Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1361066 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4177 State: PUBLISHED Published: 2022-11-29T00:00:00 Last Updated: 2024-08-03T01:34:49.314Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Extensions in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install an extension to potentially exploit heap corruption via a crafted Chrome Extension and UI interaction. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1379242 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/
-desktop_29.html - https://crbug.com/1379242 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4178 State: PUBLISHED Published: 2022-11-29T00:00:00 Last Updated: 2024-08-03T01:34:49.840Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Mojo in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1376099 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4179 State: PUBLISHED Published: 2022-11-29T00:00:00 Last Updated: 2024-08-03T01:34:49.302Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Audio in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1377783 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4180 State: PUBLISHED Published: 2022-11-29T00:00:00 Last Updated: 2024-08-03T01:34:49.572Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Mojo in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1378564 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4181 State: PUBLISHED Published: 2022-11-29T00:00:00 Last Updated: 2024-08-03T01:34:49.623Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Forms in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1382581 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4182 State: PUBLISHED Published: 2022-11-29T00:00:00 Last Updated: 2024-08-03T01:34:49.495Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Fenced Frames in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass fenced frame restrictions via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1368739 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4183 State: PUBLISHED Published: 2022-11-29T00:00:00 Last Updated: 2024-08-03T01:34:49.537Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in Popup Blocker in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1251790 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4184 State: PUBLISHED Published: 2022-11-29T00:00:00 Last Updated: 2024-08-03T01:34:49.314Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in Autofill in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass autofill restrictions via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1358647 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4185 State: PUBLISHED Published: 2022-11-29T00:00:00 Last Updated: 2024-08-03T01:34:49.304Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Navigation in Google Chrome on iOS prior to 108.0.5359.71 allowed a remote attacker to spoof the contents of the modal dialogue via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1373025 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4186 State: PUBLISHED Published: 2022-11-29T00:00:00 Last Updated: 2024-08-03T01:34:49.872Z Vendors: Google Products: Chrome Problem Types: Insufficient validation of untrusted input Description: Insufficient validation of untrusted input in Downloads in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to bypass Downloads restrictions via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1377165 - https://security.gentoo.org/glsa/202305
/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1377165 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4187 State: PUBLISHED Published: 2022-11-29T00:00:00 Last Updated: 2024-08-03T01:34:49.557Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 108.0.5359.71 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1381217 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4188 State: PUBLISHED Published: 2022-11-29T00:00:00 Last Updated: 2024-08-03T01:34:49.540Z Vendors: Google Products: Chrome Problem Types: Insufficient validation of untrusted input Description: Insufficient validation of untrusted input in CORS in Google Chrome on Android prior to 108.0.5359.71 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1340879 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-
html - https://crbug.com/1340879 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4189 State: PUBLISHED Published: 2022-11-29T00:00:00 Last Updated: 2024-08-03T01:34:49.674Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in DevTools in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1344647 - https://security.gentoo.org/glsa/202305-10 - https://s
-channel-update-for-desktop_29.html - https://crbug.com/1344647 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4190 State: PUBLISHED Published: 2022-11-29T00:00:00 Last Updated: 2024-08-03T01:34:49.571Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in Directory in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1378997 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4191 State: PUBLISHED Published: 2022-11-29T00:00:00 Last Updated: 2024-08-03T01:34:49.886Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Sign-In in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via profile destruction. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1373941 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202
_29.html - https://crbug.com/1373941 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4192 State: PUBLISHED Published: 2022-11-29T00:00:00 Last Updated: 2024-08-03T01:34:49.599Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Live Caption in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via UI interaction. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1344514 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202
_29.html - https://crbug.com/1344514 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4193 State: PUBLISHED Published: 2022-11-29T00:00:00 Last Updated: 2024-08-03T01:34:49.622Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in File System API in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1354518 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4194 State: PUBLISHED Published: 2022-11-29T00:00:00 Last Updated: 2024-08-03T01:34:49.622Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Accessibility in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1370562 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4195 State: PUBLISHED Published: 2022-11-29T00:00:00 Last Updated: 2024-08-03T01:34:49.621Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass Safe Browsing warnings via a malicious file. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1371926 - https://security.gentoo.org/glsa/202305-10 - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-4196 State: PUBLISHED Published: 2023-01-09T22:13:40.058Z Last Updated: 2025-04-09T14:01:35.710Z Vendors: Unknown Products: Multi Step Form Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Multi Step Form WordPress plugin before 1.7.8 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/dfbc61ef-3fe4-4bab-904a-480b073d4e88
CVE ID: CVE-2022-4197 State: PUBLISHED Published: 2022-12-26T12:28:00.982Z Last Updated: 2025-04-11T23:21:07.756Z Vendors: Unknown Products: Sliderby10Web Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Sliderby10Web WordPress plugin before 1.2.53 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/96818024-57ab-419d-bd46-7d2da98269e6
CVE ID: CVE-2022-4198 State: PUBLISHED Published: 2023-01-02T21:49:15.457Z Last Updated: 2025-04-10T19:07:29.012Z Vendors: Unknown Products: WP Social Sharing Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Social Sharing WordPress plugin through 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ba372400-96f7-45a9-9e89-5984ecc4d1e2 - https://security.gentoo.or
chment: References: - https://wpscan.com/vulnerability/ba372400-96f7-45a9-9e89-5984ecc4d1e2 - https://security.gentoo.org/glsa/202305-33
CVE ID: CVE-2022-4199 State: PUBLISHED Published: 2023-01-16T15:37:51.207Z Last Updated: 2025-04-04T18:21:29.591Z Vendors: Unknown Products: Link Library Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Link Library WordPress plugin before 7.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c4688c0b-0538-4151-995c-d437d7e4829d
CVE ID: CVE-2022-4200 State: PUBLISHED Published: 2023-01-02T21:49:34.280Z Last Updated: 2025-04-10T18:45:17.119Z Vendors: Unknown Products: Login with Cognito Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Login with Cognito WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ac2e3fea-e1e6-4d90-9945-d8434a00a3cf
CVE ID: CVE-2022-4201 State: PUBLISHED Published: 2023-01-27T00:00:00.000Z Last Updated: 2025-03-27T20:20:58.630Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Server-side request forgery (ssrf) in GitLab Description: A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/30376 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CV
rences: - https://gitlab.com/gitlab-org/gitlab/-/issues/30376 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4201.json
CVE ID: CVE-2022-4202 State: PUBLISHED Published: 2022-11-29T00:00:00.000Z Last Updated: 2025-04-15T13:11:35.758Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: unspecified Products: GPAC Problem Types: CWE-189 Description: A vulnerability, which was classified as problematic, was found in GPAC 2.1-DEV-rev490-g68064e101-master. Affected is the function lsr_translate_coords of the file laser/lsr_dec.c. The manipulation leads to integer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is b3d821c4ae9ba62b3a194d9dcb5e99f17bd56908. It is recommended to apply a patch to fix
ay be used. The name of the patch is b3d821c4ae9ba62b3a194d9dcb5e99f17bd56908. It is recommended to apply a patch to fix this issue. VDB-214518 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1HVWa6IpAbvsMS5rx091RfjUB4GfXrMLE/view - https://vuldb.com/?id.214518 - https://github.com/gpac/gpac/issues/2333 - https://github.com/gpac/gpac/commit/b3d821c4ae9ba62b3a194d9dcb5e99f17bd56908 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2022-4203 State: PUBLISHED Published: 2023-02-24T14:53:08.485Z Last Updated: 2025-11-04T19:14:06.670Z Vendors: OpenSSL Products: OpenSSL Problem Types: read buffer overrun Description: A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. The read buffer overrun might result in a crash which could lead to a denial of service attack. In theory it could also result in the d
overrun might result in a crash which could lead to a denial of service attack. In theory it could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext) although we are not aware of any working exploit leading to memory contents disclosure as of the time of release of this advisory. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20230207.txt - https://git.openssl.org/gitweb/
CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20230207.txt - https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c927a3492698c254637da836762f9b1f86cffabc - https://security.gentoo.org/glsa/202402-08
CVE ID: CVE-2022-4205 State: PUBLISHED Published: 2023-01-27T00:00:00.000Z Last Updated: 2025-03-27T20:21:18.593Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L) Vendors: GitLab Products: GitLab Problem Types: Access of resource using incompatible type ('type confusion') in GitLab Description: In Gitlab EE/CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a hexadecimal name could override an existing hash. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/374082 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4205.json
CVE ID: CVE-2022-4206 State: PUBLISHED Published: 2023-02-01T00:00:00.000Z Last Updated: 2025-03-27T14:43:30.972Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: GitLab Products: DAST API scanner Problem Types: Information exposure in DAST API scanner Description: A sensitive information leak issue has been discovered in all versions of DAST API scanner from 1.6.50 prior to 2.0.102, exposing the Authorization header in the vulnerability report Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/383083 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4206.json
CVE ID: CVE-2022-4207 State: PUBLISHED Published: 2022-12-13T20:18:36.516Z Last Updated: 2025-01-23T20:32:21.022Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: biplob018 Products: Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values that can be added to an Image Hover in versions 9.8.1 to 9.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authent
n versions 9.8.1 to 9.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f00cdef3-d733-4e85-8099-204ef76096b4 - https://github.com/MrOxizen
s://www.wordfence.com/threat-intel/vulnerabilities/id/f00cdef3-d733-4e85-8099-204ef76096b4 - https://github.com/MrOxizen/image-hover-effects-ultimate/commit/4ba784e1a2a0cf02e8b8cbe3db7323735d7dedc9 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2830197%40image-hover-effects-ultimate&new=2830197%40image-hover-effects-ultimate&sfp_email=&sfph_mail=