Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c4d46c87-5c30-4251-941e-a5e52b5d0c9f?source=cve - https://plugins.trac.wordpress.org/browser/simple-map-no-api/trunk/index.php#L242 - https://wordpress.org/plugins/simple-map-no-api
CVE ID: CVE-2024-13566 State: PUBLISHED Published: 2025-01-31T08:21:25.166Z Last Updated: 2025-01-31T19:34:24.664Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: samsk Products: WP DataTable Problem Types: CWE-79 Description: The WP DataTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 0.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA A
ary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9ad96faa-cbc2-46c3-a8e6-afa6744ada86?source=cve - https://plugins.trac.wordpress.org/browser/wp-datatable/trunk/shortcode.php#L42 - https://wordpress.org/plugins/wp-datatable/#developers - https://plugins.trac.wordpress.org/changeset/3231842
CVE ID: CVE-2024-13567 State: PUBLISHED Published: 2025-04-01T05:22:45.718Z Last Updated: 2025-04-01T16:20:48.858Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: awesomesupport Products: Awesome Support – WordPress HelpDesk & Support Plugin Problem Types: CWE-200 Description: The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.3.1 via the 'awesome-support' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/awesome-support directory which can contain file attachmen
t sensitive data stored insecurely in the /wp-content/uploads/awesome-support directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 6.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/24c54ef5-ad02-4767-bca6-f74c539d3068?source=cve - https://plugins.trac.wordpress.org/browser/awesome-support/trunk/includes/file-uploader/class-file-uploader.php - https://plugins.trac.wordpress.org/changeset/3250497/ - https://plugins.trac.wordpress.org/changeset/3262629/
CVE ID: CVE-2024-13568 State: PUBLISHED Published: 2025-03-01T04:21:47.217Z Last Updated: 2025-03-03T20:57:44.802Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: techjewel Products: Fluent Support – Helpdesk & Customer Support Ticket System Problem Types: CWE-200 Description: The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the 'fluent-support' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/fluent-support directory which can contain file attach
tract sensitive data stored insecurely in the /wp-content/uploads/fluent-support directory which can contain file attachments included in support tickets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/17f40832-8ae5-443a-aa98-f0e61d1152cc?source=cve - https://plugins.trac.wordpress.org/browser/fluent-support/trunk/app/Services/Includes/FileSystem.php
CVE ID: CVE-2024-13569 State: PUBLISHED Published: 2025-04-22T06:00:02.142Z Last Updated: 2025-04-22T14:41:36.575Z Vendors: Unknown Products: Front End Users Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Front End Users WordPress plugin through 3.2.32 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b9742440-0e36-4900-b58e-41c9854a62b2/
CVE ID: CVE-2024-13570 State: PUBLISHED Published: 2025-02-11T06:00:03.096Z Last Updated: 2025-02-11T15:31:51.657Z Vendors: Unknown Products: Stray Random Quotes Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Stray Random Quotes WordPress plugin through 1.9.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/26019036-f7e4-4ef5-85d4-7d5fda18823e/
CVE ID: CVE-2024-13571 State: PUBLISHED Published: 2025-02-26T06:00:08.361Z Last Updated: 2025-02-26T15:47:26.999Z Vendors: Unknown Products: Post Timeline Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Post Timeline WordPress plugin before 2.3.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ad6ad44d-fdc3-494c-a371-5d7959d1fd23/
CVE ID: CVE-2024-13572 State: PUBLISHED Published: 2025-01-24T11:07:31.292Z Last Updated: 2025-01-27T14:55:52.518Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: nfusionsolutions Products: Precious Metals Charts and Widgets for WordPress Problem Types: CWE-79 Description: The Precious Metals Charts and Widgets for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nfusion-widget' shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to i
r supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3f2c8c5f-2017-4b22-a864-dc142b3b1afb?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3227123%40precious-metals-chart-and-widgets&new=3227123%40precious-metals-chart-and-widgets&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13573 State: PUBLISHED Published: 2025-02-18T04:21:17.957Z Last Updated: 2025-02-18T15:45:42.999Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: softdiscover Products: Zigaform – Form Builder Lite Problem Types: CWE-79 Description: The Zigaform – Form Builder Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zgfm_rfvar' shortcode in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will e
r authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/768d0ef5-5213-4283-b95e-ddfe0d2196bf?source=cve - https://plugins.trac.wordpress.org/browser/zigaform-form-builder-lite/trunk/modules/formbuilder/controllers/uiform-fb-controller-frontend.php#L366
CVE ID: CVE-2024-13574 State: PUBLISHED Published: 2025-03-11T06:00:05.181Z Last Updated: 2025-03-11T14:54:30.164Z Vendors: Unknown Products: XV Random Quotes Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The XV Random Quotes WordPress plugin through 1.40 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7eb9ef20-5d34-425e-b7fc-38a769d0a822/
CVE ID: CVE-2024-13575 State: PUBLISHED Published: 2025-02-18T07:28:15.305Z Last Updated: 2025-02-18T15:06:49.114Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: magazine3 Products: Web Stories Enhancer – Level Up Your Web Stories Problem Types: CWE-79 Description: The Web Stories Enhancer – Level Up Your Web Stories plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'web_stories_enhancer' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inje
upplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc614f2-37a6-474a-828a-1f34f98715c5?source=cve - https://plugins.trac.wordpress.org/browser/web-stories-enhancer/trunk/includes/shortcode.php#L99 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3238312%40web-stories-enhancer&new=3238312%40web-stories-enhancer&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13576 State: PUBLISHED Published: 2025-02-18T04:21:16.825Z Last Updated: 2025-02-18T15:01:09.066Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: adityapatadia Products: Gumlet Video Problem Types: CWE-79 Description: The Gumlet Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gumlet' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an
tributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6b8b94fc-9ae7-47f3-b804-92d0948b662e?source=cve - https://plugins.trac.wordpress.org/browser/gumlet-video/tags/1.0.3/gumlet-video.php#L112
CVE ID: CVE-2024-13577 State: PUBLISHED Published: 2025-02-18T04:21:14.965Z Last Updated: 2025-02-18T15:13:49.140Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: catssoft Products: CATS Job Listings Problem Types: CWE-79 Description: The CATS Job Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catsone' shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user access
th contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4c0af593-2674-484a-a6a5-715f6fb488cf?source=cve - https://plugins.trac.wordpress.org/browser/cats-job-listings/trunk/CATSJobListingUser.php#L57
CVE ID: CVE-2024-13578 State: PUBLISHED Published: 2025-02-18T04:21:11.751Z Last Updated: 2025-02-18T15:18:25.205Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: zjhzxhz Products: WP-BibTeX Problem Types: CWE-79 Description: The WP-BibTeX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'WpBibTeX' shortcode in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected p
evel access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2011db9d-7237-4843-8c15-63b8fb60de5d?source=cve - https://plugins.trac.wordpress.org/browser/wp-bibtex/trunk/wp-bibtex.php#L180
CVE ID: CVE-2024-13579 State: PUBLISHED Published: 2025-02-18T04:21:13.403Z Last Updated: 2025-02-18T15:17:37.405Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: platcom Products: WP-Asambleas Problem Types: CWE-79 Description: The WP-Asambleas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'polls_popup' shortcode in all versions up to, and including, 2.85.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an
tributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2ad542c9-2025-4875-bd37-f42095c058bd?source=cve - https://plugins.trac.wordpress.org/browser/wp-asambleas/trunk/modules/shortcodes.php#L999
CVE ID: CVE-2024-13580 State: PUBLISHED Published: 2025-03-11T06:00:08.551Z Last Updated: 2025-03-11T14:43:42.684Z Vendors: Unknown Products: XV Random Quotes Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The XV Random Quotes WordPress plugin through 1.40 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/48cffe03-adcf-4da2-a331-464ae511a805/
CVE ID: CVE-2024-13581 State: PUBLISHED Published: 2025-02-18T04:21:10.649Z Last Updated: 2025-02-18T19:28:05.824Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: supporthost Products: Simple Charts Problem Types: CWE-79 Description: The Simple Charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'simple_chart' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0dca2c66-64df-44c7-9c75-330dddf582c8?source=cve - https://plugins.trac.wordpress.org/browser/simple-charts/tags/1.0/simple-charts.php#L69
CVE ID: CVE-2024-13582 State: PUBLISHED Published: 2025-02-18T04:21:21.202Z Last Updated: 2025-02-18T19:27:30.285Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: labibahmed42 Products: Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) Problem Types: CWE-79 Description: The Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wdo_simple_pricing_table_free' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat
insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d94cd171-c2a4-4ef0-bc9a-5fdd2b704b5b?source=cve - https://plugins.trac.wordpress.org/browser/simple-pricing-tables-vc-extension/tags/1.0/plugin.class.php#L403
CVE ID: CVE-2024-13583 State: PUBLISHED Published: 2025-01-24T09:21:51.358Z Last Updated: 2025-02-12T20:01:21.383Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jitendra742744 Products: Simple Gallery with Filter Problem Types: CWE-79 Description: The Simple Gallery with Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'c2tw_sgwf' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execut
henticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1c088264-64a2-4a36-ae3b-fdf60f3837e2?source=cve - https://plugins.trac.wordpress.org/browser/simple-gallery-with-filter/trunk/simple-gallery-with-filter.php#L377 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3227234%40simple-gallery-with-filter&new=3227234%40simple-gallery-with-filter&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13584 State: PUBLISHED Published: 2025-01-22T03:21:31.223Z Last Updated: 2025-01-22T14:17:15.355Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: videowhisper Products: Picture Gallery – Frontend Image Uploads, AJAX Photo List Problem Types: CWE-79 Description: The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_pictures' shortcode in all versions up to, and including, 1.5.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level
output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0f721733-2245-4d8d-9881-91cc0b48551b?source=cve - https://plugins.trac.wordpress.org/browser/picture-gallery/trunk/inc/shortcodes.php#L49 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3218329%40picture-gallery&new=3218329%40picture-gallery&sfp_email=&sfph_mail=
CVE ID: CVE-2024-13585 State: PUBLISHED Published: 2025-02-21T06:00:07.100Z Last Updated: 2025-02-21T17:34:32.704Z Vendors: Unknown Products: Ajax Search Lite Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/270f213a-2fde-471c-ad09-2b44d11891ec/
CVE ID: CVE-2024-13586 State: PUBLISHED Published: 2025-01-25T07:24:17.804Z Last Updated: 2025-01-27T14:53:16.372Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: imdr Products: Masy Gallery Problem Types: CWE-79 Description: The Masy Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'justified-gallery' shortcode in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an
tributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b865df96-335c-4856-a5e5-e728fb0645d3?source=cve - https://plugins.trac.wordpress.org/browser/masy-gallery/trunk/inc/masygal-justified-shortcode.php#L33
CVE ID: CVE-2024-13587 State: PUBLISHED Published: 2025-02-18T04:21:10.243Z Last Updated: 2025-02-18T19:28:15.368Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: softdiscover Products: Zigaform – Price Calculator & Cost Estimation Form Builder Lite Problem Types: CWE-79 Description: The Zigaform – Price Calculator & Cost Estimation Form Builder Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zgfm_fvar' shortcode in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level a
utput escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0946fab3-6299-4f62-9664-c0a049e2dbb3?source=cve - https://plugins.trac.wordpress.org/browser/zigaform-calculator-cost-estimation-form-builder-lite/trunk/modules/formbuilder/controllers/uiform-fb-controller-frontend.php#L999
CVE ID: CVE-2024-13588 State: PUBLISHED Published: 2025-02-18T04:21:15.726Z Last Updated: 2025-02-18T15:09:33.840Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kenkwasnicki Products: Simplebooklet PDF Viewer and Embedder Problem Types: CWE-79 Description: The Simplebooklet PDF Viewer and Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'simplebooklet' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts