Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rs orders. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c0d8ac01-ac73-47ea-839b-edc820436f27?source=cve - https://plugins.trac.wordpress.org/browser/easy-appointments/trunk/src/ajax.php#L380 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3059359%40easy-appointments&new=3059359%40easy-appointments&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2845 State: PUBLISHED Published: 2024-04-09T18:58:40.543Z Last Updated: 2024-08-01T19:25:42.134Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer for Elementor & Gutenberg Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and incl
for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2d113191-b550-4752-b536-644206ab56c1?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=30579
52-b536-644206ab56c1?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3057976%40betterdocs%2Ftrunk&old=3055881%40betterdocs%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2846 State: PUBLISHED Published: 2024-05-09T20:03:36.275Z Last Updated: 2024-08-01T19:25:42.148Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: upwerd Products: Visual Footer Credit Remover Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Visual Footer Credit Remover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'selector' parameter in all versions up to, and including, 2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web s
escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9fcb65a0-4218-4728-9c29-0d1a03f438a6?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3081401%40visual-footer-credit-remover&new=3081401%40visual-footer-credit-remover&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2847 State: PUBLISHED Published: 2024-04-09T18:59:09.848Z Last Updated: 2024-08-01T19:25:42.100Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: nickboss Products: WordPress File Upload Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The WordPress File Upload plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.24.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to
ser supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9f665099-d1c3-43a9-b37b-c9f42c9172ad?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3060091%40wp-file-upload%2Ftrunk&old=3045068%40wp-file-upload%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2848 State: PUBLISHED Published: 2024-03-29T11:02:02.771Z Last Updated: 2025-02-13T17:47:28.745Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: cyberchimps Products: Responsive Problem Types: CWE-862 Missing Authorization Description: The Responsive theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_footer_text_callback function in all versions up to, and including, 5.0.2. This makes it possible for unauthenticated attackers to inject arbitrary HTML content into the site's footer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://
to the site's footer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dbe0cc57-a17d-4f91-887f-fe819b32f6b3?source=cve - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=222494%40responsive&new=222494%40responsive&sfp_email=&sfph_mail= - http://www.openwall.com/lists/oss-security/2024/04/22/1
CVE ID: CVE-2024-2849 State: PUBLISHED Published: 2024-03-23T17:31:04.908Z Last Updated: 2024-08-23T16:19:10.508Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Simple File Manager Problem Types: CWE-434 Description: A vulnerability classified as critical was found in SourceCodester Simple File Manager 1.0. This vulnerability affects unknown code. The manipulation of the argument photo leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257770 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refer
tifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257770 - https://vuldb.com/?ctiid.257770 - https://vuldb.com/?submit.303123 - https://github.com/CveSecLook/cve/issues/1
CVE ID: CVE-2024-2850 State: PUBLISHED Published: 2024-03-24T02:00:06.578Z Last Updated: 2024-08-01T19:25:42.127Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC15 Problem Types: CWE-121 Description: A vulnerability was found in Tenda AC15 15.03.05.18 and classified as critical. Affected by this issue is the function saveParentControlInfo of the file /goform/saveParentControlInfo. The manipulation of the argument urls leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257774 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this di
be used. VDB-257774 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257774 - https://vuldb.com/?ctiid.257774 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V15.03.05.18/saveParentControlInfo_urls.md
CVE ID: CVE-2024-2851 State: PUBLISHED Published: 2024-03-24T03:00:06.055Z Last Updated: 2024-08-22T19:16:03.727Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tenda Products: AC15 Problem Types: CWE-78 Description: A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20_multi. It has been classified as critical. This affects the function formSetSambaConf of the file /goform/setsambacfg. The manipulation of the argument usbName leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257775. NOTE: The vendor was contacted early about t
may be used. The associated identifier of this vulnerability is VDB-257775. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257775 - https://vuldb.com/?ctiid.257775 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V15.03.05.18/formSetSambaConf.md
CVE ID: CVE-2024-2852 State: PUBLISHED Published: 2024-03-24T04:31:04.363Z Last Updated: 2024-08-01T19:25:42.173Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC15 Problem Types: CWE-121 Description: A vulnerability was found in Tenda AC15 15.03.20_multi. It has been declared as critical. This vulnerability affects the function saveParentControlInfo of the file /goform/saveParentControlInfo. The manipulation of the argument urls leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257776. NOTE: The vendor was contacted early about this
lic and may be used. The identifier of this vulnerability is VDB-257776. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257776 - https://vuldb.com/?ctiid.257776 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/saveParentControlInfo_urls.md
CVE ID: CVE-2024-2853 State: PUBLISHED Published: 2024-03-24T05:00:06.892Z Last Updated: 2024-08-01T19:25:42.158Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tenda Products: AC10U Problem Types: CWE-78 Description: A vulnerability was found in Tenda AC10U 15.03.06.48/15.03.06.49. It has been rated as critical. This issue affects the function formSetSambaConf of the file /goform/setsambacfg. The manipulation of the argument usbName leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257777 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclos
d. The identifier VDB-257777 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257777 - https://vuldb.com/?ctiid.257777 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10U/v1.V15.03.06.48/more/formSetSambaConf.md
CVE ID: CVE-2024-2854 State: PUBLISHED Published: 2024-03-24T05:31:04.168Z Last Updated: 2024-08-12T18:05:25.479Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tenda Products: AC18 Problem Types: CWE-78 Description: A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formSetSambaConf of the file /goform/setsambacfg. The manipulation of the argument usbName leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257778 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not r
the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257778 - https://vuldb.com/?ctiid.257778 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/formSetSambaConf.md
CVE ID: CVE-2024-2855 State: PUBLISHED Published: 2024-03-24T06:00:06.171Z Last Updated: 2024-08-01T19:25:42.153Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC15 Problem Types: CWE-121 Description: A vulnerability classified as critical was found in Tenda AC15 15.03.05.18/15.03.05.19/15.03.20. Affected by this vulnerability is the function fromSetSysTime of the file /goform/SetSysTimeCfg. The manipulation of the argument time leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257779. NOTE: The vendor was contacted early a
c and may be used. The associated identifier of this vulnerability is VDB-257779. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.257779 - https://vuldb.com/?ctiid.257779 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/fromSetSysTime.md
CVE ID: CVE-2024-2856 State: PUBLISHED Published: 2024-03-24T06:31:04.241Z Last Updated: 2024-08-21T15:03:56.980Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC10 Problem Types: CWE-121 Description: A vulnerability, which was classified as critical, has been found in Tenda AC10 16.03.10.13/16.03.10.20. Affected by this issue is the function fromSetSysTime of the file /goform/SetSysTimeCfg. The manipulation of the argument timeZone leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257780. NOTE: The vendor was contacted early about th
ublic and may be used. The identifier of this vulnerability is VDB-257780. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257780 - https://vuldb.com/?ctiid.257780 - https://vuldb.com/?submit.299741 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10/V16.03.10.13/fromSetSysTime.md
CVE ID: CVE-2024-2857 State: PUBLISHED Published: 2024-04-15T05:00:05.871Z Last Updated: 2024-08-09T18:43:11.239Z Vendors: Unknown Products: Simple Buttons Creator Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Simple Buttons Creator WordPress plugin through 1.04 does not have any authorisation as well as CSRF in its add button function, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins. Additional Analyst Notes: - CVE Program Container: - CISA AD
ored Cross-Site Scripting attacks against logged in admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b7a35c5b-474a-444a-85ee-c50782c7a6c2/
CVE ID: CVE-2024-2858 State: PUBLISHED Published: 2024-04-15T05:00:06.077Z Last Updated: 2024-08-01T19:25:42.166Z Vendors: Unknown Products: Simple Buttons Creator Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Simple Buttons Creator WordPress plugin through 1.04 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/43297210-17a6-4b51-b8ca-32ceef9fc09a/
CVE ID: CVE-2024-2859 State: PUBLISHED Published: 2024-04-27T00:06:10.084Z Last Updated: 2025-03-19T18:23:52.688Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Brocade Products: Brocade SANnav Description: By default, SANnav OVA is shipped with root user login enabled. While protected by a password, access to root could expose SANnav to a remote attacker should they gain access to the root account. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/23245 - https://security.netapp.com/advisory/ntap-20240628-0003/
CVE ID: CVE-2024-2860 State: PUBLISHED Published: 2024-05-08T01:01:54.775Z Last Updated: 2024-08-01T19:25:42.147Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Brocade Products: Brocade SAnnav Problem Types: CWE-306 Description: The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw. An attacker accessing the VM where the Brocade SANnav is installed can gain access to sensitive data inside the PostgreSQL database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/S
Program Container: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24260
CVE ID: CVE-2024-2861 State: PUBLISHED Published: 2024-05-23T09:32:32.877Z Last Updated: 2024-08-01T19:25:42.168Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: collizo4sky Products: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ProfilePress User Panel widget in all versions up to, and including, 4.15.8 due to insufficient input sanitization and output escaping on user supplied a
all versions up to, and including, 4.15.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/487731cd-da5a-45b6-8f39-4ae6420dd252?source=cve - https://plugins.trac.wordpress.org/changeset/3090831/wp-user-avatar
CVE ID: CVE-2024-2862 State: PUBLISHED Published: 2024-03-25T06:31:34.651Z Last Updated: 2024-08-28T13:44:03.431Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: LG Electronics Products: LG LED Assistant Problem Types: CWE-287 Description: This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lgsecurity.lge.com/bulletins/idproducts#updateDetails
CVE ID: CVE-2024-2863 State: PUBLISHED Published: 2024-03-25T06:39:46.717Z Last Updated: 2024-08-01T19:25:42.156Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: LG Electronics Products: LG LED Assistant Problem Types: CWE-35 Description: This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lgsecurity.lge.com/bulletins/idproducts#updateDetails
CVE ID: CVE-2024-2864 State: PUBLISHED Published: 2024-03-25T10:51:19.470Z Last Updated: 2024-08-01T19:25:42.153Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: KaineLabs Products: Youzify - Buddypress Moderation Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaineLabs Youzify - Buddypress Moderation.This issue affects Youzify - Buddypress Moderation: from n/a through 1.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/youzify-moderation/wordpress-youzify-buddypress-moderation-plug
erences: - https://patchstack.com/database/vulnerability/youzify-moderation/wordpress-youzify-buddypress-moderation-plugin-2-0-0-unauthenticated-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-2865 State: PUBLISHED Published: 2024-03-25T13:22:23.993Z Last Updated: 2024-08-01T19:25:42.124Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Mergen Software Products: Quality Management System Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mergen Software Quality Management System allows SQL Injection.This issue affects Quality Management System: through 25032024. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-24-0229
CVE ID: CVE-2024-2866 State: REJECTED Published: 2024-04-09T18:59:35.738Z Last Updated: 2024-04-11T15:23:48.398Z Description: No description available.
CVE ID: CVE-2024-2867 State: PUBLISHED Published: 2024-05-02T16:52:04.809Z Last Updated: 2024-08-01T19:25:42.141Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: collizo4sky Products: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Problem Types: CWE-20 Improper Input Validation Description: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 4.15.4 due to insufficient input sanitization and o
ting via the ‘title’ parameter in all versions up to, and including, 4.15.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4eb296af-547a-44aa-b804-833204b75256?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3061186%40wp-user-avatar%2Ftrunk&old=3053353%40wp-user-avatar%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2868 State: PUBLISHED Published: 2024-04-04T01:56:45.161Z Last Updated: 2025-08-27T21:02:57.711Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: devitemsllc Products: ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slitems parameter in the WL Special Day Offer Widget in all ver