Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
itiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263489 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.263489 - https://vuldb.com/?ctiid.263489 - https://vuldb.com/?submit.330022 - https://github.com/yylmm/CVE/blob/main/Prison%20Management%20System/xss4.md
CVE ID: CVE-2024-4646 State: PUBLISHED Published: 2024-05-08T12:31:06.342Z Last Updated: 2024-08-01T20:47:41.263Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Complete Web-Based School Management System Problem Types: CWE-79 Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file /view/student_payment_details.php. The manipulation of the argument index leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-263490 is the identifier assigned to thi
ack remotely. The exploit has been disclosed to the public and may be used. VDB-263490 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263490 - https://vuldb.com/?ctiid.263490 - https://vuldb.com/?submit.330120 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2015.pdf
CVE ID: CVE-2024-4647 State: PUBLISHED Published: 2024-05-08T13:00:05.269Z Last Updated: 2024-08-01T20:47:41.390Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Complete Web-Based School Management System Problem Types: CWE-79 Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /view/student_first_payment.php. The manipulation of the argument index leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of t
k can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263491. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263491 - https://vuldb.com/?ctiid.263491 - https://vuldb.com/?submit.330121 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2016.pdf
CVE ID: CVE-2024-4648 State: PUBLISHED Published: 2024-05-08T13:00:07.159Z Last Updated: 2024-08-01T20:47:41.428Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Complete Web-Based School Management System Problem Types: CWE-79 Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /view/student_exam_mark_update_form.php. The manipulation of the argument std_index leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vuln
tack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263492. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263492 - https://vuldb.com/?ctiid.263492 - https://vuldb.com/?submit.330122 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2017.pdf
CVE ID: CVE-2024-4649 State: PUBLISHED Published: 2024-05-08T13:31:05.590Z Last Updated: 2024-08-01T20:47:41.324Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Complete Web-Based School Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in Campcodes Complete Web-Based School Management System 1.0. This affects an unknown part of the file /view/student_exam_mark_insert_form1.php. The manipulation of the argument page leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263493 was assigned to this
remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263493 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263493 - https://vuldb.com/?ctiid.263493 - https://vuldb.com/?submit.330123 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2018.pdf
CVE ID: CVE-2024-4650 State: PUBLISHED Published: 2024-05-08T13:31:07.133Z Last Updated: 2024-08-01T20:47:41.185Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Complete Web-Based School Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in Campcodes Complete Web-Based School Management System 1.0. This vulnerability affects unknown code of the file /view/student_due_payment.php. The manipulation of the argument due_month leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263494 is the identifier assigned to this vulnerabili
The exploit has been disclosed to the public and may be used. VDB-263494 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263494 - https://vuldb.com/?ctiid.263494 - https://vuldb.com/?submit.330124 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2019.pdf
CVE ID: CVE-2024-4651 State: PUBLISHED Published: 2024-05-08T14:00:04.423Z Last Updated: 2024-08-01T20:47:41.674Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Complete Web-Based School Management System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in Campcodes Complete Web-Based School Management System 1.0. This issue affects some unknown processing of the file /view/student_attendance_history1.php. The manipulation of the argument year leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this
be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263495. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263495 - https://vuldb.com/?ctiid.263495 - https://vuldb.com/?submit.330125 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2020.pdf
CVE ID: CVE-2024-4652 State: PUBLISHED Published: 2024-05-08T14:00:06.006Z Last Updated: 2024-08-01T20:47:41.390Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Campcodes Products: Complete Web-Based School Management System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in Campcodes Complete Web-Based School Management System 1.0. Affected is an unknown function of the file /view/show_teacher2.php. The manipulation of the argument month leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263496. Add
y. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263496. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263496 - https://vuldb.com/?ctiid.263496 - https://vuldb.com/?submit.330126 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20xss/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2021.pdf
CVE ID: CVE-2024-4653 State: PUBLISHED Published: 2024-05-08T14:31:03.703Z Last Updated: 2024-08-01T20:47:41.369Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: BlueNet Technology Products: Clinical Browsing System Problem Types: CWE-89 Description: A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1 and classified as critical. Affected by this issue is some unknown functionality of the file /xds/outIndex.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-263498 is the identifier assigned to this vulnerability. Additional Analyst Note
osed to the public and may be used. VDB-263498 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263498 - https://vuldb.com/?ctiid.263498 - https://vuldb.com/?submit.330628 - https://github.com/Hefei-Coffee/cve/blob/main/sql.md
CVE ID: CVE-2024-4654 State: PUBLISHED Published: 2024-05-08T15:00:05.543Z Last Updated: 2024-08-01T20:47:41.435Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: BlueNet Technology Products: Clinical Browsing System Problem Types: CWE-89 Description: A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1. It has been classified as critical. This affects an unknown part of the file /xds/cloudInterface.php. The manipulation of the argument INSTI_CODE leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263499. Additional An
en disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263499. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.263499 - https://vuldb.com/?ctiid.263499 - https://vuldb.com/?submit.330631 - https://github.com/Hefei-Coffee/cve/blob/main/sql2.md
CVE ID: CVE-2024-4655 State: PUBLISHED Published: 2024-07-11T06:00:02.913Z Last Updated: 2024-08-01T20:47:41.826Z Vendors: Unknown Products: Ultimate Blocks Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ultimate Blocks WordPress plugin before 3.1.9 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/a0dc73b3-3c51-4d03-963f-00fa7d8b0d51/
CVE ID: CVE-2024-4656 State: PUBLISHED Published: 2024-05-15T01:56:55.246Z Last Updated: 2024-08-01T20:47:41.197Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: carazo Products: Import and export users and customers Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user agent header in all versions up to, and including, 1.26.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator access and higher
nitization and output escaping. This makes it possible for authenticated attackers, with administrator access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/af742451-b2d6-445a-9a10-e950490f6c7c?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3085346%40import-users-from-csv-with-meta%2Ftrunk&old=3078277%40import-users-from-csv-with-meta%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-4657 State: PUBLISHED Published: 2024-09-25T12:37:27.916Z Last Updated: 2024-09-25T13:43:38.752Z Vendors: Talent Software Products: BAP Automation Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software BAP Automation allows Stored XSS.This issue affects BAP Automation: before 30840. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1536
CVE ID: CVE-2024-4658 State: PUBLISHED Published: 2024-10-10T13:38:18.480Z Last Updated: 2025-10-14T12:24:06.331Z Vendors: TE Informatics Products: Nova CMS Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TE Informatics Nova CMS allows SQL Injection.This issue affects Nova CMS: before 5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1661
CVE ID: CVE-2024-4660 State: PUBLISHED Published: 2024-09-12T16:57:03.244Z Last Updated: 2024-09-13T14:17:34.642Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-862 Description: An issue has been discovered in GitLab EE affecting all versions starting from 11.2 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2. It was possible for a guest to read the source code of a private project by using group templates. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/460892 - https:/
ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/460892 - https://hackerone.com/reports/2480126
CVE ID: CVE-2024-4661 State: PUBLISHED Published: 2024-06-08T05:44:28.733Z Last Updated: 2024-08-01T20:47:41.503Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: webfactory Products: WP Reset – Most Advanced WordPress Reset Tool Problem Types: CWE-862 Missing Authorization Description: The WP Reset plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_ajax function in all versions up to, and including, 2.02. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the value fo the 'License Key' field for the 'Activate Pro License' setting. Additional
vel access and above, to modify the value fo the 'License Key' field for the 'Activate Pro License' setting. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0d2dc86e-f937-429f-9baa-0eb0a8715513?source=cve - https://plugins.trac.wordpress.org/changeset/3097597/wp-reset
CVE ID: CVE-2024-4662 State: PUBLISHED Published: 2024-05-23T04:30:54.393Z Last Updated: 2024-08-01T20:47:41.332Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Oxygen Builder Products: Oxygen Builder Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The Oxygen Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.8.2 via post metadata. This is due to the plugin storing custom data in post metadata without an underscore prefix. This makes it possible for lower privileged users, such as contributors, to inject arbitrary PHP code via the WordPress user interface and
ible for lower privileged users, such as contributors, to inject arbitrary PHP code via the WordPress user interface and gain elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8706c3f6-64e0-440e-a802-5c80d9cc3643?source=cve - https://oxygenbuilder.com/oxygen-4-8-3-now-available-security-update/
CVE ID: CVE-2024-4663 State: PUBLISHED Published: 2024-06-19T03:12:29.142Z Last Updated: 2024-08-01T20:47:41.323Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: garbowza Products: OSM Map Widget for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The OSM Map Widget for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute
ut escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/402d0399-bc48-4740-86a4-8bf3424fb035?source=cve - https://plugins.trac.wordpress.org/browser/osm-map-elementor/trunk/osm-map.php#L1478
CVE ID: CVE-2024-4664 State: PUBLISHED Published: 2024-06-27T06:00:03.949Z Last Updated: 2024-08-01T20:47:41.600Z Vendors: Unknown Products: WP Chat App Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Chat App WordPress plugin before 3.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/46ada0b4-f3cd-44fb-a568-3345e639bdb6/
CVE ID: CVE-2024-4665 State: PUBLISHED Published: 2025-05-15T20:09:45.830Z Last Updated: 2025-11-13T21:00:08.476Z Vendors: Unknown Products: EventPrime Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Additionally, the feature is lacking a nonce. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/50b78cac-cad1-4526-9655-ae0440739796/
CVE ID: CVE-2024-4666 State: PUBLISHED Published: 2024-05-14T22:31:37.961Z Last Updated: 2024-08-01T20:47:41.412Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: visualmodo Products: Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user s
widgets in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b6840637-9b0f-4f3d-bb73-9e4527a5f326?source=cve - https://plugins.trac.wordpress.org/browser/borderless/trunk/modules/elementor/widgets/circular-progress-bar.php#L427 - https://plugins.trac.wordpress.org/browser/borde
erless/trunk/modules/elementor/widgets/circular-progress-bar.php#L427 - https://plugins.trac.wordpress.org/browser/borderless/trunk/modules/elementor/widgets/progress-bar.php#L412 - https://plugins.trac.wordpress.org/browser/borderless/trunk/modules/elementor/widgets/semi-circular-progress-bar.php#L403 - https://plugins.trac.wordpress.org/browser/borderless/trunk/modules/elementor/widgets/team-member.php#L1101 - https://plugins.trac.wordpress.org/browser/borderless/trunk/modules/elementor/widgets/testimonial.php#L905 - https://wordpress.org/plugins/borderless/#developers - https://plugins.trac.wordpress.org/changeset/3085856/
CVE ID: CVE-2024-4667 State: PUBLISHED Published: 2024-07-09T04:32:55.525Z Last Updated: 2024-08-01T20:47:41.550Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: plugindevs Products: Blog, Posts and Category Filter for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Blog, Posts and Category Filter for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post and Category Filter widget in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied 'post_types' attribute. This makes it pos
.3 due to insufficient input sanitization and output escaping on user supplied 'post_types' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a24c2d7d-8df8-4a3a-a538-09e11ebc6dd5?source=cve - https://plugins.trac.wordpress.org/browser/blog-posts-and-category-for-elementor/trunk/widgets/post-category-filter.php#L885 - https://wordpress.org/plugins/blog-posts-and-category-for-elementor/#develope
nk/widgets/post-category-filter.php#L885 - https://wordpress.org/plugins/blog-posts-and-category-for-elementor/#developers
CVE ID: CVE-2024-4668 State: PUBLISHED Published: 2024-05-30T09:30:40.673Z Last Updated: 2024-08-01T20:47:41.487Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: celomitan Products: Gum Elementor Addon Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Gum Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Price Table and Post Slider widgets in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level acc
put escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8b4effc8-7b24-4a6c-a161-176a22de6d6a?source=cve - https://plugins.trac.wordpress.org/browser/gum-elementor-addon/trunk/widgets/pricetable.php#L2013 - https://plugins.trac.wordpress.org/browser/gum-elementor-addon/trunk/widgets/post_slider.php#L2353 - https://wordpress.org/plugins/gum-elementor-addon/#developers -