Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-10877 State: PUBLISHED Published: 2024-11-13T06:47:34.023Z Last Updated: 2024-11-13T14:39:39.771Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nasirahmed Products: AFI – The Easiest Integration Plugin Problem Types: CWE-79 Description: The AFI – The Easiest Integration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.92.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an
attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/936de04d-9b80-430b-a8b7-9755b68e2a02?source=cve - https://plugins.trac.wordpress.org/browser/advanced-form-integration/tags/1.91.4/includes/class-adfoin-log-table.php#L245 - https://plugins.trac.wordpress.org/changeset/3185778/advanced-form-integration/trunk/includes/class-adfoin-log-table.php
CVE ID: CVE-2024-10878 State: PUBLISHED Published: 2024-11-26T17:32:11.007Z Last Updated: 2024-11-26T18:25:10.843Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: smub Products: Sugar Calendar – Event Calendar, Event Tickets, and Event Management Platform Problem Types: CWE-79 Description: The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succes
makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b06cb3cf-e2da-4e18-9a09-c30cebddf5c2?source=cve - https://plugins.trac.wordpress.org/browser/sugar-calendar-lite/tags/3.3.0/includes/common/Features/EventTicketing/includes/admin/orders-list-table.php#L50 - https://plugins.trac.wordpress.org/changeset/3188760/sugar-calendar-lite/trunk/includes/common/Features/EventTicketing/includes/admin/orders-list-table.php
CVE ID: CVE-2024-10879 State: PUBLISHED Published: 2024-12-06T08:24:49.569Z Last Updated: 2024-12-06T14:18:27.072Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ultimatemember Products: ForumWP – Forum & Discussion Board Problem Types: CWE-79 Description: The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an
ttackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/10b3256b-5271-44b8-ab4d-05156d4f674b?source=cve - https://plugins.trac.wordpress.org/browser/forumwp/tags/2.1.0/includes/admin/class-emails-list-table.php#L156 - https://plugins.trac.wordpress.org/browser/forumwp/tags/2.1.0/includes/admin/class-emails-list-table.php#L178
CVE ID: CVE-2024-10880 State: PUBLISHED Published: 2024-11-23T04:32:18.851Z Last Updated: 2024-11-23T13:18:23.457Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ultimatemember Products: JobBoardWP – Job Board Listings and Submissions Problem Types: CWE-79 Description: The JobBoardWP – Job Board Listings and Submissions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.3.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick
ible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/07b48c64-aa54-4b9b-b1ee-c0f065e2aaa4?source=cve - https://plugins.trac.wordpress.org/browser/jobboardwp/tags/1.2.8/includes/admin/class-emails-list-table.php#L168 - https://plugins.trac.wordpress.org/browser/jobboardwp/tags/1.2.8/includes/admin/class-emails-list-table.php#L192 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3194143%40jobboardwp&new=3194143%40
2 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3194143%40jobboardwp&new=3194143%40jobboardwp&sfp_email=&sfph_mail=
CVE ID: CVE-2024-10881 State: PUBLISHED Published: 2024-12-05T03:23:44.481Z Last Updated: 2024-12-05T11:32:49.910Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sodah Products: LUNA RADIO PLAYER Problem Types: CWE-79 Description: The LUNA RADIO PLAYER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lunaradio' shortcode in versions up to, and including, 6.24.11.07 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an
utor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2ed8a7f8-1af3-4b41-bfaf-fd1c35baa867?source=cve - https://radioplayer.luna-universe.com/update/#release-notes
CVE ID: CVE-2024-10882 State: PUBLISHED Published: 2024-11-13T02:33:14.661Z Last Updated: 2024-11-13T14:40:19.882Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: tychesoftwares Products: Product Delivery Date for WooCommerce – Lite Problem Types: CWE-79 Description: The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user
or unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0e47daed-42cc-4d96-82a1-a3e65af9fa88?source=cve - https://plugins.trac.wordpress.org/browser/product-delivery-date-for-woocommerce-lite/tags/2.7.5/includes/admin/class-prdd-lite-view-deliveries-table.php#L129 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3185534%40product-delivery-date-for-woocommerce-lite&new=3185534%40product-delivery-date-for-woocommerce-lite&
name=&old=3185534%40product-delivery-date-for-woocommerce-lite&new=3185534%40product-delivery-date-for-woocommerce-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2024-10883 State: PUBLISHED Published: 2024-11-16T03:20:40.270Z Last Updated: 2024-11-19T15:17:19.093Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: simpleform Products: SimpleForm – Contact form made simple Problem Types: CWE-79 Description: The SimpleForm – Contact form made simple plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing a
attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/045f2be3-9a24-4f8b-8a09-8adeb751b218?source=cve - https://plugins.trac.wordpress.org/browser/simpleform/tags/2.2.0/admin/includes/class-simpleform-forms-list.php#L84
CVE ID: CVE-2024-10884 State: PUBLISHED Published: 2024-11-16T03:20:40.950Z Last Updated: 2024-11-16T15:13:40.432Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: simpleform Products: SimpleForm Contact Form Submissions Problem Types: CWE-79 Description: The SimpleForm Contact Form Submissions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an ac
ackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/07f25481-51c1-4d02-85c6-561bee587587?source=cve - https://plugins.trac.wordpress.org/browser/simpleform-contact-form-submissions/tags/2.1.0/admin/includes/class-simpleform-entries-list.php#L102
CVE ID: CVE-2024-10885 State: PUBLISHED Published: 2024-12-04T03:37:40.590Z Last Updated: 2024-12-04T21:05:14.831Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: searchiq Products: SearchIQ – The Search Solution Problem Types: CWE-79 Description: The SearchIQ – The Search Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siq_searchbox' shortcode in all versions up to, and including, 4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will
or authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/86e8e16f-9d93-457a-9093-2fd236e51682?source=cve - https://plugins.trac.wordpress.org/browser/searchiq/tags/4.6/library/shortcode.php#L66 - https://plugins.trac.wordpress.org/changeset/3198694/searchiq/trunk/library/shortcode.php
CVE ID: CVE-2024-10886 State: PUBLISHED Published: 2024-11-23T03:25:50.400Z Last Updated: 2024-11-23T13:18:20.675Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: boomdevs Products: Tribute Testimonials – WordPress Testimonial Grid/Slider Problem Types: CWE-79 Description: The Tribute Testimonials – WordPress Testimonial Grid/Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tribute_testimonials_slider' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level a
utput escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8e461095-8dce-4502-8bbf-8c985105cf24?source=cve - https://plugins.trac.wordpress.org/browser/tribute-testimonial-gridslider/tags/1.0.4/includes/class-tribute-shortcode-generator.php
CVE ID: CVE-2024-10887 State: PUBLISHED Published: 2024-11-13T02:02:31.337Z Last Updated: 2024-11-13T14:43:12.784Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: nicejob Products: NiceJob Problem Types: CWE-79 Description: The NiceJob plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes (nicejob-lead, nicejob-review, nicejob-engage, nicejob-badge, nicejob-stories) in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary w
utes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5dd6a90e-03da-43e5-b975-be8f5aa5fc60?source=cve - https://plugins.trac.wordpress.org/browser/nicejob/tags/3.6.5/nicejob.php#L154 - https://plugins.trac.wordpress.org/browser/nicejob/tags/3.6.5/nicejob.php#L209 - https://plugins.trac.wordpress.org/browser/nicejob/tags/3.6.5/nicejob.php#L266 - https://plugins.trac.wordpress.org/browser/nicejob/tags/3.6.5/nicejob.php#L328 - ht
icejob/tags/3.6.5/nicejob.php#L266 - https://plugins.trac.wordpress.org/browser/nicejob/tags/3.6.5/nicejob.php#L328 - https://plugins.trac.wordpress.org/browser/nicejob/tags/3.6.5/nicejob.php#L390
CVE ID: CVE-2024-10890 State: PUBLISHED Published: 2024-11-21T07:35:36.033Z Last Updated: 2024-11-21T11:30:08.825Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: gwin Products: WPAdverts – Classifieds Plugin Problem Types: CWE-79 Description: The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as cli
arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/592ee7b9-7016-4df3-9218-6f7aebf80503?source=cve - https://plugins.trac.wordpress.org/browser/wpadverts/tags/2.1.7/includes/shortcodes.php#L545 - https://plugins.trac.wordpress.org/changeset/3192192/wpadverts/trunk/includes/shortcodes.php
CVE ID: CVE-2024-10891 State: PUBLISHED Published: 2024-11-20T09:31:54.364Z Last Updated: 2024-11-20T20:15:56.031Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pdfcrowd Products: Save as PDF Plugin by Pdfcrowd Problem Types: CWE-79 Description: The Save as PDF Plugin by Pdfcrowd plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'save_as_pdf_pdfcrowd' shortcode in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages t
ossible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3763d893-83a0-4b6a-9c21-34a69313d555?source=cve - https://plugins.trac.wordpress.org/browser/save-as-pdf-by-pdfcrowd/trunk/public/class-save-as-pdf-pdfcrowd-public.php#L586
CVE ID: CVE-2024-10892 State: PUBLISHED Published: 2024-12-18T06:00:16.137Z Last Updated: 2024-12-18T15:10:31.241Z Vendors: Unknown Products: Cost Calculator Builder Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Cost Calculator Builder WordPress plugin before 3.2.43 does not have CSRF checks in some AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ff1f5b84-a8cf-4574-a713-53d35739c6cb/
CVE ID: CVE-2024-10893 State: PUBLISHED Published: 2024-12-03T06:00:03.786Z Last Updated: 2024-12-03T14:23:50.676Z Vendors: Unknown Products: WP Booking Calendar Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Booking Calendar WordPress plugin before 10.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a230a552-3fda-4145-810f-58af540107db/
CVE ID: CVE-2024-10894 State: PUBLISHED Published: 2025-04-10T07:02:38.711Z Last Updated: 2025-04-10T13:39:13.521Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kendysond Products: Payment Forms for Paystack Problem Types: CWE-79 Description: The Payment Forms for Paystack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'datepicker', 'textarea', and 'text' in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scrip
is makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/20b0a946-f429-4615-9d16-4a95a9120c3d?source=cve - https://plugins.trac.wordpress.org/browser/payment-forms-for-paystack/tags/4.0.0/includes/classes/class-field-shortcodes.php#L62 - https://plugins.trac.wordpress.org/browser/payment-forms-for-paystack/tags/4.0.0/includes/classes/class-field-shortcodes.php#L99 - https://plugins.trac.wordpress.org/browser/payment-forms-for-paystack/ta
cludes/classes/class-field-shortcodes.php#L99 - https://plugins.trac.wordpress.org/browser/payment-forms-for-paystack/tags/4.0.0/includes/classes/class-field-shortcodes.php#L218 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3210130%40payment-forms-for-paystack&new=3210130%40payment-forms-for-paystack&sfp_email=&sfph_mail=#file7
CVE ID: CVE-2024-10895 State: PUBLISHED Published: 2024-11-27T06:41:27.696Z Last Updated: 2024-11-27T12:01:12.398Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: logichunt Products: Counter Up – Animated Number Counter & Milestone Showcase Problem Types: CWE-79 Description: The Counter Up – Animated Number Counter & Milestone Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lgx-counter' shortcode in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and abo
g on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/36e070de-bd77-48a4-a9c2-3938b144398a?source=cve - https://plugins.trac.wordpress.org/browser/wp-counter-up/trunk/public/class-wp-counter-up-public.php#L318
CVE ID: CVE-2024-10896 State: PUBLISHED Published: 2024-11-28T06:00:12.112Z Last Updated: 2024-11-29T15:39:39.900Z Vendors: Unknown Products: Logo Slider Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo and Slider settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1304c2b6-922d-455e-bae8-d6bf855eddd9/
CVE ID: CVE-2024-10897 State: PUBLISHED Published: 2024-11-15T04:29:04.948Z Last Updated: 2024-11-15T18:11:56.137Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: themeum Products: Tutor LMS Elementor Addons Problem Types: CWE-862 Description: The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_etlms_dependency_plugin() function in all versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install Elementor or Tutor LMS. Please note the impact of this issue is incredibly limited due t
el access and above, to install Elementor or Tutor LMS. Please note the impact of this issue is incredibly limited due to the fact that these two plugins will likely already be installed as a dependency of the plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/99edd858-5e2c-4cc5-adda-d8e70ddc86f6?source=cve - https://plugins.trac.wordpress.org/browser/tutor-lms-elementor-addons/trunk/classes/Installer.php#L152 - https://plugins.trac.wordpress.org/changeset/3186320/tutor-lms-elementor-addons/trunk/classes/Installer.php
CVE ID: CVE-2024-10898 State: PUBLISHED Published: 2024-11-21T02:06:46.137Z Last Updated: 2024-11-21T14:49:48.042Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: krishaweb Products: Contact Form 7 Email Add on Problem Types: CWE-98 Description: The Contact Form 7 Email Add on plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the cf7_email_add_on_add_admin_template() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass
te arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php files can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d82efaa3-ea61-476c-ad1a-60585450c63a?source=cve - https://plugins.trac.wordpress.org/browser/cf7-email-add-on/trunk/include/class-cf7-email.php#L110