Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-24871 State: PUBLISHED Published: 2021-12-13T10:41:15 Last Updated: 2024-08-03T19:49:12.639Z Vendors: Unknown Products: Get Custom Field Values Problem Types: CWE-79 Description: The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/28007c80-dc14-4987-a52c-f2a05cfe5905
CVE ID: CVE-2021-24872 State: PUBLISHED Published: 2021-12-13T10:41:16 Last Updated: 2024-08-03T19:49:14.018Z Vendors: Unknown Products: Get Custom Field Values Problem Types: CWE-863 Description: The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ec23734a-5ea7-4e46-aba9-3dee4e6dffb6
CVE ID: CVE-2021-24873 State: PUBLISHED Published: 2021-11-23T19:16:14 Last Updated: 2024-08-03T19:49:13.471Z Vendors: Unknown Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-79 Description: The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/19980b57-1954-4a29-b2c2-43eadf758ed3 - https://plugins.trac.wordpress.org/changeset/2615802/tutor
CVE ID: CVE-2021-24874 State: PUBLISHED Published: 2022-02-14T09:20:36 Last Updated: 2024-08-03T19:49:14.383Z Vendors: Unknown Products: Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue Problem Types: CWE-79 Description: The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/28d34cc1-2294-4409-a60f-c8c441eb3f2d
CVE ID: CVE-2021-24875 State: PUBLISHED Published: 2021-11-23T19:16:16 Last Updated: 2024-08-03T19:49:12.695Z Vendors: Unknown Products: eCommerce Product Catalog Plugin for WordPress Problem Types: CWE-79 Description: The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting it back in the page in an attribute, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/652efc4a-f931-4668-ae74-a58b288a5715
CVE ID: CVE-2021-24876 State: PUBLISHED Published: 2021-11-29T08:25:43 Last Updated: 2024-08-03T19:49:13.511Z Vendors: Unknown Products: Registrations for the Events Calendar – Event Registration Plugin Problem Types: CWE-79 Description: The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e77c2493-993d-418d-9629-a1f07b5a2b6f
CVE ID: CVE-2021-24877 State: PUBLISHED Published: 2021-11-23T19:16:17 Last Updated: 2024-08-03T19:49:12.677Z Vendors: Unknown Products: MainWP Child - Securely connects sites to the MainWP WordPress Manager Dashboard Problem Types: CWE-89 Description: The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b09fe120-ab9b-44f2-b50d-3b4b299d6d15
CVE ID: CVE-2021-24878 State: PUBLISHED Published: 2022-02-07T15:47:10 Last Updated: 2024-08-03T19:49:12.683Z Vendors: Unknown Products: SupportCandy – Helpdesk & Support Ticket System Problem Types: CWE-79 Description: The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embed, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d2f1fd60-5e5e-4e38-9559-ba2d14ae37bf
CVE ID: CVE-2021-24879 State: PUBLISHED Published: 2022-02-07T15:47:11 Last Updated: 2024-08-03T19:49:13.940Z Vendors: Unknown Products: SupportCandy – Helpdesk & Support Ticket System Problem Types: CWE-352 Description: The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter (stored in their cookies) with an XSS payload in it. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6dfb4f61-c8cb-40ad-812f-139482be0fb4
CVE ID: CVE-2021-24880 State: PUBLISHED Published: 2022-02-07T15:47:12 Last Updated: 2024-08-03T19:49:13.465Z Vendors: Unknown Products: SupportCandy – Helpdesk & Support Ticket System Problem Types: CWE-79 Description: The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/09226067-0289-4d4f-9450-6f2c2ba058a0
CVE ID: CVE-2021-24881 State: PUBLISHED Published: 2023-01-23T14:31:29.900Z Last Updated: 2025-04-02T15:23:05.707Z Vendors: Unknown Products: Passster Problem Types: CWE-287 Improper Authentication Description: The Passster WordPress plugin before 3.5.5.9 does not properly check for password, as well as that the post to be viewed is public, allowing unauthenticated users to bypass the protection offered by the plugin, and access arbitrary posts (such as private) content, by sending a specifically crafted request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0967303d-ea49-4993-84eb-a7ec97240071
CVE ID: CVE-2021-24882 State: PUBLISHED Published: 2021-11-23T19:16:19 Last Updated: 2024-08-03T19:49:13.943Z Vendors: Unknown Products: Slideshow Gallery Problem Types: CWE-79 Description: The Slideshow Gallery WordPress plugin before 1.7.4 does not sanitise and escape the Slide "Title", "Description", and Gallery "Title" fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6d71816c-8267-4b84-9087-191fbb976e72
CVE ID: CVE-2021-24883 State: PUBLISHED Published: 2021-11-29T08:25:44 Last Updated: 2024-08-03T19:49:12.675Z Vendors: Unknown Products: Popup Anything – A Marketing Popup Problem Types: CWE-79 Description: The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c5dd3812-ea20-4e05-a5d3-84830b452822 - https://www.fortiguard.com/zeroday/FG-VD-21-069 - https://plugins.trac.wordpress.org/changeset/2610975
CVE ID: CVE-2021-24884 State: PUBLISHED Published: 2021-10-25T13:20:59 Last Updated: 2024-08-03T19:49:14.206Z Vendors: Unknown Products: Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress Problem Types: CWE-79 Description: The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio>,<video>,<img>,<a> and<button>.This could allow an unauthenticated, remote attacker to exploit a HTML-injection byinjecting a malicous link. The HTML-injection may trick authenticated users to follow the link. If the Link gets clicked, Javascript code can be executed. The vulnerability is due to insufficient sanitization of the "data-frmv
k gets clicked, Javascript code can be executed. The vulnerability is due to insufficient sanitization of the "data-frmverify" tag for links in the web-based entry inspection page of affected systems. A successful exploitation incomibantion with CSRF could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. These actions include stealing the users account by changing their password or allowing attackers to submit their own code through an authenticated user resulting in Remote Code Execution. If an authenticated user who is able to edit Wordpress PHP Code in any kind, clicks the malicious link, PHP code can be edited. Additional Analyst Note
able to edit Wordpress PHP Code in any kind, clicks the malicious link, PHP code can be edited. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b57dacdd-43c2-48f8-ac1e-eb8306b22533 - https://github.com/Strategy11/formidable-forms/pull/335/files - https://github.com/S1lkys/XSS-in-Formidable-4.09.04/blob/main/XSS-in-Formidable-4.09.04.pdf
CVE ID: CVE-2021-24885 State: PUBLISHED Published: 2021-10-25T13:21:01 Last Updated: 2024-08-03T19:49:12.695Z Vendors: Unknown Products: YOP Poll Problem Types: CWE-79 Description: The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d0b312f8-8b16-45be-b5e5-bf9d4b3e9b1e - https://plugins.trac.wordpress.org/changeset/2227747/
CVE ID: CVE-2021-24888 State: PUBLISHED Published: 2021-11-23T19:16:20 Last Updated: 2024-08-03T19:49:13.475Z Vendors: Unknown Products: ImageBoss – Images Up To 60% Smaller & CDN Problem Types: CWE-79 Description: The ImageBoss WordPress plugin before 3.0.6 does not sanitise and escape its Source Name setting, which could allow high privilege users to perform Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/19bffa71-705c-42fc-b2ca-bf62fabb70a0
CVE ID: CVE-2021-24889 State: PUBLISHED Published: 2021-11-29T08:25:45 Last Updated: 2024-08-03T19:49:13.490Z Vendors: Unknown Products: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress Problem Types: CWE-89 Description: The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/55008a42-eb56-436c-bce0-10ee616d0495
CVE ID: CVE-2021-24890 State: PUBLISHED Published: 2022-09-26T12:35:29.000Z Last Updated: 2025-05-21T19:27:31.158Z Vendors: Unknown Products: scripts-organizer Problem Types: CWE-862, CWE-352 Description: The Scripts Organizer WordPress plugin before 3.0 does not have capability and CSRF checks in the saveScript AJAX action, available to both unauthenticated and authenticated users, and does not validate user input in any way, which could allow unauthenticated users to put arbitrary PHP code in a file Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f3b450d2-84ce-4c13-ad6a-b60785dee7e7 - https://dplugins.com/products/s
t: References: - https://wpscan.com/vulnerability/f3b450d2-84ce-4c13-ad6a-b60785dee7e7 - https://dplugins.com/products/scripts-organizer/
CVE ID: CVE-2021-24891 State: PUBLISHED Published: 2021-11-23T19:16:21 Last Updated: 2024-08-03T19:49:14.369Z Vendors: Unknown Products: Elementor Website Builder Problem Types: CWE-79 Description: The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://www.jbelamor.com/xss-elementor-lightox.html - https://wpscan.com/vulnerability/fbed0daa-007d-4f91-8d87-4bca7781de2d
CVE ID: CVE-2021-24892 State: PUBLISHED Published: 2021-11-23T19:16:23 Last Updated: 2024-08-03T19:49:13.470Z Vendors: TODO Products: Advanced Forms Ppro, Advanced Forms Problem Types: CWE-639 Description: Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's email address and request for reset password, which could lead to take over of WordPress's administrator account. To exploit this vulnerability, an attacker must register to obtain a valid WordPress's user and use such user to authenticate with WordPress in order to exploit the vulnerable edit function. Additional Analyst Notes: - CVE
ch user to authenticate with WordPress in order to exploit the vulnerable edit function. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/364b0843-a990-4204-848a-60c928cc5bc0 - https://github.com/advancedforms/advanced-forms/commit/2ce3ab6985c3a909eefb01c562995bc6a994d3a2
CVE ID: CVE-2021-24893 State: PUBLISHED Published: 2022-01-03T12:49:06 Last Updated: 2024-08-03T19:49:14.012Z Vendors: Unknown Products: Stars Rating Problem Types: CWE-400 Description: The Stars Rating WordPress plugin before 3.5.1 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the comments section, or pending comment dashboard depending if the user sent it as unauthenticated or authenticated. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/05d3af69-20b4-499a-8322-2b53674d6a58
CVE ID: CVE-2021-24894 State: PUBLISHED Published: 2021-11-23T19:16:24 Last Updated: 2024-08-03T19:49:14.027Z Vendors: Unknown Products: Reviews Plus Problem Types: CWE-191 Description: The Reviews Plus WordPress plugin before 1.2.14 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated user submit such rating and the reviews are set to be displayed on the post/page Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/79bb5acb-ea56-41a9-83a1-28a181ae41e2 - https://plugins.trac.wordpress.org/changeset/2618234
CVE ID: CVE-2021-24895 State: PUBLISHED Published: 2022-03-14T14:40:56 Last Updated: 2024-08-03T19:49:13.896Z Vendors: Unknown Products: Cybersoldier Problem Types: CWE-79 Description: The Cybersoldier WordPress plugin before 1.7.0 does not sanitise and escape the URL settings before outputting it in an attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/be7bbf4f-6f6a-4a44-bf86-2f096351ae08
CVE ID: CVE-2021-24896 State: PUBLISHED Published: 2021-12-13T10:41:18 Last Updated: 2024-08-03T19:49:13.968Z Vendors: Unknown Products: Caldera Forms – More Than Contact Forms Problem Types: CWE-79 Description: The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2c469e8b-c761-460b-b31d-9219a43006ff
CVE ID: CVE-2021-24897 State: PUBLISHED Published: 2022-03-14T14:40:58 Last Updated: 2024-08-03T19:49:13.999Z Vendors: Unknown Products: Add Subtitle Problem Types: CWE-79 Description: The Add Subtitle WordPress plugin through 1.1.0 does not sanitise or escape the sub-title field (available only with classic editor) when output in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a0dd1da8-f8d2-453d-a2f2-711a49fb6466
CVE ID: CVE-2021-24898 State: PUBLISHED Published: 2022-02-28T09:06:15 Last Updated: 2024-08-03T19:49:14.027Z Vendors: Unknown Products: Editable Table Simple Fast FrontEnd From Sql tables Problem Types: CWE-79 Description: The EditableTable WordPress plugin through 0.1.4 does not sanitise and escape any of the Table and Column fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/10fdc464-0ddc-4919-8f21-969fff854011
CVE ID: CVE-2021-24899 State: PUBLISHED Published: 2021-11-29T08:25:47 Last Updated: 2024-08-03T19:49:13.962Z Vendors: Unknown Products: Media Tags Problem Types: CWE-79 Description: The Media-Tags WordPress plugin through 3.2.0.2 does not sanitise and escape any of its Labels settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_htnl capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/cf4b266c-d68e-4add-892a-d01a31987a4b
CVE ID: CVE-2021-24900 State: PUBLISHED Published: 2022-02-01T12:21:28 Last Updated: 2024-08-03T19:49:14.011Z Vendors: Unknown Products: Ninja Tables – Best WP DataTables Plugin for WordPress Problem Types: CWE-79 Description: The Ninja Tables WordPress plugin before 4.1.8 does not sanitise and escape some of its table fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/213d7c08-a37c-49d0-a072-24db711da5ec - https://packetstormsecurity.com/files/164632/
CVE ID: CVE-2021-24901 State: PUBLISHED Published: 2022-02-28T09:06:17 Last Updated: 2024-08-03T19:49:13.923Z Vendors: Unknown Products: Security Audit Problem Types: CWE-79 Description: The Security Audit WordPress plugin through 1.0.0 does not sanitise and escape the Data Id setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9c315404-b66a-448c-a3b7-367a37b53435
CVE ID: CVE-2021-24902 State: PUBLISHED Published: 2021-12-27T10:33:20 Last Updated: 2024-08-03T19:49:13.867Z Vendors: Unknown Products: Typebot | Build beautiful conversational forms Problem Types: CWE-79 Description: The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2bde2030-2dfe-4dd3-afc1-36f7031a91ea
CVE ID: CVE-2021-24903 State: PUBLISHED Published: 2022-02-28T09:06:18 Last Updated: 2024-08-03T19:49:13.972Z Vendors: Unknown Products: Album and Image Gallery with Lightbox – Flagallery Photo Portfolio Problem Types: CWE-79 Description: The GRAND FlaGallery WordPress plugin through 6.1.2 does not sanitise and escape some of its gallery settings, which could allow high privilege users to perform Cross-Site scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ad67e45e-254a-46ce-a243-bfc86839446e
CVE ID: CVE-2021-24904 State: PUBLISHED Published: 2022-02-14T09:20:37 Last Updated: 2024-08-03T19:49:13.405Z Vendors: Unknown Products: Mortgage Calculators WP Problem Types: CWE-79 Description: The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a calculator, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7b80f89b-e724-41c5-aa03-21d1eef50f21
CVE ID: CVE-2021-24905 State: PUBLISHED Published: 2022-03-21T18:55:37 Last Updated: 2024-08-03T19:49:13.470Z Vendors: Unknown Products: Advanced Contact form 7 DB Problem Types: CWE-863 Description: The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX action, and does not validate the file to be deleted, allowing any authenticated user to delete arbitrary files on the web server. For example, removing the wp-config.php allows attackers to trigger WordPress setup again, gain administrator privileges and execute arbitrary code or display arbitrary content to the users. Additional Analyst Notes: - CVE
trator privileges and execute arbitrary code or display arbitrary content to the users. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/cf022415-6614-4b95-913b-802186766ae6
CVE ID: CVE-2021-24906 State: PUBLISHED Published: 2022-01-24T08:00:53 Last Updated: 2024-08-03T19:49:14.366Z Vendors: Unknown Products: Protect WP Admin Problem Types: CWE-862 Description: The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users to disable the plugin (and therefore the protection offered) via a crafted request Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4204682b-f657-42e1-941c-bee7a245e9fd
CVE ID: CVE-2021-24907 State: PUBLISHED Published: 2021-12-21T08:45:34 Last Updated: 2024-08-03T19:49:13.505Z Vendors: Unknown Products: Contact Form, Drag and Drop Form Builder for WordPress – Everest Forms Problem Types: CWE-79 Description: The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/56dae1ae-d5d2-45d3-8991-db69cc47ddb7
CVE ID: CVE-2021-24908 State: PUBLISHED Published: 2021-11-29T08:25:48 Last Updated: 2024-08-03T19:49:13.522Z Vendors: Unknown Products: Check & Log Email Problem Types: CWE-79 Description: The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/77f50129-4b1f-4e50-8321-9dd32deba6e1
CVE ID: CVE-2021-24909 State: PUBLISHED Published: 2022-01-17T13:00:28 Last Updated: 2024-08-03T19:49:12.686Z Vendors: Unknown Products: ACF Photo Gallery Field Problem Types: CWE-79 Description: The ACF Photo Gallery Field WordPress plugin before 1.7.5 does not sanitise and escape the post parameter in the includes/acf_photo_gallery_metabox_edit.php file before outputing back in an attribute, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5855f1fe-28f6-4cd6-a83c-95c23d809b79