Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-2375 State: PUBLISHED Published: 2022-08-22T15:01:53 Last Updated: 2024-08-03T00:32:09.626Z Vendors: Unknown Products: WP Sticky Button – Click to Chat Problem Types: CWE-79, CWE-352 Description: The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to update them. Furthermore, due to the lack of escaping in some of them, it could lead to Stored Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/caab1fca-cc6b-45bb-bd0d-f857edd8bb81
CVE ID: CVE-2022-2376 State: PUBLISHED Published: 2022-09-05T12:35:19 Last Updated: 2024-08-03T00:32:09.699Z Vendors: Unknown Products: Directorist – WordPress Business Directory Plugin with Classified Ads Listings Problem Types: CWE-862 Description: The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/437c4330-376a-4392-86c6-c4c7ed9583ad
CVE ID: CVE-2022-2377 State: PUBLISHED Published: 2022-08-22T15:02:09 Last Updated: 2024-08-03T00:32:09.474Z Vendors: Unknown Products: Directorist – WordPress Business Directory Plugin with Classified Ads Listings Problem Types: CWE-862, CWE-352 Description: The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of the blog Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f4e606e9-0664-42fb-a59b-21de306eb530
CVE ID: CVE-2022-2378 State: PUBLISHED Published: 2022-08-15T08:37:09 Last Updated: 2024-08-03T00:39:06.235Z Vendors: Unknown Products: Easy Student Results Problem Types: CWE-79 Description: The Easy Student Results WordPress plugin through 2.2.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3f4e8fe5-1c92-49ad-b709-a40749c80596
CVE ID: CVE-2022-2379 State: PUBLISHED Published: 2022-08-15T08:37:23 Last Updated: 2024-08-03T00:39:06.362Z Vendors: Unknown Products: Easy Student Results Problem Types: CWE-862 Description: The Easy Student Results WordPress plugin through 2.2.8 lacks authorisation in its REST API, allowing unauthenticated users to retrieve information related to the courses, exams, departments as well as student's grades and PII such as email address, physical address, phone number etc Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0773ba24-212e-41d5-9ae0-1416ea2c9db6
CVE ID: CVE-2022-2380 State: PUBLISHED Published: 2022-07-13T18:29:25.000Z Last Updated: 2025-04-23T18:02:29.804Z Vendors: n/a Products: Kernel Problem Types: CWE-125 Description: The Linux kernel was found vulnerable out of bounds memory access in the drivers/video/fbdev/sm712fb.c:smtcfb_read() function. The vulnerability could result in local attackers being able to crash the kernel. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev.git/commit/?h=for-next&id=bd771cf5c4254511cc4abb88f3dab3bd58bdf8e8
CVE ID: CVE-2022-2381 State: PUBLISHED Published: 2022-08-15T08:37:38 Last Updated: 2024-08-03T00:39:06.339Z Vendors: Unknown Products: E Unlocked – Student Result Problem Types: CWE-352 Description: The E Unlocked - Student Result WordPress plugin through 1.0.4 is lacking CSRF and validation when uploading the School logo, which could allow attackers to make a logged in admin upload arbitrary files, such as PHP via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c39c41bf-f622-4239-a0a1-4dfe0e079f7f
CVE ID: CVE-2022-2382 State: PUBLISHED Published: 2022-08-22T15:02:20 Last Updated: 2024-08-03T00:39:06.347Z Vendors: Unknown Products: Product Slider for WooCommerce Problem Types: CWE-862, CWE-352 Description: The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in particular could allow them to delete arbitrary blog options. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/777d4637-444b-4eda-bc21-95d3a3bf6cd3
CVE ID: CVE-2022-2383 State: PUBLISHED Published: 2022-08-22T15:02:27 Last Updated: 2024-08-03T00:39:06.347Z Vendors: Unknown Products: Feed Them Social – for Twitter feed, Youtube and more Problem Types: CWE-79 Description: The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4a3b3023-e740-411c-a77c-6477b80d7531
CVE ID: CVE-2022-2384 State: PUBLISHED Published: 2022-08-15T08:37:52 Last Updated: 2024-08-03T00:39:07.356Z Vendors: Unknown Products: Digital Publications by Supsystic Problem Types: CWE-79 Description: The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0917b964-f347-487e-b8d7-c4f09c290fe5
CVE ID: CVE-2022-2385 State: PUBLISHED Published: 2022-07-12T14:25:10.421681Z Last Updated: 2024-09-16T22:25:39.286Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Kubernetes Products: aws-iam-authenticator Problem Types: CWE-20 Description: A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kubernetes-sigs/aws-iam-authenticator/issues/472 - https://groups.google.com/a/kubernetes.io/g/dev/c/EMxHpU-1ZYs
CVE ID: CVE-2022-2386 State: PUBLISHED Published: 2022-08-08T13:48:13 Last Updated: 2024-08-03T00:39:07.934Z Vendors: Unknown Products: Crowdsignal Dashboard – Polls, Surveys & more Problem Types: CWE-79 Description: The Crowdsignal Dashboard WordPress plugin before 3.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/47855d4b-9f6a-4fc7-b231-4337f51c8886
CVE ID: CVE-2022-2387 State: PUBLISHED Published: 2022-11-07T00:00:00.000Z Last Updated: 2025-05-05T20:26:52.592Z Vendors: Unknown Products: Easy Digital Downloads – Simple eCommerce for Selling Digital Files Problem Types: CWE-352 Description: The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/db3c3c78-1724-4791-9ab6-ebb2e8a4c8b8
CVE ID: CVE-2022-2388 State: PUBLISHED Published: 2022-08-22T15:02:35 Last Updated: 2024-08-03T00:39:06.410Z Vendors: Unknown Products: WP Coder – add custom html, css and js code Problem Types: CWE-352 Description: The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a logged in admin delete arbitrary ones via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/50acd35f-eb31-4aba-bf32-b390e9514beb
CVE ID: CVE-2022-2389 State: PUBLISHED Published: 2022-08-22T15:02:49 Last Updated: 2024-08-03T00:39:07.097Z Vendors: Unknown Products: Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami Problem Types: CWE-862, CWE-352 Description: The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one of its AJAX action, allowing any authenticated users, such as subscriber to create automations Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e70f00b7-6251-4
ations Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e70f00b7-6251-476e-9297-60af509e6ad9
CVE ID: CVE-2022-2390 State: PUBLISHED Published: 2022-08-12T10:25:08.000Z Last Updated: 2025-04-21T13:50:34.958Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: Google LLC Products: Play Services SDK Problem Types: CWE-471 Description: Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service. As Google Play services SDK is so widely used, this bug affects many applications. For an application affected, this bug will let the attacker, gain the access to all non-exported providers and/or gain the access to other providers the victim has permissions. We recommend upgradi
to all non-exported providers and/or gain the access to other providers the victim has permissions. We recommend upgrading to version 18.0.2 of the Play Service SDK as well as rebuilding and redeploying apps. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developers.google.com/android/guides/releases#may_03_2022 - https://mvnrepository.com/artifact/com.google.android.gms/play-services-basement/18.0.2
CVE ID: CVE-2022-2391 State: PUBLISHED Published: 2022-08-08T13:48:28 Last Updated: 2024-08-03T00:39:06.371Z Vendors: Unknown Products: Inspiro PRO Problem Types: CWE-79 Description: The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to inject JavaScript into the description. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/dd6ebf6b-209b-437c-9fe4-527ab9e3b9e3
CVE ID: CVE-2022-2392 State: PUBLISHED Published: 2022-08-22T15:03:01 Last Updated: 2024-08-03T00:39:06.383Z Vendors: Unknown Products: Lana Downloads Manager Problem Types: CWE-552 Description: The Lana Downloads Manager WordPress plugin before 1.8.0 is affected by an arbitrary file download vulnerability that can be exploited by users with "Contributor" permissions or higher. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5001ed18-858e-4c9d-9d7b-a1305fcdf61b
CVE ID: CVE-2022-2393 State: PUBLISHED Published: 2022-07-14T14:53:46 Last Updated: 2024-08-03T00:39:07.715Z Vendors: n/a Products: pki-core Problem Types: CWE-285 Description: A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent network to impersonate another user within the scope of the domain, but they would not be able to decrypt message content. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2101046
CVE ID: CVE-2022-2394 State: PUBLISHED Published: 2022-07-19T17:46:48.011706Z Last Updated: 2024-09-16T20:22:09.334Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: Puppet Products: Bolt Problem Types: CWE-200 Description: Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, such as via Puppet Enterprise. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/CVE-2022-2394
CVE ID: CVE-2022-2395 State: PUBLISHED Published: 2022-08-08T13:48:42 Last Updated: 2024-08-03T00:39:06.395Z Vendors: Unknown Products: weForms – Easy Drag & Drop Contact Form Builder For WordPress Problem Types: CWE-79 Description: The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5e442dd9-a49d-4a8e-959b-199a8689da4b
CVE ID: CVE-2022-2396 State: PUBLISHED Published: 2022-07-14T12:06:55.000Z Last Updated: 2025-04-15T14:06:44.901Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Simple e-Learning System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in SourceCodester Simple e-Learning System 1.0. Affected by this vulnerability is an unknown functionality of the file /vcs/claire_blake. The manipulation of the argument Bio with the input "><script>alert(document.cookie)</script> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Addition
e scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CyberThoth/CVE/blob/83c243538386cd0761025f85eb747eab7cae5c21/CVE/Simple%20e-Learning%20System/Cross%20Site%20Scripting%28Stored%29/POC.md - https://vuldb.com/?id.203779
CVE ID: CVE-2022-2398 State: PUBLISHED Published: 2022-08-08T13:48:58 Last Updated: 2024-08-03T00:39:06.414Z Vendors: Unknown Products: WordPress Comments Fields Problem Types: CWE-79 Description: The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0a218789-9a78-49ca-b919-fa61d33d5672
CVE ID: CVE-2022-2399 State: PUBLISHED Published: 2022-07-28T21:35:09 Last Updated: 2024-08-03T00:39:06.353Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in WebGPU in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html - https://crbug.com/1313172
CVE ID: CVE-2022-2400 State: PUBLISHED Published: 2022-07-18T00:00:00 Last Updated: 2024-08-03T00:39:06.372Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: dompdf Products: dompdf/dompdf Problem Types: CWE-73 Description: External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a6da5e5e-86be-499a-a3c3-2950f749202a - https://github.com/dompdf/dompdf/commit/99aeec1efec9213e87098d42eb09439e7ee0bb6a - https://lists.debian.org/debian-lts-announce/2023/07/msg00017.html
CVE ID: CVE-2022-2401 State: PUBLISHED Published: 2022-07-14T17:20:49 Last Updated: 2024-12-06T23:08:34.889Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-200 Description: Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2022-2402 State: PUBLISHED Published: 2022-09-06T17:18:51.162141Z Last Updated: 2024-09-16T23:55:47.949Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: ESET, spol. s r.o. Products: ESET Endpoint Encryption, ESET Full Disk Encryption Problem Types: CWE-121 Description: The vulnerability in the driver dlpfde.sys enables a user logged into the system to perform system calls leading to kernel stack overflow, resulting in a system crash, for instance, a BSOD. Additional Analyst Notes: - CVE Program Container: References: - https://support.eset.com/en/ca8298-vulnerability-fixed-in-eset-endpoint-encryption-and-eset-full-disk-encryption-for-windows
CVE ID: CVE-2022-2403 State: PUBLISHED Published: 2022-09-01T20:28:25 Last Updated: 2024-08-03T00:39:07.025Z Vendors: n/a Products: Openshift Problem Types: CWE-497 Description: A credentials leak was found in the OpenShift Container Platform. The private key for the external cluster certificate was stored incorrectly in the oauth-serving-cert ConfigMaps, and accessible to any authenticated OpenShift user or service-account. A malicious user could exploit this flaw by reading the oauth-serving-cert ConfigMap in the openshift-config-managed namespace, compromising any web traffic secured using that certificate. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.
affic secured using that certificate. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2101959 - https://access.redhat.com/security/cve/CVE-2022-2403
CVE ID: CVE-2022-2404 State: PUBLISHED Published: 2022-09-26T12:35:33.000Z Last Updated: 2025-05-21T19:20:21.761Z Vendors: Unknown Products: WP Popup Builder – Popup Forms , Marketing PoPuP & Newsletter Problem Types: CWE-79 Description: The WP Popup Builder WordPress plugin before 1.2.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0d889dde-b9d5-46cf-87d3-4f8a85cf9b98
CVE ID: CVE-2022-2405 State: PUBLISHED Published: 2022-09-26T12:35:34.000Z Last Updated: 2025-05-21T19:19:27.568Z Vendors: Unknown Products: WP Popup Builder – Popup Forms , Marketing PoPuP & Newsletter Problem Types: CWE-862, CWE-352 Description: The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/50037028-2790-47ee-aae1-faf0724eb917
CVE ID: CVE-2022-2406 State: PUBLISHED Published: 2022-07-14T17:23:55 Last Updated: 2024-12-06T23:08:23.956Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-400 Description: The legacy Slack import feature in Mattermost version 6.7.0 and earlier fails to properly limit the sizes of imported files, which allows an authenticated attacker to crash the server by importing large files via the Slack import REST API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2022-2407 State: PUBLISHED Published: 2022-08-22T15:03:08 Last Updated: 2024-08-03T00:39:07.097Z Vendors: Unknown Products: WP phpMyAdmin Problem Types: CWE-79 Description: The WP phpMyAdmin WordPress plugin before 5.2.0.4 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5be611e8-5b7a-4579-9757-45a4c94a53ca
CVE ID: CVE-2022-2408 State: PUBLISHED Published: 2022-07-14T17:25:20 Last Updated: 2024-12-06T23:08:12.973Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-200 Description: The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2022-2409 State: PUBLISHED Published: 2022-08-08T13:49:14 Last Updated: 2024-08-03T00:39:07.672Z Vendors: Unknown Products: Rough Chart Problem Types: CWE-79 Description: The Rough Chart WordPress plugin through 1.0.0 does not properly escape chart data label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fbf474d1-4ac2-4ed2-943c-497a4d5e9cea
CVE ID: CVE-2022-2410 State: PUBLISHED Published: 2022-08-08T13:49:29 Last Updated: 2024-08-03T00:39:07.785Z Vendors: Unknown Products: mTouch Quiz Problem Types: CWE-79 Description: The mTouch Quiz WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c7cd55c1-e28b-4287-bab7-eb36483e0b18
CVE ID: CVE-2022-2411 State: PUBLISHED Published: 2022-08-08T13:49:44 Last Updated: 2024-08-03T00:39:07.269Z Vendors: Unknown Products: Auto More Tag Problem Types: CWE-79 Description: The Auto More Tag WordPress plugin through 4.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/72e83ffb-14e4-4e32-9516-083447dc8294
CVE ID: CVE-2022-2412 State: PUBLISHED Published: 2022-08-08T13:50:04 Last Updated: 2024-08-03T00:39:06.990Z Vendors: Unknown Products: Better Tag Cloud Problem Types: CWE-79 Description: The Better Tag Cloud WordPress plugin through 0.99.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fc384cea-ae44-473c-8aa9-a84a2821bdc6
CVE ID: CVE-2022-2413 State: PUBLISHED Published: 2024-01-16T15:49:54.103Z Last Updated: 2025-05-22T18:22:23.158Z Vendors: Unknown Products: Slide Anything Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pages, allowing a logged in user with roles as low as Author to inject a javascript payload into the slide title even when the unfiltered_html capability is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2e38b1bb-4410-45e3-87ca-d47a2cce9e22/