Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-24804 State: PUBLISHED Published: 2021-11-17T10:15:43 Last Updated: 2024-08-03T19:42:17.213Z Vendors: Unknown Products: Simple JWT Login – Login and Register to WordPress using JWT Problem Types: CWE-352 Description: The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site takeover. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6f015e8e-462b-4ef7-a9a1-bb91e7d28e37
CVE ID: CVE-2021-24805 State: PUBLISHED Published: 2022-04-25T15:50:43 Last Updated: 2024-08-03T19:42:17.212Z Vendors: Unknown Products: DW Question Answer Pro Problem Types: CWE-352 Description: The DW Question & Answer Pro WordPress plugin through 1.3.4 does not properly check for CSRF in some of its functions, allowing attackers to make logged in users perform unwanted actions, such as update a comment or a question status. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a6be3fcf-60f7-4f13-b773-871a7296113c
CVE ID: CVE-2021-24806 State: PUBLISHED Published: 2021-11-08T17:35:24 Last Updated: 2024-08-03T19:42:17.338Z Vendors: Unknown Products: Comments – wpDiscuz Problem Types: CWE-352 Description: The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make logged in users post arbitrary comment. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2746101e-e993-42b9-bd6f-dfd5544fa3fe
CVE ID: CVE-2021-24807 State: PUBLISHED Published: 2021-11-08T17:35:25 Last Updated: 2024-08-03T19:42:17.186Z Vendors: Unknown Products: Support Board Problem Types: CWE-79 Description: The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically executed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/19d101aa-4b60-4db4-a33b-86c826b288b0 - https://medium.com/%40lijohnjefferson/cve-2021-24807-6bc22af2a444 - https://github.com/itsjeffersonli/CVE-202
26b288b0 - https://medium.com/%40lijohnjefferson/cve-2021-24807-6bc22af2a444 - https://github.com/itsjeffersonli/CVE-2021-24807
CVE ID: CVE-2021-24808 State: PUBLISHED Published: 2021-11-01T08:46:29 Last Updated: 2024-08-03T19:42:17.339Z Vendors: Unknown Products: BP Better Messages Problem Types: CWE-79 Description: The BP Better Messages WordPress plugin before 1.9.9.41 sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/53ff82ec-00ec-4b20-8f60-db9db8c025b4 - https://plugins.trac.wordpress.org/changeset/2605772/bp-better-messages/trunk/views/layout-new.php
CVE ID: CVE-2021-24809 State: PUBLISHED Published: 2021-11-01T08:46:30 Last Updated: 2024-08-03T19:42:17.375Z Vendors: Unknown Products: BP Better Messages Problem Types: CWE-352 Description: The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread, bp_messages_mute_thread, bp_messages_unmute_thread, bp_better_messages_add_user_to_thread, bp_better_messages_exclude_user_from_thread. This could allow attackers to make logged in users do unwanted actions Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e18
o unwanted actions Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e186fef4-dca0-461f-b539-082c13a68d13 - https://plugins.trac.wordpress.org/changeset/2605772/bp-better-messages/trunk/inc/ajax.php
CVE ID: CVE-2021-24810 State: PUBLISHED Published: 2022-03-07T08:16:00 Last Updated: 2024-08-03T19:42:17.265Z Vendors: Unknown Products: WP Event Manager – Easily Build your Calendar of Events! Problem Types: CWE-79 Description: The WP Event Manager WordPress plugin before 3.1.23 does not escape some of its Field Editor settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/94670822-0251-4e77-8d7f-b47aa7232e52
CVE ID: CVE-2021-24811 State: PUBLISHED Published: 2021-11-29T08:25:37 Last Updated: 2024-08-03T19:42:17.193Z Vendors: Unknown Products: Shop Page WP Problem Types: CWE-79 Description: The Shop Page WP WordPress plugin before 1.2.8 does not sanitise and escape some of the Product fields, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/000e65f1-89cd-4dd5-a09d-5febd9fdfbdb
CVE ID: CVE-2021-24812 State: PUBLISHED Published: 2021-11-23T19:16:12 Last Updated: 2024-08-03T19:42:17.340Z Vendors: Unknown Products: BetterLinks – Shorten, Track and Manage any URL Problem Types: CWE-79 Description: The BetterLinks WordPress plugin before 1.2.6 does not sanitise and escape some of imported link fields, which could lead to Stored Cross-Site Scripting issues when an admin import a malicious CSV. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6bc8fff1-ff10-4175-8a46-563f0f26f96a
CVE ID: CVE-2021-24813 State: PUBLISHED Published: 2021-11-01T08:46:32 Last Updated: 2024-08-03T19:42:17.348Z Vendors: Unknown Products: Events Made Easy Problem Types: CWE-79 Description: The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a1fe0783-7a88-4d75-967f-cef970b73752 - https://plugins.trac.wordpress.org/changeset/2607749/
CVE ID: CVE-2021-24814 State: PUBLISHED Published: 2022-02-01T12:21:26 Last Updated: 2024-08-03T19:42:17.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. If the victim is an administrator with a valid session cookie, full control of the WordPress instance may be taken (AJAX calls and iframe manipulatio
ator with a valid session cookie, full control of the WordPress instance may be taken (AJAX calls and iframe manipulation are possible because the vulnerable endpoint is on the same domain as the admin panel - there is no same-origin restriction). Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/94ab34f6-86a9-4e14-bf86-26ff6cb4383e
CVE ID: CVE-2021-24815 State: PUBLISHED Published: 2021-11-17T10:15:44 Last Updated: 2024-08-03T19:42:17.342Z Vendors: Unknown Products: Accept Donations with PayPal Problem Types: CWE-79 Description: The Accept Donations with PayPal WordPress plugin before 1.3.2 does not escape the Amount Menu Name field of created Buttons, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/08f4ebf5-6bbe-4fb0-a9d2-c8a994afe39b
CVE ID: CVE-2021-24816 State: PUBLISHED Published: 2021-11-08T17:35:26 Last Updated: 2024-08-03T19:42:17.200Z Vendors: Unknown Products: Phoenix Media Rename Problem Types: CWE-284 Description: The Phoenix Media Rename WordPress plugin before 3.4.4 does not have capability checks in its phoenix_media_rename AJAX action, which could allow users with Author roles to rename any uploaded media files, including ones they do not own. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5f63d677-20f3-4fe0-bb90-048b6898e6cd
CVE ID: CVE-2021-24817 State: PUBLISHED Published: 2021-12-13T10:40:58 Last Updated: 2024-08-03T19:42:17.351Z Vendors: Unknown Products: Ultimate Nofollow Problem Types: CWE-79 Description: The Ultimate NoFollow WordPress plugin through 1.4.8 does not sanitise and escape the href attribute of its shortcodes, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ccb27d2e-2d2a-40d3-ba7e-bcd5e5012a9a
CVE ID: CVE-2021-24818 State: PUBLISHED Published: 2021-12-13T10:41:00 Last Updated: 2024-08-03T19:42:17.201Z Vendors: Unknown Products: Wp Limits Problem Types: CWE-352 Description: The WP Limits WordPress plugin through 1.0 does not have CSRF check when saving its settings, allowing attacker to make a logged in admin change them, which could make the blog unstable by setting low values Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7cd524ed-5eb9-4d6b-b4d2-3d4be6b57879
CVE ID: CVE-2021-24819 State: PUBLISHED Published: 2021-12-13T10:41:02 Last Updated: 2024-08-03T19:42:17.341Z Vendors: Unknown Products: Page/Post Content Shortcode Problem Types: CWE-863 Description: The Page/Post Content Shortcode WordPress plugin through 1.0 does not have proper authorisation in place, allowing users with a role as low as contributor to access draft/private/password protected/trashed posts/pages they should not be allowed to, including posts created by other users such as admins and editors. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c97b218c-b430-4301-884f-f64d0dd08f07
CVE ID: CVE-2021-24820 State: PUBLISHED Published: 2022-02-28T09:06:10 Last Updated: 2024-08-03T19:42:17.213Z Vendors: Unknown Products: Cost Calculator Problem Types: CWE-22 Description: The Cost Calculator WordPress plugin through 1.6 allows authenticated users (Contributor+ in versions < 1.5, and Admin+ in versions <= 1.6) to perform path traversal and local PHP file inclusion on Windows Web Servers via the Cost Calculator post's Layout Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/47652b24-a6f0-4bbc-834e-496b88523fe7
CVE ID: CVE-2021-24821 State: PUBLISHED Published: 2022-03-07T08:16:02 Last Updated: 2024-08-03T19:42:17.192Z Vendors: Unknown Products: Cost Calculator Problem Types: CWE-79 Description: The Cost Calculator WordPress plugin before 1.6 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the Description fields of a Cost Calculator > Price Settings (which gets injected on the edit page as well as any page that embeds the calculator using the shortcode), as well as the Text Preview field of a Project (injected on the edit project page) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f0915b66-0b99-4ae
age) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f0915b66-0b99-4aeb-9fba-759cafaeb0cb
CVE ID: CVE-2021-24822 State: PUBLISHED Published: 2021-11-29T08:25:39 Last Updated: 2024-08-03T19:42:17.228Z Vendors: Unknown Products: Stylish Cost Calculator Problem Types: CWE-79, CWE-352 Description: The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users), which could allow any authenticated users, such as subscriber to call them, and perform Stored Cross-Site Scripting attacks against logged in admin, as well as frontend users due to the lack of sanitisation and escaping in some parameters Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vu
n and escaping in some parameters Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/db84a782-d4c8-4abf-99ea-ea672a9b806e
CVE ID: CVE-2021-24823 State: PUBLISHED Published: 2022-02-28T09:06:12 Last Updated: 2024-08-03T19:42:17.351Z Vendors: Unknown Products: Support Board Problem Types: CWE-352 Description: The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions. For example, make an admin delete arbitrary files Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1bdebd9e-a7f2-4f55-b5b0-185eb619ebaf - https://noob3xploiter.medium.com/support-board-3-3-4-arbitrary-file-deletion-to-remote-code-execution-da4c45b45c83
CVE ID: CVE-2021-24824 State: PUBLISHED Published: 2022-03-07T08:16:03 Last Updated: 2024-08-03T19:42:17.203Z Vendors: Unknown Products: Custom Content Shortcode Problem Types: CWE-863 Description: The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the email address of orders can be retrieved Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7b4d4675-6089-4435-9b56-31496adc4767
CVE ID: CVE-2021-24825 State: PUBLISHED Published: 2022-03-07T08:16:05 Last Updated: 2024-08-03T19:42:17.342Z Vendors: Unknown Products: Custom Content Shortcode Problem Types: CWE-345 Description: The Custom Content Shortcode WordPress plugin before 4.0.2 does not validate the data passed to its load shortcode, which could allow Contributor+ (v < 4.0.1) or Admin+ (v < 4.0.2) users to display arbitrary files from the filesystem (such as logs, .htaccess etc), as well as perform Local File Inclusion attacks as PHP files will be executed. Please note that such attack is still possible by admin+ in single site blogs by default (but won't be when either the unfiltered_html or file_edit is disallo
possible by admin+ in single site blogs by default (but won't be when either the unfiltered_html or file_edit is disallowed) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/be9d6f82-c972-459a-bacf-65b3dfb11a09
CVE ID: CVE-2021-24826 State: PUBLISHED Published: 2022-03-07T08:16:06 Last Updated: 2024-08-03T19:42:17.327Z Vendors: Unknown Products: Custom Content Shortcode Problem Types: CWE-79 Description: The Custom Content Shortcode WordPress plugin before 4.0.2 does not escape custom fields before outputting them, which could allow Contributor+ (v < 4.0.1) or Admin+ (v < 4.0.2) users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed. Please note that such attack is still possible by admin+ in single site blogs by default (but won't be when the unfiltered_html is disallowed) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnera
filtered_html is disallowed) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e247d78a-7243-486c-a017-7471a8dcb800
CVE ID: CVE-2021-24827 State: PUBLISHED Published: 2021-11-08T17:35:27 Last Updated: 2024-08-03T19:42:17.212Z Vendors: Unknown Products: Asgaros Forum Problem Types: CWE-89 Description: The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/36cc5151-1d5e-4874-bcec-3b6326235db1 - https://plugins.trac.wordpress.org/changeset/2611560/asgaros-forum
CVE ID: CVE-2021-24828 State: PUBLISHED Published: 2022-01-03T12:49:04 Last Updated: 2024-08-03T19:42:17.224Z Vendors: Unknown Products: Mortgage Calculator / Loan Calculator Problem Types: CWE-79 Description: The Mortgage Calculator / Loan Calculator WordPress plugin before 1.5.17 does not escape the some of the attributes of its mlcalc shortcode before outputting them, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6f9d1ee5-7ed7-4304-96a2-611b2f0081d2
CVE ID: CVE-2021-24829 State: PUBLISHED Published: 2021-11-08T17:35:29 Last Updated: 2024-08-03T19:42:17.199Z Vendors: Unknown Products: Visitor Traffic Real Time Statistics Problem Types: CWE-89 Description: The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to the today_traffic_index AJAX action (available to any authenticated users) before using it in a SQL statement, leading to an SQL injection issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/cc6585c8-5798-48a1-89f7-a3337f56df3f
CVE ID: CVE-2021-24830 State: PUBLISHED Published: 2021-11-23T19:16:13 Last Updated: 2024-08-03T19:42:17.343Z Vendors: Unknown Products: Advanced Access Manager Problem Types: CWE-79 Description: The Advanced Access Manager WordPress plugin before 6.8.0 does not escape some of its settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1c46373b-d43d-4d18-b0ae-3711fb0be0f9 - https://plugins.trac.wordpress.org/changeset/2616161/
CVE ID: CVE-2021-24831 State: PUBLISHED Published: 2022-01-03T12:49:05 Last Updated: 2024-08-03T19:42:17.210Z Vendors: Unknown Products: Tab – Accordion, FAQ Problem Types: CWE-862 Description: All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenticated attackers to modify various data in the plugin, such as add/edit/delete arbitrary tabs. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/75ed9f5f-e091-4372-a6cb-57958ad5f900
CVE ID: CVE-2021-24832 State: PUBLISHED Published: 2021-11-08T17:35:30 Last Updated: 2024-08-03T19:42:17.371Z Vendors: Unknown Products: WP SEO Redirect 301 Problem Types: CWE-352 Description: The WP SEO Redirect 301 WordPress plugin before 2.3.2 does not have CSRF in place when deleting redirects, which could allow attackers to make a logged in admin delete them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/cf031259-b76e-475c-8a8e-fa6a0d9e7bb4
CVE ID: CVE-2021-24833 State: PUBLISHED Published: 2021-11-17T10:15:46 Last Updated: 2024-08-03T19:42:17.229Z Vendors: Unknown Products: YOP Poll Problem Types: CWE-79 Description: The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of question and answer text parameters in Create Poll module. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7cb39087-fbab-463d-9592-003e3fca6d34
yst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7cb39087-fbab-463d-9592-003e3fca6d34 - https://plugins.trac.wordpress.org/changeset/2605368 - https://www.fortiguard.com/zeroday/FG-VD-21-052
CVE ID: CVE-2021-24834 State: PUBLISHED Published: 2021-11-17T10:15:47 Last Updated: 2024-08-03T19:42:17.214Z Vendors: Unknown Products: YOP Poll Problem Types: CWE-79 Description: The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability which exists in the Create Poll - Options module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of custom label parameters - vote button label , results link label and back to vote caption label. Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.word
d back to vote caption label. Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/changeset/2605368 - https://wpscan.com/vulnerability/72f58b14-e5cb-4f1c-a16f-621238c6ebbf - https://www.fortiguard.com/zeroday/FG-VD-21-053
CVE ID: CVE-2021-24835 State: PUBLISHED Published: 2021-11-08T17:35:31 Last Updated: 2024-08-03T19:42:17.420Z Vendors: Unknown Products: WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible Problem Types: CWE-89 Description: The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used in combination with another WCFM - WooCommerce Multivendor plugin such as WCFM - WooCommerce Multivendor Marketplace, does not escape the withdrawal_vendor parameter before using it in a SQL statement, allowing low privilege users such as Subscribers to perform SQL injection attacks Additional A
ng it in a SQL statement, allowing low privilege users such as Subscribers to perform SQL injection attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c493ac9c-67d1-48a9-be21-824b1a1d56c2
CVE ID: CVE-2021-24836 State: PUBLISHED Published: 2021-12-13T10:41:04 Last Updated: 2024-08-03T19:42:17.472Z Vendors: Unknown Products: Temporary Login Without Password Problem Types: CWE-862, CWE-352 Description: The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/15eed13f-3195-4f5d-8933-36695c830f4f
CVE ID: CVE-2021-24837 State: PUBLISHED Published: 2023-01-23T14:31:59.842Z Last Updated: 2024-08-03T19:42:17.209Z Vendors: Unknown Products: Passster Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Passster WordPress plugin before 3.5.5.8 does not escape the area parameter of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5fea3ac3-d599-41f3-8f76-08f0d3552af1
CVE ID: CVE-2021-24838 State: PUBLISHED Published: 2022-01-17T13:00:27 Last Updated: 2024-08-03T19:42:17.311Z Vendors: Unknown Products: AnyComment Problem Types: CWE-601 Description: The AnyComment WordPress plugin before 0.3.5 has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being validated first, leading to an Open Redirect issue, which according to the vendor, is a feature. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/562e81ad-7422-4437-a5b4-fcab9379db82