Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
tization and output escaping on user supplied attributes such as urls. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1e257954-9e44-4939-8e01-efceb3c0953a?source=cve - https://wordpress.org/plugins/ninja-beaver-lite-addons-for-beaver-builder/
CVE ID: CVE-2024-2165 State: PUBLISHED Published: 2024-04-09T18:58:47.412Z Last Updated: 2025-08-27T15:54:56.670Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: rainbowgeek Products: SEOPress – On-site SEO Problem Types: CWE-20 Improper Input Validation Description: The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt parameter in all versions up to, and including, 7.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an in
with author access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/46e66230-06d6-452e-a7aa-862b2bb8c27d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3056025%40wp-seopress%2Ftrunk&old=3047913%40wp-seopress%2Ftrunk&sfp_email=&sfph_mail=#file14
CVE ID: CVE-2024-2166 State: PUBLISHED Published: 2024-09-04T21:37:17.923Z Last Updated: 2024-09-05T14:23:10.788Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Forcepoint Products: Email Security Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Email Security (Real Time Monitor modules) allows Reflected XSS.This issue affects Email Security: before 8.5.5 HF003. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.forcepoint.com/s/article/000042397
CVE ID: CVE-2024-2167 State: REJECTED Published: N/A Last Updated: 2024-03-04T16:29:40.615Z Description: No description available.
CVE ID: CVE-2024-2168 State: PUBLISHED Published: 2024-03-04T21:00:11.431Z Last Updated: 2024-08-01T19:03:39.153Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Tours & Travels Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/operations/expense_category.php of the component HTTP POST Request Handler. The manipulation of the argument status leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
l injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-255678 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.255678 - https://vuldb.com/?ctiid.255678 - https://www.yuque.com/mailemonyeyongjuan/nekc0f/uoobn101h48xv6ih
CVE ID: CVE-2024-2169 State: PUBLISHED Published: 2024-03-19T19:50:10.700Z Last Updated: 2024-09-04T12:04:51.230Z Vendors: MikroTik, Microsoft, dproxy-nexgen Products: RouterOS-TFTP, WDS, dproxy-nexgen Problem Types: CWE-406: Insufficient Control of Network Message Volume (Network Amplification) Description: Implementations of UDP application protocol are vulnerable to network loops. An unauthenticated attacker can use maliciously-crafted packets against a vulnerable implementation that can lead to Denial of Service (DOS) and/or abuse of resources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.cert.org/vuls/id/417980 - https://www.kb.cer
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.cert.org/vuls/id/417980 - https://www.kb.cert.org/vuls/id/417980
CVE ID: CVE-2024-2170 State: PUBLISHED Published: 2024-03-26T04:31:41.322Z Last Updated: 2024-08-01T19:23:24.857Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kurudrive Products: VK All in One Expansion Unit Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the child page index widget in all versions up to, and including, 9.96.0.1 due to insufficient input sanitization and output escaping on user supplied attributes such as 'className.' This makes it possible for authenticated attacker
n and output escaping on user supplied attributes such as 'className.' This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1bc697b3-20f6-46df-a250-f2009a60200e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3058212%40vk-all-in-one-expansion-unit&new=3058212%40vk-all-in-one-expansion-unit&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2171 State: PUBLISHED Published: 2024-06-06T18:22:31.301Z Last Updated: 2024-08-09T18:41:46.790Z Severity: LOW (CVSS 3.4 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N) Vendors: zenml-io Products: zenml-io/zenml Problem Types: CWE-79 Description: A stored Cross-Site Scripting (XSS) vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logo_url' field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users, potentially compromising their accounts. The vulnerability affects version 0.55.3 and was fixed in version 0.56.2. The impact of exploiting this vulnerability could lead to user account compro
on 0.55.3 and was fixed in version 0.56.2. The impact of exploiting this vulnerability could lead to user account compromise. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/cee06a28-7e3b-460b-b504-69add838ebe8 - https://github.com/zenml-io/zenml/commit/68bcb3ba60cba9729c9713a49c39502d40fb945e
CVE ID: CVE-2024-2172 State: PUBLISHED Published: 2024-03-13T15:26:53.433Z Last Updated: 2024-08-01T19:03:39.304Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: cyberlord92 Products: Web Application Firewall – website security, Malware Scanner Problem Types: CWE-304 Missing Critical Step in Authentication Description: The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing capability check on the mo_wpns_init() function in all versions up to, and including, 4.7.2 (for Malware Scanner) and 2.1.1 (for Web Application Firewall). This makes it possible for un
p to, and including, 4.7.2 (for Malware Scanner) and 2.1.1 (for Web Application Firewall). This makes it possible for unauthenticated attackers to escalate their privileges to that of an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6347f588-a3fd-4909-ad57-9d78787b5728?source=cve - https://plugins.trac.wordpress.org/browser/miniorange-malware-protection/tags/4.7.2/handler/login.php#L89 - https://wordpress.org/plugins/miniorange-malware-protection/
CVE ID: CVE-2024-2173 State: PUBLISHED Published: 2024-03-06T18:34:05.763Z Last Updated: 2025-03-21T20:43:37.488Z Vendors: Google Products: Chrome Problem Types: Out of bounds memory access Description: Out of bounds memory access in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/325893559 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedo
https://issues.chromium.org/issues/325893559 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYEGSHTMXIPXD5OW5CXVWQS3ZUBCBSXG/
CVE ID: CVE-2024-2174 State: PUBLISHED Published: 2024-03-06T18:34:06.209Z Last Updated: 2025-02-13T17:33:17.411Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/325866363 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fe
- https://issues.chromium.org/issues/325866363 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYEGSHTMXIPXD5OW5CXVWQS3ZUBCBSXG/
CVE ID: CVE-2024-2175 State: PUBLISHED Published: 2024-08-16T14:17:03.626Z Last Updated: 2024-08-16T15:07:20.684Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Display Control Center, Accessories and Display Manager Problem Types: CWE-276 Description: An insecure permissions vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) that could allow a local attacker to escalate privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-155486
CVE ID: CVE-2024-2176 State: PUBLISHED Published: 2024-03-06T18:34:06.562Z Last Updated: 2025-02-13T17:33:18.658Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in FedCM in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/03/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/325936438 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O
.org/issues/325936438 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYEGSHTMXIPXD5OW5CXVWQS3ZUBCBSXG/
CVE ID: CVE-2024-2177 State: PUBLISHED Published: 2024-07-09T13:30:57.825Z Last Updated: 2024-09-17T16:00:34.552Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-1021 Description: A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow via a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/444467 - https://hackerone.com/reports/23834
gram Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/444467 - https://hackerone.com/reports/2383443
CVE ID: CVE-2024-2178 State: PUBLISHED Published: 2024-06-02T10:52:32.063Z Last Updated: 2024-08-01T19:03:39.289Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-29 Description: A path traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'copy_to_custom_personas' endpoint in the 'lollms_personalities_infos.py' file. This vulnerability allows attackers to read arbitrary files by manipulating the 'category' and 'name' parameters during the 'Copy to custom personas folder for editing' process. By inserting '../' sequences in these parameters, attackers can traverse the dir
m personas folder for editing' process. By inserting '../' sequences in these parameters, attackers can traverse the directory structure and access files outside of the intended directory. Successful exploitation results in unauthorized access to sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/e585f1dd-a026-4419-8f42-5835e85fad9e
CVE ID: CVE-2024-2179 State: PUBLISHED Published: 2024-03-05T21:08:23.317Z Last Updated: 2024-08-30T21:14:28.613Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Concrete CMS Products: Concrete CMS Problem Types: CWE-79 Description: Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group type since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Name field which might be executed when users visit the affected page. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 2.2 with a vector of AV:N/AC:H/PR:H/UI:N/S:U/
he Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 2.2 with a vector of AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N Concrete versions below 9 do not include group types so they are not affected by this vulnerability. Thanks Luca Fuda for reporting. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.concretecms.org/9-x/developers/introduction/version-history/927-release-notes
CVE ID: CVE-2024-2180 State: PUBLISHED Published: 2024-03-15T04:17:57.931Z Last Updated: 2025-04-10T20:29:36.918Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Zemana Products: AntiLogger Problem Types: CWE-404 Description: Zemana AntiLogger v2.74.204.664 is vulnerable to a Memory Information Leak vulnerability by triggering the 0x80002020 IOCTL code of the zam64.sys and zamguard64.sys drivers Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fluidattacks.com/advisories/gomez/ - https://zemana.com/us/antilogger.html
CVE ID: CVE-2024-2181 State: PUBLISHED Published: 2024-04-09T18:58:53.569Z Last Updated: 2024-08-01T19:03:39.005Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpzoom Products: Beaver Builder Addons by WPZOOM Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbi
ut escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6baa44c7-1c13-45ad-9fb5-da06933f3cd0?source=cve - https://plugins.trac.wordpress.org/changeset/3046905/wpzoom-addons-for-beaver-builder
CVE ID: CVE-2024-2182 State: PUBLISHED Published: 2024-03-12T16:18:31.829Z Last Updated: 2025-11-08T07:11:46.026Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Fast Datapath for Red Hat Enterprise Linux 8, Fast Datapath for Red Hat Enterprise Linux 9, Fast Datapath for RHEL 7, Fast Datapath for RHEL 8, Fast Datapath for RHEL 9 Problem Types: CWE-346 Description: A flaw was found in the Open Virtual Network (OVN). In OVN clusters where BFD is used between hypervisors for high availability, an attacker can inject specially crafted BFD packets from inside unprivileged workloads, including virtual machines or containers, that can trigger a de
crafted BFD packets from inside unprivileged workloads, including virtual machines or containers, that can trigger a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:1385 - https://access.redhat.com/errata/RHSA-2024:1386 - https://access.redhat.com/errata/RHSA-2024:1387 - https://access.redhat.com/errata/RHSA-2024:1388 - https://access.redhat.com/errata/RHSA-2024:1390 - https://access.redhat.com/errata/RHSA-2024:1391 - https://access.redhat.com/errata/RHSA-2024:1392 - https://access.redhat.com/errata/RHSA-2024:1393 - https://access.redhat.com/errata/RHSA-2024:1394 - https://access.redhat.c
ps://access.redhat.com/errata/RHSA-2024:1393 - https://access.redhat.com/errata/RHSA-2024:1394 - https://access.redhat.com/errata/RHSA-2024:4035 - https://access.redhat.com/security/cve/CVE-2024-2182 - https://bugzilla.redhat.com/show_bug.cgi?id=2267840 - https://mail.openvswitch.org/pipermail/ovs-announce/2024-March/000346.html - https://www.openwall.com/lists/oss-security/2024/03/12/5
CVE ID: CVE-2024-2183 State: PUBLISHED Published: 2024-04-09T18:59:00.099Z Last Updated: 2024-08-01T19:03:39.049Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpzoom Products: Beaver Builder Addons by WPZOOM Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arb
put escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-30424 is likely a duplicate of this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/781987af-3753-46ec-9d56-fb8b6ef42277?source=cve - https://plugins.trac.wordpress.org/changeset/3046905/wpzoom-addons-for-beaver-builder
CVE ID: CVE-2024-2184 State: PUBLISHED Published: 2024-03-11T00:26:02.346Z Last Updated: 2024-08-28T20:24:54.597Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Canon Inc. Products: Color imageCLASS MF740C Series, Color imageCLASS MF640C Series, i-SENSYS MF740C Series, i-SENSYS MF640C Series, Satera MF740C Series, Satera MF640C Series, Color imageCLASS X MF1127C, C1127i Series, Color imageCLASS LBP664Cdw, Color imageCLASS LBP622Cdw, i-SENSYS LBP660C Series, i-SENSYS LBP620C Series, Satera LBP660C Series, Satera LBP620C Series, Color imageCLASS X LBP1127C, C1127P, Color imageCLASS MF750C Series, i-SENSYS MF750C Series, Satera MF750C Series, Color imageCLAS
eCLASS X LBP1127C, C1127P, Color imageCLASS MF750C Series, i-SENSYS MF750C Series, Satera MF750C Series, Color imageCLASS X MF1333C, C1333i Series, Color imageCLASS LBP674Cdw, i-SENSYS LBP673Cdw, Satera LBP670C Series, Color imageCLASS X LBP1333C, C1333P Problem Types: CWE-787 Description: Buffer overflow in identifier field of WSD probe request process of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*:Satera MF740C Series/Satera MF640C Series/Satera LBP660C Series/Satera LBP620C Series firmware v12.07 and earlier, and Satera MF750C Series/Satera LBP
640C Series/Satera LBP660C Series/Satera LBP620C Series firmware v12.07 and earlier, and Satera MF750C Series/Satera LBP670C Series firmware v03.09 and earlier sold in Japan.Color imageCLASS MF740C Series/Color imageCLASS MF640C Series/Color imageCLASS X MF1127C/Color imageCLASS LBP664Cdw/Color imageCLASS LBP622Cdw/Color imageCLASS X LBP1127C firmware v12.07 and earlier, and Color imageCLASS MF750C Series/Color imageCLASS X MF1333C/Color imageCLASS LBP674Cdw/Color imageCLASS X LBP1333C firmware v03.09 and earlier sold in US.i-SENSYS MF740C Series/i-SENSYS MF640C Series/C1127i Series/i-SENSYS LBP660C Series/i-SENSYS LBP620C Series/C1127P firmware v12.07 and earlier, and i-SENSYS MF750C Series
7i Series/i-SENSYS LBP660C Series/i-SENSYS LBP620C Series/C1127P firmware v12.07 and earlier, and i-SENSYS MF750C Series/C1333i Series/i-SENSYS LBP673Cdw/C1333P firmware v03.09 and earlier sold in Europe. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.canon/advisory-information/cp2024-002/
CVE ID: CVE-2024-2185 State: PUBLISHED Published: 2024-04-09T18:58:29.832Z Last Updated: 2024-08-01T19:03:38.988Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpzoom Products: Beaver Builder Addons by WPZOOM Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Box widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a
utput escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/03564cae-df90-454b-8379-6ad9f22b7389?source=cve - https://plugins.trac.wordpress.org/changeset/3046905/wpzoom-addons-for-beaver-builder
CVE ID: CVE-2024-2186 State: PUBLISHED Published: 2024-04-09T18:58:57.763Z Last Updated: 2024-08-15T14:20:23.602Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpzoom Products: Beaver Builder Addons by WPZOOM Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Team Members widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to injec
d output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/746385e0-6bb9-47f2-a3e7-72f8e28be731?source=cve - https://plugins.trac.wordpress.org/changeset/3046905/wpzoom-addons-for-beaver-builder