Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-5314 State: PUBLISHED Published: 2025-07-01T11:27:12.335Z Last Updated: 2025-07-01T13:57:50.512Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: dearhive Products: Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer Problem Types: CWE-79 Description: The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the ‘pdf-source’ parameter in all versions up to, and including, 2.3.65 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that ex
d output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e316c636-2dd7-4d50-8c99-36f08ecf03ad?source=cve - https://plugins.trac.wordpress.org/browser/3d-flipbook-dflip-lite/trunk/assets/js/libs/pdf.min.js - https://plugins.trac.wordpress.org/browser/3d-flipbook-dflip-lite/trunk/assets/js/dflip.min.js - https://plugins.trac.wordpress.org/browser/3d-flipbook-dflip-lite/trunk/assets/js/dflip.js#L8861 - https://plugi
in.js - https://plugins.trac.wordpress.org/browser/3d-flipbook-dflip-lite/trunk/assets/js/dflip.js#L8861 - https://plugins.trac.wordpress.org/changeset/3319013/
CVE ID: CVE-2025-5315 State: PUBLISHED Published: 2025-06-26T05:31:15.850Z Last Updated: 2025-06-26T13:22:43.572Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-862 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users with Guest role permissions to add child items to incident work items by sending crafted API requests that bypassed UI-enforced role restrictions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/54628
ns. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/546282 - https://hackerone.com/reports/3163037
CVE ID: CVE-2025-5316 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:40.519Z Description: No description available.
CVE ID: CVE-2025-5317 State: PUBLISHED Published: 2025-11-11T08:02:22.504Z Last Updated: 2025-11-12T20:04:14.955Z Vendors: Bitdefender Products: Endpoint Security Tools for Mac Problem Types: CWE-862 Description: An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac (BEST) before 7.20.52.200087 allows local users with administrative privileges to bypass the configured uninstall password protection. An unauthorized user with sudo privileges can manually remove the application directory (/Applications/Endpoint Security for Mac.app/) and the related directories within /Library/Bitdefender/AVP without needing the uninstall password. Additional Analyst Notes: -
related directories within /Library/Bitdefender/AVP without needing the uninstall password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.bitdefender.com/support/security-advisories/improper-access-restriction-to-critical-folder-in-bitdefender-endpoint-security-tools-for-mac/
CVE ID: CVE-2025-5318 State: PUBLISHED Published: 2025-06-24T14:10:07.188Z Last Updated: 2025-11-20T21:27:25.305Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telec
tions Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Container Platform 4.19, Red Hat OpenShift Container Platform 4.20, Red Hat OpenShift distributed tracing 3.7.0 Problem Types: CW
Platform 4.19, Red Hat OpenShift Container Platform 4.20, Red Hat OpenShift distributed tracing 3.7.0 Problem Types: CWE-125 Description: A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.
information or affect service behavior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:18231 - https://access.redhat.com/errata/RHSA-2025:18275 - https://access.redhat.com/errata/RHSA-2025:18286 - https://access.redhat.com/errata/RHSA-2025:19012 - https://access.redhat.com/errata/RHSA-2025:19098 - https://access.redhat.com/errata/RHSA-2025:19101 - https://access.redhat.com/errata/RHSA-2025:19295 - https://access.redhat.com/errata/RHSA-2025:19300 - https://access.redhat.com/errata/RHSA-2025:19313 - https://access.redhat.com/errata/RHSA-2025:19400 - https://access.redhat.com/errata/RHSA-2025:19401 - https://access.redhat.com/errata/R
edhat.com/errata/RHSA-2025:19400 - https://access.redhat.com/errata/RHSA-2025:19401 - https://access.redhat.com/errata/RHSA-2025:19470 - https://access.redhat.com/errata/RHSA-2025:19472 - https://access.redhat.com/errata/RHSA-2025:19807 - https://access.redhat.com/errata/RHSA-2025:19864 - https://access.redhat.com/errata/RHSA-2025:20943 - https://access.redhat.com/errata/RHSA-2025:21013 - https://access.redhat.com/errata/RHSA-2025:21329 - https://access.redhat.com/security/cve/CVE-2025-5318 - https://bugzilla.redhat.com/show_bug.cgi?id=2369131 - https://www.libssh.org/security/advisories/CVE-2025-5318.txt
CVE ID: CVE-2025-5320 State: PUBLISHED Published: 2025-05-29T13:31:04.612Z Last Updated: 2025-06-01T04:39:35.844Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: gradio-app Products: gradio Problem Types: CWE-346, CWE-345 Description: A vulnerability classified as problematic has been found in gradio-app gradio up to 5.29.1. This affects the function is_valid_origin of the component CORS Handler. The manipulation of the argument localhost_aliases leads to erweiterte Rechte. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may b
ttack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310491 - https://vuldb.com/?ctiid.310491 - https://vuldb.com/?submit.580250 - https://gist.github.com/superboy-zjc/aa3dfa161d7b19d8a53ab4605792f2fe - https://gist.github.com/superboy-zjc/aa3dfa161d7b19d8a53ab4605792f2fe#proof-of-concept-poc
CVE ID: CVE-2025-5321 State: PUBLISHED Published: 2025-05-29T15:00:06.375Z Last Updated: 2025-06-01T04:39:53.266Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: aimhubio Products: aim Problem Types: CWE-265, CWE-264 Description: A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component run_view Object Handler. The manipulation of the argument Abfrage leads to erweiterte Rechte. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respon
as been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310492 - https://vuldb.com/?ctiid.310492 - https://vuldb.com/?submit.580253 - https://gist.github.com/superboy-zjc/1fc4747a0ac77a1edc8c32e1d4edc54c
CVE ID: CVE-2025-5322 State: PUBLISHED Published: 2025-07-03T21:24:34.738Z Last Updated: 2025-07-08T14:29:48.581Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: e4jvikwp Products: VikRentCar Car Rental Management System Problem Types: CWE-434 Description: The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the do_updatecar and createcar functions in all versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server, which may make remote code ex
nistrator-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5f837ba2-64a2-4d8e-8212-b646cb94b0d7?source=cve - https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.3/admin/controller.php#L1698 - https://plugins.trac.wordpress.org/browser/vikrentcar/tags/1.4.3/admin/controller.php#L1418 - https://plugins.trac.wordpress.org/changeset/3317493/
CVE ID: CVE-2025-5323 State: PUBLISHED Published: 2025-05-29T18:00:06.249Z Last Updated: 2025-05-29T18:57:43.643Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: fossasia Products: open-event-server Problem Types: CWE-649, CWE-325 Description: A vulnerability, which was classified as problematic, has been found in fossasia open-event-server 1.19.1. This issue affects the function send_email_change_user_email of the file /fossasia/open-event-server/blob/development/app/api/helpers/mail.py of the component Mail Verification Handler. The manipulation leads to reliance on obfuscation or encryption of security-relevant inputs without integrity checking. The attack m
tion leads to reliance on obfuscation or encryption of security-relevant inputs without integrity checking. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310493 - https://vuldb.com/?ctiid.310493 - https://vuldb.com/?submit.580256 - https://gist.github.com/superboy-zjc/31ecea91b304b8dd9871ad507467ca61 - https://gist.github.com/superboy-zjc/31ecea91b304b8dd9871ad507467ca61#proof-of-conc
c/31ecea91b304b8dd9871ad507467ca61 - https://gist.github.com/superboy-zjc/31ecea91b304b8dd9871ad507467ca61#proof-of-concept
CVE ID: CVE-2025-5324 State: PUBLISHED Published: 2025-05-29T18:31:04.815Z Last Updated: 2025-05-29T18:45:02.588Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: TechPowerUp Products: GPU-Z Problem Types: CWE-401, CWE-404 Description: A vulnerability, which was classified as problematic, was found in TechPowerUp GPU-Z 2.23.0. Affected is the function sub_140001880 in the library GPU-Z.sys of the component 0x8000645C IOCTL Handler. The manipulation leads to memory leak. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in an
disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310494 - https://vuldb.com/?ctiid.310494 - https://vuldb.com/?submit.580513 - https://github.com/Aiyakami/CVE-1/issues/3 - https://github.com/Aiyakami/CVE-1/tree/main/test1
CVE ID: CVE-2025-5325 State: PUBLISHED Published: 2025-05-29T19:31:04.427Z Last Updated: 2025-05-30T12:34:01.541Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: zhilink 智互联(深圳)科技有限公司 Products: ADP Application Developer Platform 应用开发者平台 Problem Types: CWE-1336, CWE-791 Description: A vulnerability has been found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /adpweb/a/ica/api/service/rfa/testService. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been di
utralization of special elements used in a template engine. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310495 - https://vuldb.com/?ctiid.310495 - https://vuldb.com/?submit.581275
CVE ID: CVE-2025-5326 State: PUBLISHED Published: 2025-05-29T20:00:07.370Z Last Updated: 2025-05-29T20:17:26.066Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: zhilink 智互联(深圳)科技有限公司 Products: ADP Application Developer Platform 应用开发者平台 Problem Types: CWE-502, CWE-20 Description: A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this issue is some unknown functionality of the file /adpweb/wechat/verifyToken/. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this
nched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310496 - https://vuldb.com/?ctiid.310496 - https://vuldb.com/?submit.581277
CVE ID: CVE-2025-5327 State: PUBLISHED Published: 2025-05-29T20:31:04.905Z Last Updated: 2025-05-29T20:45:21.607Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: chshcms Products: mccms Problem Types: CWE-918 Description: A vulnerability was found in chshcms mccms 2.7. It has been classified as critical. This affects the function index of the file sys/apps/controllers/api/Gf.php. The manipulation of the argument pic leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA A
The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310497 - https://vuldb.com/?ctiid.310497 - https://vuldb.com/?submit.582295 - https://github.com/caigo8/CVE-md/blob/main/Mccms_V2.7/%E5%89%8D%E5%8F%B0SSRF.md
CVE ID: CVE-2025-5328 State: PUBLISHED Published: 2025-05-29T21:00:06.617Z Last Updated: 2025-05-30T12:53:30.230Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: chshcms Products: mccms Problem Types: CWE-22 Description: A vulnerability was found in chshcms mccms 2.7. It has been declared as critical. This vulnerability affects the function restore_del of the file /sys/apps/controllers/admin/Backups.php. The manipulation of the argument dirs leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CIS
ed. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310498 - https://vuldb.com/?ctiid.310498 - https://vuldb.com/?submit.582297 - https://github.com/caigo8/CVE-md/blob/main/Mccms_V2.7/%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4.md
CVE ID: CVE-2025-5330 State: PUBLISHED Published: 2025-05-29T21:31:04.146Z Last Updated: 2025-05-30T12:52:43.045Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: FreeFloat Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. This affects an unknown part of the component RETR Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310503 - https://vuldb.com/?ctiid.310503 - https://
Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310503 - https://vuldb.com/?ctiid.310503 - https://vuldb.com/?submit.585402 - https://github.com/r3ng4f/FreeFloat_1/blob/main/01-exploit.txt
CVE ID: CVE-2025-5331 State: PUBLISHED Published: 2025-05-29T22:00:07.544Z Last Updated: 2025-05-30T13:41:27.680Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PCMan Products: FTP Server Problem Types: CWE-120, CWE-119 Description: A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. This vulnerability affects unknown code of the component NLST Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310504 - https://vuldb.com/?ctiid.310504 - https://vuldb.co
- CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310504 - https://vuldb.com/?ctiid.310504 - https://vuldb.com/?submit.585404 - https://github.com/r3ng4f/PCMan_1/blob/main/exploit02.txt
CVE ID: CVE-2025-5332 State: PUBLISHED Published: 2025-05-29T22:31:04.158Z Last Updated: 2025-05-30T12:51:07.194Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Online Notice Board Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in 1000 Projects Online Notice Board 1.0 and classified as critical. This issue affects some unknown processing of the file /index.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310505 - https://vuldb.com
used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310505 - https://vuldb.com/?ctiid.310505 - https://vuldb.com/?submit.586566 - https://github.com/ubfbuz3/cve/issues/16 - https://1000projects.org/
CVE ID: CVE-2025-5333 State: PUBLISHED Published: 2025-07-06T13:50:25.955Z Last Updated: 2025-07-07T14:02:14.408Z Vendors: Broadcom Products: Symantec IT Management Suite Description: Remote attackers can execute arbitrary code in the context of the vulnerable service process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35903
CVE ID: CVE-2025-5334 State: PUBLISHED Published: 2025-05-29T14:47:25.817Z Last Updated: 2025-06-10T18:24:21.477Z Vendors: Devolutions Products: Remote Desktop Manager Problem Types: CWE-359 Description: Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated user to gain unauthorized access to private personal information. Under specific circumstances, entries may be unintentionally moved from user vaults to shared vaults when edited by their owners, making them accessible to other users. This issue affects the following versions : * Remote Desktop Manager Windows 2025.1.34.0 and earlier * R
to other users. This issue affects the following versions : * Remote Desktop Manager Windows 2025.1.34.0 and earlier * Remote Desktop Manager macOS 2025.1.16.3 and earlier * Remote Desktop Manager Android 2025.1.3.3 and earlier * Remote Desktop Manager iOS 2025.1.6.0 and earlier Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2025-0009
CVE ID: CVE-2025-5335 State: PUBLISHED Published: 2025-06-10T14:50:15.088Z Last Updated: 2025-08-19T13:20:44.173Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Autodesk Products: Installer Problem Types: CWE-426 Description: A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized in the Autodesk Installer application. Exploitation of this vulnerability may lead to code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://emsfs.autodesk.com/utility/odis/1/installer/latest/AdODIS-installer.exe - https://www.autodesk.com/trust/se
s: - https://emsfs.autodesk.com/utility/odis/1/installer/latest/AdODIS-installer.exe - https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0010
CVE ID: CVE-2025-5336 State: PUBLISHED Published: 2025-06-14T08:23:26.308Z Last Updated: 2025-06-17T18:38:52.125Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: holithemes Products: Click to Chat – HoliThemes Problem Types: CWE-79 Description: The Click to Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-no_number’ parameter in all versions up to, and including, 4.22 to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Addition
nd above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/83695ac4-a08b-4c25-ac33-d9b7498f5a2c?source=cve - https://wordpress.org/plugins/click-to-chat-for-whatsapp/#developers - https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.22/new/inc/assets/js/dev/app.dev.js#L126 - https://plugins.trac.wordpress.org/browser/click-to-chat-for-whatsapp/tags/4.22/new/inc/assets/js/dev/app.dev.js#L818 - https://plugins.trac.wordpress.org/changeset/3309693/