Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ates that address this vulnerability for the affected products. Customers are advised to upgrade their Blue Planet products to the latest software version as soon as possible. The software updates can be downloaded from the Ciena Support Portal. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ciena.com/product-security
CVE ID: CVE-2024-2006 State: PUBLISHED Published: 2024-03-13T15:27:04.179Z Last Updated: 2024-08-11T13:59:37.515Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpwax Products: Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.7 via deserialization of untrusted input in the outpost_shortcode_metabox_markup function. This makes it possible for authenticated a
lization of untrusted input in the outpost_shortcode_metabox_markup function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8cf1b234-862b-41a0-ab63-a986f8023613?source=cve - https://plugins.trac.wordpress.org/browser/post-grid-carousel-ultimate/trunk/includes/classes/metabox.php#L43 - https:
- https://plugins.trac.wordpress.org/browser/post-grid-carousel-ultimate/trunk/includes/classes/metabox.php#L43 - https://plugins.trac.wordpress.org/changeset?old_path=/post-grid-carousel-ultimate/tags/1.6.7&old=3045923&new_path=/post-grid-carousel-ultimate/tags/1.6.8&new=3045923&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2007 State: PUBLISHED Published: 2024-02-29T18:31:04.685Z Last Updated: 2024-08-19T17:09:47.661Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: OpenBMB Products: XAgent Problem Types: CWE-265 Description: A vulnerability was found in OpenBMB XAgent 1.0.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Privileged Mode. The manipulation leads to sandbox issue. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier VDB-255265 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA
The identifier VDB-255265 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.255265 - https://vuldb.com/?ctiid.255265 - https://github.com/OpenBMB/XAgent/issues/386
CVE ID: CVE-2024-2008 State: PUBLISHED Published: 2024-04-04T02:32:40.474Z Last Updated: 2024-08-19T19:16:52.414Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: awordpresslife Products: Modal Popup Box – Popup Builder, Show Offers And News in Popup Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Modal Popup Box – Popup Builder, Show Offers And News in Popup plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.2 via deserialization of untrusted input in the awl_modal_popup_box_shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above,
pup_box_shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fca3d106-49df-49fc-a90d-e0cb26bd34b6?source=cve - https://plugins.trac.wordpress.org/browser/modal-popup-box/trunk/include/modal-popup-box-shortcode.php#L19 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfp
-popup-box/trunk/include/modal-popup-box-shortcode.php#L19 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3062572%40modal-popup-box&new=3062572%40modal-popup-box&sfp_email=&sfph_mail=
CVE ID: CVE-2024-2009 State: PUBLISHED Published: 2024-02-29T18:31:05.718Z Last Updated: 2024-08-13T13:40:21.515Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Nway Pro Problem Types: CWE-209 Description: A vulnerability was found in Nway Pro 9. It has been rated as problematic. Affected by this issue is the function ajax_login_submit_form of the file login\index.php of the component Argument Handler. The manipulation of the argument rsargs[] leads to information exposure through error message. The attack may be launched remotely. VDB-255266 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disc
otely. VDB-255266 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.255266 - https://vuldb.com/?ctiid.255266
CVE ID: CVE-2024-2010 State: PUBLISHED Published: 2024-09-12T08:49:16.420Z Last Updated: 2025-09-16T11:08:26.494Z Vendors: TE Informatics Products: V5 Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in TE Informatics V5 allows Reflected XSS.This issue affects V5: before 6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-24-1456
CVE ID: CVE-2024-2011 State: PUBLISHED Published: 2024-06-11T13:24:58.764Z Last Updated: 2024-08-01T18:56:22.675Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: Hitachi Energy Products: FOXMAN-UN, UNEM Problem Types: CWE-122 Description: A heap-based buffer overflow vulnerability exists in the FOXMAN-UN/UNEM that if exploited will generally lead to a denial of service but can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Previe
rogram Container: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000194&languageCode=en&Preview=true
CVE ID: CVE-2024-2012 State: PUBLISHED Published: 2024-06-11T13:16:29.566Z Last Updated: 2024-08-01T18:56:22.575Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Hitachi Energy Products: FOXMAN-UN, UNEM Problem Types: CWE-288 Description: vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or code to be executed on the UNEM server allowing sensitive data to be read or modified or could cause other unintended behavior Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&langua
ichment: - CVE Program Container: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true
CVE ID: CVE-2024-2013 State: PUBLISHED Published: 2024-06-11T13:14:40.501Z Last Updated: 2024-08-01T18:56:22.747Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Hitachi Energy Products: FOXMAN-UN, UNEM Problem Types: CWE-288 Description: An authentication bypass vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway component that if exploited allows attackers without any access to interact with the services and the post-authentication attack surface. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000201&languageCode=en&Preview=true
CVE ID: CVE-2024-2014 State: PUBLISHED Published: 2024-02-29T21:00:08.643Z Last Updated: 2024-08-01T18:56:22.680Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Panabit Products: Panalog Problem Types: CWE-89 Description: A vulnerability classified as critical was found in Panabit Panalog 202103080942. This vulnerability affects unknown code of the file /Maintain/sprog_upstatus.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255268. NOTE: The vendor was contacted early about this disclosure but did not respond in any wa
is vulnerability is VDB-255268. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.255268 - https://vuldb.com/?ctiid.255268 - https://github.com/mashroompc0527/CVE/blob/main/vul.md
CVE ID: CVE-2024-2015 State: PUBLISHED Published: 2024-02-29T21:00:10.058Z Last Updated: 2024-08-01T18:56:22.732Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: ZhiCms Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in ZhiCms 4.0. This issue affects the function getindexdata of the file app/index/controller/mcontroller.php. The manipulation of the argument key leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255269 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Conta
er VDB-255269 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.255269 - https://vuldb.com/?ctiid.255269 - https://gist.github.com/L1nyz-tel/e3ee6f3401a9d1c580be1a9b4a8afab5
CVE ID: CVE-2024-2016 State: PUBLISHED Published: 2024-02-29T21:31:04.756Z Last Updated: 2024-08-01T18:56:22.610Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: ZhiCms Problem Types: CWE-94 Description: A vulnerability, which was classified as critical, was found in ZhiCms 4.0. Affected is the function index of the file app/manage/controller/setcontroller.php. The manipulation of the argument sitename leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-255270 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Containe
the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.255270 - https://vuldb.com/?ctiid.255270 - https://gist.github.com/L1nyz-tel/e3ee6f3401a9d1c580be1a9b4a8afab5
CVE ID: CVE-2024-2017 State: PUBLISHED Published: 2024-06-06T02:38:13.733Z Last Updated: 2024-08-01T18:56:22.545Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: adamskaat Products: Countdown, Coming Soon, Maintenance – Countdown & Clock Problem Types: CWE-862 Missing Authorization Description: The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the conditionsRow and switchCountdown functions in all versions up to, and including, 2.7.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject PHP Objects and modi
is makes it possible for authenticated attackers, with subscriber-level access and above, to inject PHP Objects and modify the status of countdowns. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d8fab229-cd6b-45a3-9e80-a03a1704ad3e?source=cve - https://plugins.trac.wordpress.org/browser/countdown-builder/trunk/classes/Ajax.php#L92 - https://plugins.trac.wordpress.org/browser/countdown-builder/trunk/classes/Ajax.php#L51 - https://plugins.trac.wordpress.org/changeset/3097588/ - https://plugins.trac.wordpress.org/changeset/3096150/
CVE ID: CVE-2024-2018 State: PUBLISHED Published: 2024-04-09T18:58:42.446Z Last Updated: 2024-08-01T18:56:22.532Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpwhitesecurity Products: WP Activity Log Premium Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via the entry->roles parameter in all versions up to, and including, 4.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with sub
nd lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. One demonstrated attack included the injection of a PHP Object. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2f060ea1-01e2-4e5b-82ba-b5cdd0d8290a?source=cve - https://melapress.com/support/kb/wp-activity-log-plugin-changelog/
CVE ID: CVE-2024-2019 State: PUBLISHED Published: 2024-06-04T05:32:13.416Z Last Updated: 2024-08-09T18:50:16.918Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: bobbysmith007 Products: WP-DB-Table-Editor Problem Types: CWE-284 Improper Access Control Description: The WP-DB-Table-Editor plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to lack of a default capability requirement on the 'dbte_render' function in all versions up to, and including, 1.8.4. This makes it possible for authenticated attackers, with contributor access and above, to modify database tables that the theme has been configured to
enticated attackers, with contributor access and above, to modify database tables that the theme has been configured to use the plugin to edit. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2d044e0a-a956-4319-985d-6a9a276daf49?source=cve - https://plugins.trac.wordpress.org/browser/wp-db-table-editor/trunk/db-table-editor.php
CVE ID: CVE-2024-2020 State: PUBLISHED Published: 2024-03-13T15:26:46.255Z Last Updated: 2024-08-01T18:56:22.635Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: codepeople Products: Calculated Fields Form Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form page href parameter in all versions up to, and including, 5.1.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute
scaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the professional version or higher. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/45bfa9fb-f35b-4fd4-8553-cf87bf69df6b?source=cve - https://wordpress.org/plugins/calculated-fields-form/#developers
CVE ID: CVE-2024-2021 State: PUBLISHED Published: 2024-02-29T23:31:04.361Z Last Updated: 2024-08-08T18:45:02.218Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Netentsec Products: NS-ASG Application Security Gateway Problem Types: CWE-89 Description: A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. Affected is an unknown function of the file /admin/list_localuser.php. The manipulation of the argument ResId leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255300. NOTE: The vendor was con
en disclosed to the public and may be used. The identifier of this vulnerability is VDB-255300. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.255300 - https://vuldb.com/?ctiid.255300 - https://github.com/dtxharry/cve/blob/main/cve.md
CVE ID: CVE-2024-2022 State: PUBLISHED Published: 2024-03-01T00:00:07.845Z Last Updated: 2024-08-08T20:54:27.333Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Netentsec Products: NS-ASG Application Security Gateway Problem Types: CWE-89 Description: A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/list_ipAddressPolicy.php. The manipulation of the argument GroupId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-255301 was assigned to this vulne
tely. The exploit has been disclosed to the public and may be used. The identifier VDB-255301 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.255301 - https://vuldb.com/?ctiid.255301 - https://github.com/zouzuo1994321/cve/blob/main/cve.md
CVE ID: CVE-2024-2023 State: PUBLISHED Published: 2024-06-14T12:50:56.493Z Last Updated: 2024-08-01T18:56:22.631Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: galdub, Premio Products: Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager, Folders Pro Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Folders and Folders Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0 in Folders and 3.0.2 in Folders Pro via the 'handle_folders_file_upload' function. This makes it possible for authenticated attackers,
3.0.2 in Folders Pro via the 'handle_folders_file_upload' function. This makes it possible for authenticated attackers, with author access and above, to upload files to arbitrary locations on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b4cc839c-de7a-43eb-a7fa-b1049419bfa3?source=cve - https://plugins.trac.wordpress.org/browser/folders/tags/3.0/includes/media.replace.php#L1311 - https://plugins.trac.wordpress.org/changeset/3070429/folders/trunk/includes/media.replace.php
CVE ID: CVE-2024-2024 State: PUBLISHED Published: 2024-06-14T12:51:02.731Z Last Updated: 2024-08-01T18:56:22.852Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Premio Products: Folders Pro Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Folders Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handle_folders_file_upload' function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author access and above, to upload arbitrary files on the affected site's server which may make remote
attackers, with author access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fa1d953f-6a5c-46af-a1a5-2c4f90da679a?source=cve - https://plugins.trac.wordpress.org/browser/folders/tags/3.0/includes/media.replace.php#L1311
CVE ID: CVE-2024-2025 State: PUBLISHED Published: 2024-03-23T01:57:39.316Z Last Updated: 2024-08-09T20:04:36.885Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: svenl77 Products: BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages Problem Types: CWE-502 Deserialization of Untrusted Data Description: The "BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages" plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.20 via deserialization of untrusted input in the get_simple_request function. This makes it possible for authenticated attackers, with subscriber-level a
ed input in the get_simple_request function. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/78da9e79-399e-43e3-ac27-a162861cae71?source=cve - https://plugins.trac.wordpress.org/changeset/3055634/wc4bp/trunk/class/includes/class-request-helper.php
CVE ID: CVE-2024-2026 State: PUBLISHED Published: 2024-04-09T18:59:04.410Z Last Updated: 2024-08-01T18:56:22.711Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: patrickposner Products: Passster – Password Protect Pages and Content Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Passster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_protector shortcode in all versions up to, and including, 4.2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with
t sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/880f1f3f-857c-46da-a65c-082348260f89?source=cve - https://plugins.trac.wordpress.org/browser/content-protector/trunk/inc/class-ps-public.php#L48