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cba546d8-df3e-4ada-9cf9-663baf175dd0?source=cve - https://themeforest.net/user/mikado-themes/portfolio
CVE ID: CVE-2025-9059 State: PUBLISHED Published: 2025-09-11T05:18:13.597Z Last Updated: 2025-09-11T14:42:19.656Z Vendors: Broadcom Products: 8.6.IT Management Suite Problem Types: CWE-427, CWE-269 Description: The Altiris Core Agent Updater package (AeXNSC.exe) is prone to an elevation of privileges vulnerability through DLL hijacking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36132
CVE ID: CVE-2025-9060 State: PUBLISHED Published: 2025-08-15T16:25:21.405Z Last Updated: 2025-08-15T17:51:51.859Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: MSoft Products: MFlash Problem Types: CWE-20 Description: A vulnerability has been found in the MSoft MFlash application that allows execution of arbitrary code on the server. The issue occurs in the integration configuration functionality that is only available to MFlash administrators. The vulnerability is related to insufficient validation of parameters when setting up security components. This issue affects MFlash v. 8.0 and possibly others. To mitigate apply 8.2-653 hotfix 11.06.2025 and abov
y components. This issue affects MFlash v. 8.0 and possibly others. To mitigate apply 8.2-653 hotfix 11.06.2025 and above. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/klsecservices/Advisories/blob/master/K-MSoft-2025-002.md
CVE ID: CVE-2025-9061 State: PUBLISHED Published: 2025-09-09T05:25:42.900Z Last Updated: 2025-09-09T19:25:13.958Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Mikado Themes Products: Wilmer Core Problem Types: CWE-79 Description: The Wilmer Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional
issions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/53d65d4c-4bd6-4e18-b7ba-ee64328faf32?source=cve - https://themeforest.net/item/wilmr-construction-wordpress-theme/23695848
CVE ID: CVE-2025-9063 State: PUBLISHED Published: 2025-10-14T12:20:39.318Z Last Updated: 2025-10-14T18:45:57.209Z Vendors: Rockwell Automation Products: PanelView Plus 7 Performance Series B Problem Types: CWE-287 Description: An authentication bypass security issue exists within FactoryTalk View Machine Edition Web Browser ActiveX control. Exploitation of this vulnerability allows unauthorized access to the PanelView Plus 7 Series B, including access to the file system, retrieval of diagnostic information, event logs, and more. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1753.html
CVE ID: CVE-2025-9064 State: PUBLISHED Published: 2025-10-14T12:22:36.551Z Last Updated: 2025-10-14T18:46:34.339Z Vendors: Rockwell Automation Products: FactoryTalk View Machine Edition Problem Types: CWE-287 Description: A path traversal security issue exists within FactoryTalk View Machine Edition, allowing unauthenticated attackers on the same network as the device to delete any file within the panels operating system. Exploitation of this vulnerability is dependent on the knowledge of filenames to be deleted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1753.html
CVE ID: CVE-2025-9065 State: PUBLISHED Published: 2025-09-09T12:51:42.091Z Last Updated: 2025-09-09T13:23:24.291Z Vendors: Rockwell Automation Products: ThinManager Problem Types: CWE-610 Description: A server-side request forgery security issue exists within Rockwell Automation ThinManager® software due to the lack of input sanitization. Authenticated attackers can exploit this vulnerability by specifying external SMB paths, exposing the ThinServer® service account NTLM hash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1743.html
CVE ID: CVE-2025-9066 State: PUBLISHED Published: 2025-10-14T12:15:04.242Z Last Updated: 2025-10-14T18:44:50.355Z Vendors: Rockwell Automation Products: FactoryTalk ViewPoint Problem Types: CWE-20 Description: A security issue was discovered within FactoryTalk® ViewPoint, allowing unauthenticated attackers to achieve XXE. Certain SOAP requests can be abused to perform XXE, resulting in a temporary denial-of-service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1752html
CVE ID: CVE-2025-9067 State: PUBLISHED Published: 2025-10-14T12:24:45.641Z Last Updated: 2025-10-14T18:50:28.594Z Vendors: Rockwell Automation Products: FactoryTalk Linx Problem Types: CWE-269 Description: A security issue exists within the x86 Microsoft Installer File (MSI), installed with FTLinx. Authenticated attackers with valid Windows user credentials can initiate a repair and hijack the resulting console window. This allows the launching of a command prompt running with SYSTEM-level privileges, allowing full access to all files, processes, and system resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/securi
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1754.html
CVE ID: CVE-2025-9068 State: PUBLISHED Published: 2025-10-14T12:23:45.550Z Last Updated: 2025-10-14T18:49:27.564Z Vendors: Rockwell Automation Products: FactoryTalk Linx Problem Types: CWE-269 Description: A security issue exists within the Rockwell Automation Driver Package x64 Microsoft Installer File (MSI) repair functionality, installed with FTLinx. Authenticated attackers with valid Windows Users credentials can initiate a repair and hijack the resulting console window for vbpinstall.exe. This allows the launching of a command prompt running with SYSTEM-level privileges, allowing full access to all files, processes, and system resources. Additional Analyst Notes: - CISA ADP Vulnrichment
s, allowing full access to all files, processes, and system resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1754.html
CVE ID: CVE-2025-9071 State: PUBLISHED Published: 2025-08-29T09:19:59.959Z Last Updated: 2025-08-29T13:45:42.363Z Vendors: Oberon microsystems AG Products: Oberon PSA Crypto Problem Types: CWE-780 Description: Erroneously using an all-zero seed for RSA-OEAP padding instead of the generated random bytes, in Oberon microsystems AG’s Oberon PSA Crypto library in all versions up to 1.5.1, results in deterministic RSA and thus in a loss of confidentiality for guessable messages, recognition of repeated messages, and loss of security proofs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oberon.ch/security-advisories/cve-2025-9071/
CVE ID: CVE-2025-9072 State: PUBLISHED Published: 2025-09-15T10:28:17.356Z Last Updated: 2025-09-15T12:06:57.518Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-601 Description: Mattermost versions 10.10.x <= 10.10.1, 10.5.x <= 10.5.9, 10.9.x <= 10.9.4 fail to validate the redirect_to parameter, allowing an attacker to craft a malicious link that, once a user authenticates with their SAML provider, could post the user’s cookies to an attacker-controlled URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-9073 State: PUBLISHED Published: 2025-09-11T07:24:53.628Z Last Updated: 2025-09-11T14:40:08.338Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: maheshmthorat Products: All in one Minifier Problem Types: CWE-89 Description: The All in one Minifier plugin for WordPress is vulnerable to SQL Injection via the 'post_id' parameter in all versions up to, and including, 3.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive infor
ted attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5385ffa7-045b-4ed8-b1d1-eed8924eeb9b?source=cve - https://plugins.trac.wordpress.org/browser/all-in-one-minifier/trunk/admin/admin-ajax.php
CVE ID: CVE-2025-9074 State: PUBLISHED Published: 2025-08-20T13:28:35.553Z Last Updated: 2025-09-25T16:43:01.881Z Vendors: Docker Products: Docker Desktop Problem Types: CWE-668 Description: A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker Engine API via the configured Docker subnet, at 192.168.65.7:2375 by default. This vulnerability occurs with or without Enhanced Container Isolation (ECI) enabled, and with or without the "Expose daemon on tcp://localhost:2375 without TLS" option enabled. This can lead to execution of a wide range of privileged commands to the engine API, including controlling other containers, creating new on
cution of a wide range of privileged commands to the engine API, including controlling other containers, creating new ones, managing images etc. In some circumstances (e.g. Docker Desktop for Windows with WSL backend) it also allows mounting the host drive with the same privileges as the user running Docker Desktop. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.docker.com/desktop/release-notes/#4443
CVE ID: CVE-2025-9075 State: PUBLISHED Published: 2025-10-01T03:25:23.865Z Last Updated: 2025-10-01T13:19:35.263Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bdthemes Products: ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns Problem Types: CWE-79 Description: The ZoloBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Gutenberg blocks in versions up to, and including, 2.3.10. This is due to insufficient input sanitization and output escaping on user-supplied attributes within multiple block components including Google Maps markers, Lightbox captions, Image Gallery da
-supplied attributes within multiple block components including Google Maps markers, Lightbox captions, Image Gallery data attributes, Progress Pie prefix/suffix fields, and Text Path URL fields. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5860d456-a992-4816-8c93-7311c33734e4?source=cve - https://plugins.trac.wordpress.org/browser/zoloblocks/tags/2.3.3/build/blocks/google-map/frontend.js#L1 - https://plugins.trac.wordpress