Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-13340 State: PUBLISHED Published: 2025-01-23T11:13:30.092Z Last Updated: 2025-01-23T14:24:13.903Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: realmag777 Products: MDTF – Meta Data and Taxonomies Filter Problem Types: CWE-79 Description: The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdf_results_by_ajax' shortcode in all versions up to, and including, 1.3.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web
es. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fcaeae5b-4047-4f09-8197-6ce2c21cc812?source=cve - https://wordpress.org/plugins/wp-meta-data-filter-and-taxonomy-filter/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3226055%40wp-meta-data-filter-and-taxonomy-filter&new=3226055%40wp-meta-data-filter-and-taxonomy-filter&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?s
3226055%40wp-meta-data-filter-and-taxonomy-filter&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3224186%40wp-meta-data-filter-and-taxonomy-filter&new=3224186%40wp-meta-data-filter-and-taxonomy-filter&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13341 State: PUBLISHED Published: 2025-02-01T06:41:50.837Z Last Updated: 2025-02-03T16:37:46.200Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Techspawn Products: MultiLoca - WooCommerce Multi Locations Inventory Management Problem Types: CWE-89 Description: The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to SQL Injection via the 'data-id' parameter in all versions up to, and including, 4.1.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level a
cient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8bb172cc-b7a6-401d-a246-1918702d654d?source=cve - https://codecanyon.net/item/woocommerce-multi-locations-inventory-management/28949586
CVE ID: CVE-2024-13342 State: PUBLISHED Published: 2025-08-29T10:54:01.765Z Last Updated: 2025-08-29T11:47:19.969Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: pluggabl Products: Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools Problem Types: CWE-434 Description: The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_files_to_order' function in all versions up to, and including, 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files with double extensions on the affected site's server which may make remote c
ticated attackers to upload arbitrary files with double extensions on the affected site's server which may make remote code execution possible. This is only exploitable on select instances where the configuration will execute the first extension present. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac8a125-121c-4392-846e-625726043972?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/tags/7.2.4/includes/class-wcj-checkout-files-upload.php#L452 - https://plugins.trac.wordpress.org/changeset/3262569/
CVE ID: CVE-2024-13343 State: PUBLISHED Published: 2025-02-01T03:21:10.638Z Last Updated: 2025-02-03T16:38:53.333Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Vanquish Products: WooCommerce Customers Manager Problem Types: CWE-269 Description: The WooCommerce Customers Manager plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_assign_new_roles() function in all versions up to, and including, 31.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
e, to elevate their privileges to that of an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/193c9fe9-17bc-47e7-b93d-dfcebcf8004d?source=cve - https://codecanyon.net/item/woocommerce-customers-manager/10965432
CVE ID: CVE-2024-13344 State: PUBLISHED Published: 2025-05-02T03:21:18.456Z Last Updated: 2025-05-02T14:55:33.351Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: smartcms Products: Advance Seat Reservation Management for WooCommerce Problem Types: CWE-89 Description: The Advance Seat Reservation Management for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'profileId' parameter in all versions up to, and including, 3.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into alread
he existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/35acdb85-e463-46b1-aea7-a6d4c3581499?source=cve - https://codecanyon.net/item/advance-seat-reservation-management-for-woocommerce/19984266
CVE ID: CVE-2024-13345 State: PUBLISHED Published: 2025-02-13T06:58:05.351Z Last Updated: 2025-02-13T14:44:52.531Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: themefusion Products: Avada (Fusion) Builder Problem Types: CWE-94 Description: The Avada Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.11.13. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
ted attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/94f6aab3-49a7-4837-a424-e40e483f3f68?source=cve - https://avada.com/documentation/avada-changelog/
CVE ID: CVE-2024-13346 State: PUBLISHED Published: 2025-02-13T06:58:04.888Z Last Updated: 2025-02-13T14:47:26.368Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: ThemeFusion Products: Avada | Website Builder For WordPress & WooCommerce Problem Types: CWE-94 Description: The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.11.13. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additio
fore running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1f2f390b-332b-452c-9fe7-ccd1a45390dd?source=cve - https://avada.com/documentation/avada-changelog/
CVE ID: CVE-2024-13347 State: PUBLISHED Published: 2025-02-03T06:00:09.278Z Last Updated: 2025-02-03T16:06:07.711Z Vendors: Unknown Products: Essential WP Real Estate Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Essential WP Real Estate WordPress plugin through 1.1.3 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e2f97636-4c67-409a-83c6-ad6255aa2cc5/
CVE ID: CVE-2024-13348 State: REJECTED Published: 2025-01-14T03:23:06.411Z Last Updated: 2025-01-30T15:05:18.960Z Description: No description available.
CVE ID: CVE-2024-13349 State: PUBLISHED Published: 2025-01-30T13:42:10.093Z Last Updated: 2025-01-30T14:13:58.291Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: stockdio Products: Stockdio Historical Chart Problem Types: CWE-79 Description: The Stockdio Historical Chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stockdio-historical-chart' shortcode in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that
ble for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ecf476a8-e341-44d4-988c-a7fb3fb538d1?source=cve - https://plugins.trac.wordpress.org/browser/stockdio-historical-chart/trunk/stockdioplugin.php#L1155 - https://wordpress.org/plugins/stockdio-historical-chart
CVE ID: CVE-2024-13350 State: PUBLISHED Published: 2025-03-05T08:21:55.623Z Last Updated: 2025-03-05T15:00:48.153Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: searchiq Products: SearchIQ – The Search Solution Problem Types: CWE-79 Description: The SearchIQ – The Search Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siq_searchbox' shortcode in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will
or authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a04f074c-448d-4c5f-ae46-0ad1a3effdb4?source=cve - https://plugins.trac.wordpress.org/browser/searchiq/trunk/library/shortcode.php#L132 - https://wordpress.org/plugins/searchiq
CVE ID: CVE-2024-13351 State: PUBLISHED Published: 2025-01-15T09:25:56.149Z Last Updated: 2025-01-15T14:49:49.924Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: neran Products: Social proof testimonials and reviews by Repuso Problem Types: CWE-79 Description: The Social proof testimonials and reviews by Repuso plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rw_image_badge1' shortcode in all versions up to, and including, 5.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary
ibutes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ff7ead53-4b20-48ba-95cd-118fb4eab330?source=cve - https://plugins.trac.wordpress.org/changeset/3222107/social-testimonials-and-reviews-widget/trunk/social-testimonials-and-reviews-widget.php
CVE ID: CVE-2024-13352 State: PUBLISHED Published: 2025-02-07T06:00:03.665Z Last Updated: 2025-02-07T15:16:21.207Z Vendors: Unknown Products: Legull Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Legull WordPress plugin through 1.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2c141cc0-f79e-42bd-97a6-98829647104c/
CVE ID: CVE-2024-13353 State: PUBLISHED Published: 2025-02-21T09:21:06.050Z Last Updated: 2025-02-21T15:13:09.546Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: cyberchimps Products: Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates Problem Types: CWE-98 Description: The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.4 via several widgets. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server,
authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/98df88f8-5aeb-4f57-8525-6a9357173b1d?source=cve - https://plugins.trac.wordpress.org/browser/responsive-addons-for-elementor/trunk/includes/widgets-manager/widgets/woocommerce/class-responsive-addons-for-elementor-product-carous
ns-for-elementor/trunk/includes/widgets-manager/widgets/woocommerce/class-responsive-addons-for-elementor-product-carousel.php#L3151 - https://plugins.trac.wordpress.org/browser/responsive-addons-for-elementor/trunk/includes/widgets-manager/widgets/woocommerce/class-responsive-addons-for-elementor-woo-products.php#L3725 - https://plugins.trac.wordpress.org/changeset/3226779/responsive-addons-for-elementor/tags/1.6.5/includes/widgets-manager/widgets/woocommerce/class-responsive-addons-for-elementor-woo-products.php - https://plugins.trac.wordpress.org/changeset/3226779/responsive-addons-for-elementor/tags/1.6.5/includes/widgets-manager/widgets/woocommerce/class-responsive-addons-for-elementor
nsive-addons-for-elementor/tags/1.6.5/includes/widgets-manager/widgets/woocommerce/class-responsive-addons-for-elementor-product-carousel.php
CVE ID: CVE-2024-13354 State: PUBLISHED Published: 2025-01-24T11:07:32.947Z Last Updated: 2025-01-27T14:55:20.098Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cyberchimps Products: Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates Problem Types: CWE-79 Description: The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML tags in several widgets in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contribu
o insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c46d71fb-ccf1-4cbe-8088-edb7fba225e9?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3226779%40responsive-addons-for-elementor&new=3226779%40responsive-addons-for-elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13355 State: PUBLISHED Published: 2025-01-16T09:39:14.156Z Last Updated: 2025-01-16T15:00:41.629Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: nmedia Products: Admin and Customer Messages After Order for WooCommerce: OrderConvo Problem Types: CWE-434 Description: The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to limited file uploads due to insufficient file type validation in the upload_file() function in all versions up to, and including, 13.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload files on the affected site's serve
ssible for authenticated attackers, with Subscriber-level access and above, to upload files on the affected site's server which may make remote code execution possible and is confirmed to make Cross-Site Scripting possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/82cee07d-871a-4579-aa53-ca0d14315458?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3222601%40admin-and-client-message-after-order-for-woocommerce&new=3222601%40admin-and-client-message-after-order-for-woocommerce&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13356 State: PUBLISHED Published: 2025-02-04T09:21:06.951Z Last Updated: 2025-02-04T14:15:19.170Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: mlfactory Products: DSGVO All in one for WP Problem Types: CWE-352 Description: The DSGVO All in one for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6. This is due to missing or incorrect nonce validation in the user_remove_form.php file. This makes it possible for unauthenticated attackers to delete admin user accounts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link
ts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2efe885d-7e17-4057-abde-37482047facb?source=cve - https://plugins.trac.wordpress.org/browser/dsgvo-all-in-one-for-wp/trunk/core/inc/user_remove_form.php#L25 - https://plugins.trac.wordpress.org/changeset/3233492/dsgvo-all-in-one-for-wp/trunk/core/inc/user_remove_form.php
CVE ID: CVE-2024-13357 State: PUBLISHED Published: 2025-05-15T20:07:00.597Z Last Updated: 2025-05-20T19:28:50.898Z Vendors: Unknown Products: Ditty Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d134bb34-6324-4bc8-943e-4e743d00fcb2/
CVE ID: CVE-2024-13358 State: PUBLISHED Published: 2025-03-01T03:22:18.575Z Last Updated: 2025-03-03T20:57:55.715Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: svenl77 Products: BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages Problem Types: CWE-862 Description: The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wc4bp_delete_page() function in all versions up to, and including, 3.4.24. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins
.4.24. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins page setting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2f526f3c-4e9b-4440-b3c3-8541c1be0ba0?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3244145%40wc4bp&new=3244145%40wc4bp&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13359 State: PUBLISHED Published: 2025-03-08T09:22:53.866Z Last Updated: 2025-03-13T14:09:13.824Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: tychesoftwares Products: Product Input Fields for WooCommerce Problem Types: CWE-434 Description: The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the add_product_input_fields_to_order_item_meta() function in all versions up to, and including, 1.12.0. This may make it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possibl
enticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Please note that by default the plugin is only vulnerable to a double extension file upload attack, unless an administrators leaves the accepted file extensions field blank which can make .php file uploads possible. Please note 1.12.2 was mistakenly marked as patched while 1.12.1 was marked as vulnerable for a short period of time, this is not the case and 1.12.1 is fully patched. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a9c08f2e-bffd-40a6-89f3-559cb34f4395?source=cve - https://plugins.trac
www.wordfence.com/threat-intel/vulnerabilities/id/a9c08f2e-bffd-40a6-89f3-559cb34f4395?source=cve - https://plugins.trac.wordpress.org/browser/product-input-fields-for-woocommerce/tags/-1.8.2/includes/class-alg-wc-pif-main.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3250201%40product-input-fields-for-woocommerce&new=3250201%40product-input-fields-for-woocommerce&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3234567%40product-input-fields-for-woocommerce&new=3234567%40product-input-fields-for-woocommerce&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13360 State: PUBLISHED Published: 2025-01-22T07:29:39.434Z Last Updated: 2025-01-22T14:32:14.997Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: senols Products: AI Power: Complete AI Pack Problem Types: CWE-918 Description: The AI Power: Complete AI Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.8.96 via the wpaicg_troubleshoot_add_vector(). This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal serv
itrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5cf6cbba-0e0c-4d2c-90d0-d7e0a5222df2?source=cve - https://plugins.trac.wordpress.org/changeset/3224162/