Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
s it possible for authenticated attackers (subscriber or higher) to manipulate products. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c42f56a2-b9f9-40ef-86ad-fea6cf2e29f8?source=cve - https://plugins.trac.wordpress.org/browser/woo-bulk-editor/trunk/ext/bulkoperations/bulkoperations.php#L286 - https://plugins.trac.wordpress.org/changeset/2970262/woo-bulk-editor/trunk/ext/bulkoperations/bulkoperations.php?contextall=1&old=2844667&old_path=%2Fwoo-bulk-editor%2Ftrunk%2Fext%2Fbulkoperations%2Fbulkoperations.php
CVE ID: CVE-2023-4939 State: PUBLISHED Published: 2023-10-21T07:33:24.839Z Last Updated: 2025-02-05T18:59:26.170Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: salesmanag0 Products: SALESmanago Problem Types: CWE-305 Authentication Bypass by Primary Weakness Description: The SALESmanago plugin for WordPress is vulnerable to Log Injection in versions up to, and including, 3.2.4. This is due to the use of a weak authentication token for the /wp-json/salesmanago/v1/callbackApiV3 API endpoint which is simply a SHA1 hash of the site URL and client ID found in the page source of the website. This makes it possible for unauthenticated attackers to inject arbitrar
ient ID found in the page source of the website. This makes it possible for unauthenticated attackers to inject arbitrary content into the log files, and when combined with another vulnerability this could have significant consequences. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/de7db1d6-b352-44c7-a6cc-b21cb65a0482?source=cve - https://plugins.trac.wordpress.org/browser/salesmanago/trunk/src/Admin/Controller/CallbackController.php - https://plugins.trac.wordpress.org/browser/salesmanago/trunk/src/Includes/Helper.php#L376
CVE ID: CVE-2023-4940 State: PUBLISHED Published: 2023-10-20T06:35:15.630Z Last Updated: 2025-02-05T19:10:17.211Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: realmag777 Products: BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_swap function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a
is makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/31c5e524-ef4d-48c7-baa0-595f8060a167?source=cve - https://plugins.trac.wordpress.org/browser/woo-bulk-editor/trunk/ext/bulkoperations/bulkoperations.php#L521 - https://plugins.trac.wordpress.org/changeset/2970262/woo-bulk-editor/trunk/ext/bulkoperations/bulkoperations.php?contextall=1&old=2844667&old_path=%2Fwoo-bulk-editor%2Ftrunk%2Fext%2Fbulkoperations%2F
bulkoperations/bulkoperations.php?contextall=1&old=2844667&old_path=%2Fwoo-bulk-editor%2Ftrunk%2Fext%2Fbulkoperations%2Fbulkoperations.php
CVE ID: CVE-2023-4941 State: PUBLISHED Published: 2023-10-20T07:29:29.267Z Last Updated: 2025-02-05T19:04:39.642Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: realmag777 Products: BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net Problem Types: CWE-862 Missing Authorization Description: The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_swap function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products. Additional Analyst Notes: - CVE Program Container: -
henticated attackers (subscriber or higher) to manipulate products. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bc20f303-cac3-4517-9c45-153c410a13af?source=cve - https://plugins.trac.wordpress.org/browser/woo-bulk-editor/trunk/ext/bulkoperations/bulkoperations.php#L521 - https://plugins.trac.wordpress.org/changeset/2970262/woo-bulk-editor/trunk/ext/bulkoperations/bulkoperations.php?contextall=1&old=2844667&old_path=%2Fwoo-bulk-editor%2Ftrunk%2Fext%2Fbulkoperations%2Fbulkoperations.php
CVE ID: CVE-2023-4942 State: PUBLISHED Published: 2023-10-20T06:35:12.339Z Last Updated: 2025-02-05T19:11:05.093Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: realmag777 Products: BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_visibility function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can tr
on. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/26d8b75b-befa-4c6a-b072-0da44e437174?source=cve - https://plugins.trac.wordpress.org/browser/woo-bulk-editor/trunk/ext/bulkoperations/bulkoperations.php#L719 - https://plugins.trac.wordpress.org/changeset/2970262/woo-bulk-editor/trunk/ext/bulkoperations/bulkoperations.php?contextall=1&old=2844667&old_path=%2Fwoo-bulk-editor%2Ftrunk%2Fext%2Fbulkoperati
k/ext/bulkoperations/bulkoperations.php?contextall=1&old=2844667&old_path=%2Fwoo-bulk-editor%2Ftrunk%2Fext%2Fbulkoperations%2Fbulkoperations.php
CVE ID: CVE-2023-4943 State: PUBLISHED Published: 2023-10-20T06:35:13.763Z Last Updated: 2025-02-05T19:10:41.713Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: realmag777 Products: BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net Problem Types: CWE-862 Missing Authorization Description: The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_visibility function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products. Additional Analyst Notes: - CVE Program Contai
or authenticated attackers (subscriber or higher) to manipulate products. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2d10475f-83dd-4e59-83e4-aeaa72a22b96?source=cve - https://plugins.trac.wordpress.org/browser/woo-bulk-editor/trunk/ext/bulkoperations/bulkoperations.php#L719 - https://plugins.trac.wordpress.org/changeset/2970262/woo-bulk-editor/trunk/ext/bulkoperations/bulkoperations.php?contextall=1&old=2844667&old_path=%2Fwoo-bulk-editor%2Ftrunk%2Fext%2Fbulkoperations%2Fbulkoperations.php
CVE ID: CVE-2023-4944 State: PUBLISHED Published: 2023-09-14T02:29:50.725Z Last Updated: 2025-02-05T19:28:43.197Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: richardgabriel Products: Awesome Weather Widget Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Awesome Weather Widget for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'awesome-weather' shortcode in versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-l
n and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3bf77988-370b-437f-83a0-18a147e3e087?source=cve - https://plugins.trac.wordpress.org/browser/awesome-weather/tags/3.0.2/awesome-weather.php#L133 - https://plugins.trac.wordpress.org/browser/awesome-weather/tags/3.0.2/awesome-weather.php#L117
CVE ID: CVE-2023-4945 State: PUBLISHED Published: 2023-09-14T02:29:51.220Z Last Updated: 2025-02-05T19:28:33.873Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pluggabl Products: Booster for WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in versions up to, and including, 7.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions
ser supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/981639a3-63c4-4b3f-827f-4d770bd44806?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/tags/7.1.0/includes/shortcodes/class-wcj-general-shortcodes.php#L1035 - https://plugins.trac.wordpress.org/changeset/2966325/woocommerce-jetpack
CVE ID: CVE-2023-4947 State: PUBLISHED Published: 2023-10-20T06:35:12.814Z Last Updated: 2025-02-05T19:10:57.709Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Yan&Co Products: WooCommerce EAN Payment Gateway Problem Types: CWE-862 Missing Authorization Description: The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_order_ean_data AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above, to update EAN numbers for orders. Additional Analyst Notes: - CVE Program Container: - CISA ADP
level access and above, to update EAN numbers for orders. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2760b183-3c15-4f0e-b72f-7c0333f9d4b6?source=cve - https://plugins.yanco.dk/product/woocommerce-ean-payment-gateway/
CVE ID: CVE-2023-4948 State: PUBLISHED Published: 2023-09-14T03:24:07.870Z Last Updated: 2025-02-05T19:28:23.661Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Yan&Co Products: WooCommerce CVR Payment Gateway Problem Types: CWE-862 Missing Authorization Description: The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_order_cvr_data AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above, to update CVR numbers for orders. Additional Analyst Notes: - CVE Program Container: - CISA ADP
level access and above, to update CVR numbers for orders. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f72ba0e2-a9c4-43b0-a01f-185554090162?source=cve - https://plugins.yanco.dk/product/woocommerce-cvr-payment-gateway/
CVE ID: CVE-2023-4949 State: PUBLISHED Published: 2023-11-10T16:57:03.311Z Last Updated: 2024-09-03T17:29:10.425Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H) Vendors: Free Software Foundation Products: Grub-Legacy Problem Types: CWE-119, CWE-190 Description: An attacker with local access to a system (either through a disk or external drive) can present a modified XFS partition to grub-legacy in such a way to exploit a memory corruption in grub’s XFS file system implementation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://xenbits.xenproject.org/xsa/advisory-443.html
CVE ID: CVE-2023-4950 State: PUBLISHED Published: 2023-10-16T19:38:58.080Z Last Updated: 2025-04-23T16:14:20.720Z Vendors: Unknown Products: Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/73db1ee8-06a2-41b6-b287-44e25f5f2e58
CVE ID: CVE-2023-4951 State: PUBLISHED Published: 2023-09-14T16:43:40.721Z Last Updated: 2024-09-25T14:16:47.777Z Severity: LOW (CVSS 2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: Green Rocket Security Products: GreenRADIUS Problem Types: CWE-79 Description: A cross site scripting issue was discovered with the pagination function on the "Client-based Authentication Policy Configuration" screen of the GreenRADIUS web admin interface. This issue is found in GreenRADIUS v5.1.1.1 and prior. A fix was included in v5.1.2.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://greenrocketsecurity.com/cve-2023-4951/
CVE ID: CVE-2023-4956 State: PUBLISHED Published: 2023-11-07T19:12:00.777Z Last Updated: 2025-11-07T00:46:07.885Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Quay 3 Problem Types: CWE-1021 Description: A flaw was found in Quay. Clickjacking is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they intend to click on the top-level page. During the pentest, it has been detected that the config-editor page is vulnerable to clickjacking. This flaw allows an attacker to trick an administrator user into clicking on buttons on the config-editor panel, poss
g. This flaw allows an attacker to trick an administrator user into clicking on buttons on the config-editor panel, possibly reconfiguring some parts of the Quay instance. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2023-4956 - https://bugzilla.redhat.com/show_bug.cgi?id=2238886
CVE ID: CVE-2023-4957 State: PUBLISHED Published: 2023-10-11T13:21:32.613Z Last Updated: 2025-08-28T07:56:23.568Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Zebra Technologies Products: ZTC ZT410 Problem Types: CWE-288 Description: A vulnerability of authentication bypass has been found on a Zebra Technologies ZTC ZT410-203dpi ZPL printer. This vulnerability allows an attacker that is in the same network as the printer, to change the username and password for the Web Page by sending a specially crafted POST request to the setvarsResults.cgi file. For this vulnerability to be exploitable, the printers protected mode must be disabled. Additional Analyst N
s.cgi file. For this vulnerability to be exploitable, the printers protected mode must be disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/authentication-bypass-zebra-ztc
CVE ID: CVE-2023-4958 State: PUBLISHED Published: 2023-12-12T10:02:33.672Z Last Updated: 2024-08-02T07:44:53.761Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L) Vendors: Red Hat Products: Red Hat Advanced Cluster Security 4.2, Red Hat Advanced Cluster Security 3 Problem Types: CWE-1021 Description: In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowing an attacker to exploit this with a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page, that deceptively points to valid RHACS endpoints, hijacking the user's account permissions
attacker-controlled web page, that deceptively points to valid RHACS endpoints, hijacking the user's account permissions to perform other actions. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:5206 - https://access.redhat.com/security/cve/CVE-2023-4958 - https://bugzilla.redhat.com/show_bug.cgi?id=1990363
CVE ID: CVE-2023-4959 State: PUBLISHED Published: 2023-09-15T09:51:26.867Z Last Updated: 2025-11-07T00:08:17.699Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Quay 3 Problem Types: CWE-352 Description: A flaw was found in Quay. Cross-site request forgery (CSRF) attacks force a user to perform unwanted actions in an application. During the pentest, it was detected that the config-editor page is vulnerable to CSRF. The config-editor page is used to configure the Quay instance. By coercing the victim’s browser into sending an attacker-controlled request from another domain, it is possible to reconfigure the Quay instance (including
sending an attacker-controlled request from another domain, it is possible to reconfigure the Quay instance (including adding users with admin privileges). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-4959 - https://bugzilla.redhat.com/show_bug.cgi?id=2238908
CVE ID: CVE-2023-4960 State: PUBLISHED Published: 2024-01-11T08:33:09.984Z Last Updated: 2025-06-03T14:08:18.557Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wclovers Products: WCFM Marketplace – Best Multivendor Marketplace for WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcfm_stores' shortcode in versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with co
sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f99e9f01-cc98-4af5-bb95-f56f6a550e96?source=cve - https://plugins.trac.wordpress.org/browser/wc-multivendor-marketplace/tags/3.6.1/views/store-lists/wcfmmp-view-store-lists.php#L207 - https://plugins.trac.wordpress.org/browser/wc-multivendor-marketplace/tags/3.6.1/core/class-wcfmmp-shortcode
.php#L207 - https://plugins.trac.wordpress.org/browser/wc-multivendor-marketplace/tags/3.6.1/core/class-wcfmmp-shortcode.php#L241 - https://plugins.trac.wordpress.org/changeset/3000763/wc-multivendor-marketplace#file999
CVE ID: CVE-2023-4961 State: PUBLISHED Published: 2023-10-20T07:29:21.548Z Last Updated: 2025-02-05T19:06:34.113Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: galdub Products: Pop ups, WordPress Exit Intent Popup, Email Pop Up, Lightbox Pop Up, Spin the Wheel, Contact Form Builder – Poptin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Poptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'poptin-form' shortcode in versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl
uding, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/778af777-4c98-45cd-9704-1bdc96054aa7?source=cve - https://plugins.trac.wordpress.org/browser/poptin/tags/1.3/poptin.php#L659 - https://plugins.trac.wordpress.org/changeset/2968210/poptin#file2
CVE ID: CVE-2023-4962 State: PUBLISHED Published: 2024-01-11T08:32:36.644Z Last Updated: 2025-06-17T21:09:12.682Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: alobaidi Products: Video PopUp Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Video PopUp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'video_popup' shortcode in versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary
tes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/670ea03e-2f76-48a4-9f40-bc4cfd987a89?source=cve - https://plugins.trac.wordpress.org/browser/video-popup/trunk/features/shortcode.php?rev=2928708#L144 - https://plugins.trac.wordpress.org/changeset/3004434/video-popup
CVE ID: CVE-2023-4963 State: PUBLISHED Published: 2023-09-15T02:44:54.273Z Last Updated: 2025-02-05T19:28:13.115Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: webshouter Products: WS Facebook Like Box Widget Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WS Facebook Like Box Widget for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ws-facebook-likebox' shortcode in versions up to, and including, 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contr
itization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8bebc229-9d15-439f-a8df-f68455bc5193?source=cve - https://plugins.trac.wordpress.org/browser/ws-facebook-likebox/trunk/includes/shortcodes.php#L22