Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-5631 State: PUBLISHED Published: 2023-10-18T14:51:18.443Z Last Updated: 2025-10-21T23:05:34.074Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Roundcube Products: Roundcubemail Problem Types: CWE-79 Description: Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb70
tainer: - CISA ADP Vulnrichment: References: - https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613 - https://github.com/roundcube/roundcubemail/releases/tag/1.6.4 - https://github.com/roundcube/roundcubemail/releases/tag/1.5.5 - https://github.com/roundcube/roundcubemail/releases/tag/1.4.15 - https://github.com/roundcube/roundcubemail/issues/9168 - https://roundcube.net/news/2023/10/16/security-update-1.6.4-released - https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d - https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079 - https://www.
/2023/10/16/security-updates-1.5.5-and-1.4.15 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079 - https://www.debian.org/security/2023/dsa-5531 - https://lists.debian.org/debian-lts-announce/2023/10/msg00035.html - http://www.openwall.com/lists/oss-security/2023/11/01/1 - http://www.openwall.com/lists/oss-security/2023/11/01/3 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LK67Q46OIEGJCRQUBHKLH3IIJTBNGGX4/ - http://www.openwall.com/lists/oss-security/2023/11/17/2
CVE ID: CVE-2023-5632 State: PUBLISHED Published: 2023-10-18T08:34:34.788Z Last Updated: 2024-09-13T14:50:24.704Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Eclipse Products: Mosquitto Problem Types: CWE-834 Description: In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/eclipse/mosquitto/pull/
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/eclipse/mosquitto/pull/2053 - https://github.com/eclipse/mosquitto/commit/18bad1ff32435e523d7507e9b2ce0010124a8f2d
CVE ID: CVE-2023-5633 State: PUBLISHED Published: 2023-10-23T21:58:59.776Z Last Updated: 2025-11-06T20:51:23.307Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-416 Description: The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware g
flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:0113 - https://access.redhat.com/errata/RHSA-2024:0134 - https://access.redhat.com/errata/RHSA-2024:0461 - https://access.redhat.com/errata/RHSA-2024:1404 - https://access.redhat.com/errata/RHSA-2024:4823 - https://access.redhat.com/errata/RHSA-2024:4831 - https://access.redhat.com/security/cve/CVE-2023-5633 - https://bug
3 - https://access.redhat.com/errata/RHSA-2024:4831 - https://access.redhat.com/security/cve/CVE-2023-5633 - https://bugzilla.redhat.com/show_bug.cgi?id=2245663
CVE ID: CVE-2023-5634 State: PUBLISHED Published: 2023-12-01T13:19:13.935Z Last Updated: 2024-10-15T17:40:25.436Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ArslanSoft Products: Education Portal Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ArslanSoft Education Portal allows SQL Injection.This issue affects Education Portal: before v1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0670
CVE ID: CVE-2023-5635 State: PUBLISHED Published: 2023-12-01T13:29:44.356Z Last Updated: 2025-06-03T02:20:25.539Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ArslanSoft Products: Education Portal Problem Types: CWE-1320 Description: Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ArslanSoft Education Portal allows Account Footprinting.This issue affects Education Portal: before v1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0670
CVE ID: CVE-2023-5636 State: PUBLISHED Published: 2023-12-01T13:37:57.783Z Last Updated: 2024-08-02T08:07:32.341Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ArslanSoft Products: Education Portal Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Command Injection.This issue affects Education Portal: before v1.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-23-0670
CVE ID: CVE-2023-5637 State: PUBLISHED Published: 2023-12-01T13:33:41.505Z Last Updated: 2024-08-02T08:07:32.562Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ArslanSoft Products: Education Portal Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Read Sensitive Strings Within an Executable.This issue affects Education Portal: before v1.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.usom.gov.tr/bildirim/tr-23-0670
CVE ID: CVE-2023-5638 State: PUBLISHED Published: 2023-10-19T01:53:50.873Z Last Updated: 2025-02-05T19:12:33.958Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pluggabl Products: Booster for WooCommerce Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcj_image' shortcode in versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissio
user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f0257620-3a0e-4011-9378-7aa423e7c0b2?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/tags/7.1.3/includes/shortcodes/class-wcj-general-shortcodes.php#L1122 - https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/tags/7.1.3/includes/functions/wcj-functions-general.php#L1205 - https://plugins
ordpress.org/browser/woocommerce-jetpack/tags/7.1.3/includes/functions/wcj-functions-general.php#L1205 - https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/tags/7.1.2/includes/shortcodes/class-wcj-general-shortcodes.php#L1122
CVE ID: CVE-2023-5639 State: PUBLISHED Published: 2023-10-19T01:53:50.298Z Last Updated: 2025-02-05T19:12:46.138Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themepoints Products: Team Showcase Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tmfshortcode' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissi
n user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d3b26060-294e-4d4c-9295-0b08f533d5c4?source=cve - https://plugins.trac.wordpress.org/browser/team-showcase/trunk/team-manager-free.php?rev=2912143#L489 - https://plugins.trac.wordpress.org/browser/team-showcase/trunk/team-manager-free.php?rev=2912143#L893 - https://plugins.trac.wordpress.org/changeset/2980614/team-showcase
CVE ID: CVE-2023-5640 State: PUBLISHED Published: 2023-11-20T18:55:11.955Z Last Updated: 2024-08-02T08:07:32.473Z Vendors: Unknown Products: Article analytics Problem Types: CWE-89 SQL Injection Description: The Article Analytics WordPress plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9a383ef5-0f1a-4894-8f78-845abcb5062d - https://devl00p.github.io/posts/Injection-SQL-dans-le-plugin-Wordpress-Article-Analytics/
CVE ID: CVE-2023-5641 State: PUBLISHED Published: 2023-11-27T16:22:06.585Z Last Updated: 2024-08-02T08:07:32.511Z Vendors: Unknown Products: Martins Free & Easy SEO BackLink Link Building Network Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Martins Free & Easy SEO BackLink Link Building Network WordPress plugin before 1.2.30 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c0a6c253-71f2-415d-a6ec-022f2eafc13b
CVE ID: CVE-2023-5642 State: PUBLISHED Published: 2023-10-18T15:04:29.588Z Last Updated: 2024-09-13T15:15:44.553Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Advantech Products: R-SeeNet Problem Types: CWE-200 Description: Advantech R-SeeNet v2.4.23 allows an unauthenticated remote attacker to read from and write to the snmpmon.ini file, which contains sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tenable.com/security/research/tra-2023-33
CVE ID: CVE-2023-5643 State: PUBLISHED Published: 2024-02-05T09:49:33.885Z Last Updated: 2025-05-15T19:47:27.586Z Vendors: Arm Ltd Products: Bifrost GPU Kernel Driver, Valhall GPU Kernel Driver, Arm 5th Gen GPU Architecture Kernel Driver Problem Types: CWE-787 Description: Out-of-bounds Write vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. Depending on the configuration of the Mali GPU Kernel Driver, and if the system’s memory is carefully prepared by the user, then this in turn could write to memory outside of buffer
and if the system’s memory is carefully prepared by the user, then this in turn could write to memory outside of buffer bounds.This issue affects Bifrost GPU Kernel Driver: from r41p0 through r45p0; Valhall GPU Kernel Driver: from r41p0 through r45p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r45p0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
CVE ID: CVE-2023-5644 State: PUBLISHED Published: 2023-12-26T18:33:08.615Z Last Updated: 2024-09-25T20:22:12.674Z Vendors: Unknown Products: WP Mail Log Problem Types: CWE-863 Incorrect Authorization Description: The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/08f1d623-0453-4103-a9aa-2d0ddb6eb69e
CVE ID: CVE-2023-5645 State: PUBLISHED Published: 2023-12-26T18:33:05.509Z Last Updated: 2024-08-02T08:07:32.639Z Vendors: Unknown Products: WP Mail Log Problem Types: CWE-89 SQL Injection Description: The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e392fb53-66e9-4c43-9e4f-f4ea7c561551
CVE ID: CVE-2023-5646 State: REJECTED Published: 2023-10-20T01:51:33.830Z Last Updated: 2024-01-23T22:28:26.243Z Description: No description available.
CVE ID: CVE-2023-5647 State: REJECTED Published: 2023-10-20T01:51:34.384Z Last Updated: 2024-01-23T22:29:39.643Z Description: No description available.
CVE ID: CVE-2023-5650 State: PUBLISHED Published: 2023-11-28T01:53:43.502Z Last Updated: 2024-08-02T08:07:32.465Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Zyxel Products: ATP series firmware, USG FLEX series firmware, USG FLEX 50(W) series firmware, USG20(W)-VPN series firmware, VPN series firmware Problem Types: CWE-269 Description: An improper privilege management vulnerability in the ZySH of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4
versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37, could allow an authenticated local attacker to modify the URL of the registration page in the web GUI of an affected device. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-aps
CVE ID: CVE-2023-5651 State: PUBLISHED Published: 2023-11-20T18:55:08.790Z Last Updated: 2024-10-01T14:31:01.633Z Vendors: Unknown Products: WP Hotel Booking Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing any authenticated users, such as subscriber to delete arbitrary posts Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a365c050-96ae-4266-aa87-850ee259ee2c
CVE ID: CVE-2023-5652 State: PUBLISHED Published: 2023-11-20T18:55:06.152Z Last Updated: 2024-08-02T08:07:32.460Z Vendors: Unknown Products: WP Hotel Booking Problem Types: CWE-89 SQL Injection Description: The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a function hooked to admin_init, allowing unauthenticated users to perform SQL injections Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8ea46b9a-5239-476b-949d-49546371eac1
CVE ID: CVE-2023-5653 State: PUBLISHED Published: 2023-11-27T16:22:01.293Z Last Updated: 2024-08-02T08:07:32.554Z Vendors: Unknown Products: WassUp Real Time Analytics Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WassUp Real Time Analytics WordPress plugin through 1.9.4.5 does not escape IP address provided via some headers before outputting them back in an admin page, allowing unauthenticated users to perform Stored XSS attacks against logged in admins Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/76316621-1987-44ea-83e5-6ca884bdd1c0
CVE ID: CVE-2023-5654 State: PUBLISHED Published: 2023-10-19T14:28:23.769Z Last Updated: 2024-09-12T14:35:37.964Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Meta Products: React Developer Tools Extension Problem Types: CWE-285 Description: The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL’s vi
URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL’s via the victim's browser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/CalumHutton/1fb89b64409570a43f89d1fd3274b231
CVE ID: CVE-2023-5655 State: REJECTED Published: 2023-10-20T01:51:34.822Z Last Updated: 2024-01-23T22:31:10.923Z Description: No description available.
CVE ID: CVE-2023-5656 State: REJECTED Published: 2023-10-20T07:29:25.188Z Last Updated: 2024-01-23T22:32:20.323Z Description: No description available.
CVE ID: CVE-2023-5658 State: PUBLISHED Published: 2023-11-07T11:01:44.546Z Last Updated: 2025-02-05T18:51:07.293Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: phpwebdev Products: WP MapIt Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP MapIt plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_mapit' shortcode in all versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject
d attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7ef6f598-e1a7-4036-9485-1aad0416349a?source=cve - https://plugins.trac.wordpress.org/browser/wp-mapit/tags/2.7.1/wp_mapit/classes/class.wp_mapit_map.php#L235
CVE ID: CVE-2023-5659 State: PUBLISHED Published: 2023-11-07T11:31:06.961Z Last Updated: 2025-02-05T18:50:20.709Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: tryinteract Products: Interact: Embed A Quiz On Your Site Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Interact: Embed A Quiz On Your Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'interact-quiz' shortcode in all versions up to, and including, 3.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated atta
icient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/69ba1a39-ddb0-4661-8104-d8bb71710e0c?source=cve - https://plugins.trac.wordpress.org/browser/interact-quiz-embed/tags/3.0.7/interact-quiz-embed.php#L53
CVE ID: CVE-2023-5660 State: PUBLISHED Published: 2023-11-07T11:31:09.310Z Last Updated: 2025-02-05T18:48:57.158Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: brewlabs Products: SendPress Newsletters Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The SendPress Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.22.3.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above p
aping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cbce42a0-29a7-40df-973c-1fe7338f6c94?source=cve - https://plugins.trac.wordpress.org/browser/sendpress/tags/1.22.3.31/classes/sc/class-sendpress-sc-unsubscribe-form.php#L57
CVE ID: CVE-2023-5661 State: PUBLISHED Published: 2023-11-07T11:31:07.891Z Last Updated: 2025-02-05T18:49:58.583Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: umarbajwa Products: Social Feed | All social media in one place Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Social Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialfeed' shortcode in all versions up to, and including, 1.5.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with author-l
zation and output escaping on user supplied attributes. This makes it possible for authenticated attackers with author-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8b145772-624e-4af0-9156-03c483bf8381?source=cve - https://plugins.trac.wordpress.org/browser/add-facebook/tags/1.5.4.6/public/templates/default/template.php#L417
CVE ID: CVE-2023-5662 State: PUBLISHED Published: 2023-11-22T15:33:23.830Z Last Updated: 2024-11-20T18:51:25.157Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ibenic Products: Sponsors Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Sponsors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sponsors' shortcode in all versions up to, and including, 3.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arb