Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-11082 State: PUBLISHED Published: 2024-11-28T09:47:12.805Z Last Updated: 2024-11-29T19:12:37.946Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: tumultinc Products: Tumult Hype Animations Problem Types: CWE-434 Description: The Tumult Hype Animations plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the hypeanimations_panel() function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Not
load arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/be3a0b4b-cce5-4d78-99d5-697f2cf04427?source=cve - https://plugins.trac.wordpress.org/browser/tumult-hype-animations/trunk/includes/adminpanel.php#L277 - https://wordpress.org/plugins/tumult-hype-animations/#developers - https://plugins.trac.wordpress.org/changeset/3197761/ - https://github.com/tumult/hype-wordpress-plugin/commit/1702d3d4fd0fae9cb9fc40cdfc3dfb8584d5f04c
CVE ID: CVE-2024-11083 State: PUBLISHED Published: 2024-11-27T05:31:54.074Z Last Updated: 2024-11-27T12:06:01.992Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: collizo4sky Products: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Problem Types: CWE-200 Description: The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.15.18 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administra
icated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/60c8159f-0641-4b75-9d56-34bd13105caf?source=cve - https://plugins.trac.wordpress.org/changeset/3197296/wp-user-avatar
CVE ID: CVE-2024-11084 State: PUBLISHED Published: 2025-04-15T15:34:31.149Z Last Updated: 2025-04-15T15:58:29.394Z Vendors: Perforce Products: Helix ALM Problem Types: CWE-203 Description: Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exists. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.perforce.com/s/detail/a91PA000001SeWbYAK
CVE ID: CVE-2024-11085 State: PUBLISHED Published: 2024-11-16T03:20:52.725Z Last Updated: 2024-11-16T15:13:21.651Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: maxwellberkel Products: WP Log Viewer Problem Types: CWE-862 Description: The WP Log Viewer plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on several AJAX actions in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access logs, update plugin-related user settings and general plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
lugin-related user settings and general plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e27bd526-1a5f-4628-8bb2-1741496f897f?source=cve - https://plugins.trac.wordpress.org/browser/wp-log-viewer/trunk/libs/Ajax.php
CVE ID: CVE-2024-11086 State: REJECTED Published: N/A Last Updated: 2024-11-20T13:00:11.735Z Description: No description available.
CVE ID: CVE-2024-11087 State: PUBLISHED Published: 2025-03-08T07:04:55.340Z Last Updated: 2025-03-11T16:08:20.531Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: cyberlord92 Products: miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon Problem Types: CWE-287 Description: The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 200.3.9. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any exi
user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username and the user does not have an already-existing account for the service returning the token. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f677b257-606a-45f2-ba85-3a56b8df2a3c?source=cve - https://www.miniorange.com/
CVE ID: CVE-2024-11088 State: PUBLISHED Published: 2024-11-21T13:55:32.836Z Last Updated: 2024-11-21T14:17:07.908Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: mra13 Products: Simple Membership Problem Types: CWE-200 Description: The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-
uch as administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c1558b08-a33b-4cf2-bacb-c88065f513cc?source=cve - https://plugins.trac.wordpress.org/changeset/3190023/simple-membership
CVE ID: CVE-2024-11089 State: PUBLISHED Published: 2024-11-21T13:55:32.191Z Last Updated: 2024-11-21T14:23:02.953Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: cayenne Products: Anonymous Restricted Content Problem Types: CWE-200 Description: The Anonymous Restricted Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to logged-in users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-i
to logged-in users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/95a01f44-2356-4ea4-b48e-80e3c6114efa?source=cve - https://plugins.trac.wordpress.org/changeset/3191193/anonymous-restricted-content
CVE ID: CVE-2024-11090 State: PUBLISHED Published: 2025-01-26T06:41:20.755Z Last Updated: 2025-01-27T14:40:21.275Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: stellarwp Products: Membership Plugin – Restrict Content Problem Types: CWE-200 Description: The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.13 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
ave been restricted to higher-level roles such as administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7615c391-ccb1-4990-bbfd-949782cc609a?source=cve - https://plugins.trac.wordpress.org/changeset/3227065/restrict-content
CVE ID: CVE-2024-11091 State: PUBLISHED Published: 2024-11-26T08:31:54.963Z Last Updated: 2024-11-26T14:09:24.406Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sayedulsayem Products: Support SVG – Upload svg files in wordpress without hassle Problem Types: CWE-79 Description: The Support SVG – Upload svg files in wordpress without hassle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in
s makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d9207baf-348c-4d3b-a6f0-cbfcd2624f78?source=cve - https://wordpress.org/plugins/support-svg/#developers - https://plugins.trac.wordpress.org/changeset/3195829/
CVE ID: CVE-2024-11092 State: PUBLISHED Published: 2024-11-16T03:20:48.060Z Last Updated: 2024-11-16T15:13:03.052Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: petrichorpost Products: SVGPlus Problem Types: CWE-79 Description: The SVGPlus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP V
ary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/77e43062-1a3d-4db1-aeac-4d7505d18730?source=cve - https://wordpress.org/plugins/svgplus/#developers
CVE ID: CVE-2024-11093 State: PUBLISHED Published: 2024-12-04T02:40:26.429Z Last Updated: 2024-12-04T14:09:10.267Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: burgthaleratsirconic Products: SG Helper Problem Types: CWE-79 Description: The SG Helper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in version 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
ages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9016822f-f167-4225-8216-e74cd687443c?source=cve - https://wordpress.org/plugins/sg-helper/#developers
CVE ID: CVE-2024-11094 State: PUBLISHED Published: 2024-11-16T09:36:36.429Z Last Updated: 2024-11-19T15:12:11.494Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: aaron13100 Products: 404 Solution Problem Types: CWE-488 Description: The 404 Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.35.17 via the export feature. This makes it possible for unauthenticated attackers to extract sensitive data such as redirects including GET parameters which may reveal sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabili
ion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d738be73-2573-4fb8-b6f0-768a08628265?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3188844%40404-solution%2Ftrunk&old=3169186%40404-solution%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11095 State: PUBLISHED Published: 2024-12-14T04:23:41.955Z Last Updated: 2024-12-16T17:50:46.445Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: visualmodo Products: Visualmodo Elements Problem Types: CWE-79 Description: The Visualmodo Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analys
ove, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/49005688-fa40-458d-9c96-5ec2ca7adcd3?source=cve - https://wordpress.org/plugins/visualmodo-elements/#developers
CVE ID: CVE-2024-11096 State: PUBLISHED Published: 2024-11-12T00:31:04.374Z Last Updated: 2025-01-09T08:22:25.704Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Task Manager Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in code-projects Task Manager 1.0. This affects an unknown part of the file /newProject.php. The manipulation of the argument projectName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283917 - https://vuldb.c
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283917 - https://vuldb.com/?ctiid.283917 - https://vuldb.com/?submit.441186 - https://github.com/UnrealdDei/cve/blob/main/sql4.md - https://code-projects.org/
CVE ID: CVE-2024-11097 State: PUBLISHED Published: 2024-11-12T02:00:13.839Z Last Updated: 2024-11-12T15:57:10.398Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: SourceCodester Products: Student Record Management System Problem Types: CWE-835, CWE-404 Description: A vulnerability has been found in SourceCodester Student Record Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the component Main Menu. The manipulation leads to infinite loop. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283918 - https://vuldb.com/?ctiid.283918 - https://vuldb.com/?submit.441237 - https://github.com/Hacker0xone/CVE/issues/5 - https://www.sourcecodester.com/
CVE ID: CVE-2024-11098 State: PUBLISHED Published: 2024-11-19T07:35:24.890Z Last Updated: 2024-11-26T15:57:56.333Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: mr2p Products: SVG Block Problem Types: CWE-79 Description: The SVG Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.1.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA AD
itrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/79cc1f11-9b53-4e71-b0cc-8f8ebd4a5f32?source=cve - https://wordpress.org/plugins/svg-block/#developers - https://plugins.trac.wordpress.org/changeset/3188270/
CVE ID: CVE-2024-11099 State: PUBLISHED Published: 2024-11-12T02:00:15.575Z Last Updated: 2024-11-12T14:43:34.862Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Job Recruitment Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Job Recruitment 1.0 and classified as critical. This issue affects some unknown processing of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283919 - https://vuldb.com/?ctiid
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283919 - https://vuldb.com/?ctiid.283919 - https://vuldb.com/?submit.441259 - https://github.com/Kenton868/CVE/blob/main/sqlInjection1.md - https://code-projects.org/
CVE ID: CVE-2024-11100 State: PUBLISHED Published: 2024-11-12T03:31:04.374Z Last Updated: 2024-11-12T15:19:52.917Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: 1000 Projects Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
loit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283921 - https://vuldb.com/?ctiid.283921 - https://vuldb.com/?submit.441292 - https://github.com/Hacker0xone/CVE/issues/6 - https://1000projects.org/
CVE ID: CVE-2024-11101 State: PUBLISHED Published: 2024-11-12T04:00:10.541Z Last Updated: 2024-11-12T15:15:13.174Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: 1000 Projects Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/search-invoices.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
he exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283920 - https://vuldb.com/?ctiid.283920 - https://vuldb.com/?submit.441314 - https://github.com/Hacker0xone/CVE/issues/7 - https://1000projects.org/
CVE ID: CVE-2024-11102 State: PUBLISHED Published: 2024-11-12T04:00:14.685Z Last Updated: 2024-11-12T16:31:26.039Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Hospital Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in SourceCodester Hospital Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /vm/doctor/edit-doc.php. The manipulation of the argument name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst
xploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.283922 - https://vuldb.com/?ctiid.283922 - https://vuldb.com/?submit.441694 - https://github.com/Salah-Tayeh/CVEs-and-Vulnerabilities/blob/main/Hospital%20Management%20System%20-%20Stored%20XSS.md - https://drive.google.com/file/d/1Omjwoh6B2xh41c3Av0_VJsoR7tascb1_/view?usp=sharing - https://www.sourcecodester.com/
CVE ID: CVE-2024-11103 State: PUBLISHED Published: 2024-11-28T09:47:09.248Z Last Updated: 2024-12-02T11:14:03.748Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: contest-gallery Products: Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons Problem Types: CWE-640 Description: The Contest Gallery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 24.0.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to cha
lidating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0df7f413-2631-46d9-8c0b-d66f05a02c01?source=cve - https://plugins.trac.wordpress.org/browser/contest-gallery/trunk/v10/v10-admin/users/frontend/login/ajax/users-login-check-ajax-password-reset.php#L88 - https://plugins.trac.wordpress.org/browser/contest-gallery/trunk/v10/v10-admin/users/frontend/login/ajax/users-login-check-ajax-lost-password.php
press.org/browser/contest-gallery/trunk/v10/v10-admin/users/frontend/login/ajax/users-login-check-ajax-lost-password.php#L31 - https://plugins.trac.wordpress.org/changeset/3196011/contest-gallery/tags/24.0.8/v10/v10-admin/users/frontend/login/ajax/users-login-check-ajax-lost-password.php?old=3190068&old_path=contest-gallery%2Ftags%2F24.0.7%2Fv10%2Fv10-admin%2Fusers%2Ffrontend%2Flogin%2Fajax%2Fusers-login-check-ajax-lost-password.php
CVE ID: CVE-2024-11104 State: PUBLISHED Published: 2024-11-22T05:33:40.055Z Last Updated: 2024-11-22T11:34:09.093Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: techfyd Products: Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery) Problem Types: CWE-862 Description: The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the save_options() fu
zed modification of data that can lead to a denial of service due to a missing capability check on the save_options() function in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. Please note this is limited to option values that can be saved as arrays. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2a9810a8-311a-424a-bd64-8d25ee891bb5?source=cve - https://plugins.trac.wordpress.org/browser/sky-elementor-addons/tags/2.6.1/includes/admin.php#L1267 - https://plugins.trac.wordpress.org/b
ac.wordpress.org/browser/sky-elementor-addons/tags/2.6.1/includes/admin.php#L1267 - https://plugins.trac.wordpress.org/browser/sky-elementor-addons/tags/2.6.1/includes/admin.php#L1290 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3193495%40sky-elementor-addons&new=3193495%40sky-elementor-addons&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3189030%40sky-elementor-addons&new=3189030%40sky-elementor-addons&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11105 State: REJECTED Published: N/A Last Updated: 2025-07-05T22:16:35.358Z Description: No description available.