Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9a446fe7-c97a-436e-b494-b924e6518297?source=cve - https://plugins.trac.wordpress.org/browser/media-library-assistant/trunk/includes/class-mla-settings.php#L32 - https://wordpress.org/plugins/media-library-assistant/#developers - https://plugins.trac.wordpress.org/changeset/3133909/
CVE ID: CVE-2024-6824 State: PUBLISHED Published: 2024-08-08T05:31:46.746Z Last Updated: 2024-08-09T17:49:40.841Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: leap13 Products: Premium Addons for Elementor Problem Types: CWE-862 Description: The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'check_temp_validity' and 'update_template_title' functions in all versions up to, and including, 4.10.38. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary content and update post and page titles. Additi
attackers, with Contributor-level access and above, to delete arbitrary content and update post and page titles. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b2840b9e-1baf-460c-ba11-43e4279ece27?source=cve - https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/includes/addons-integration.php#L159 - https://plugins.trac.wordpress.org/browser/premium-addons-for-elementor/trunk/includes/addons-integration.php#L184 - https://plugins.trac.wordpress.org/changeset/3131564/
CVE ID: CVE-2024-6825 State: PUBLISHED Published: 2025-03-20T10:11:36.172Z Last Updated: 2025-10-15T12:49:46.893Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: berriai Products: berriai/litellm Problem Types: CWE-94 Description: BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'post_call_rules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function name and the remaining part appended with the '.py' extension and imported. This allows an attacker to set a system method, such as 'os.sy
ning part appended with the '.py' extension and imported. This allows an attacker to set a system method, such as 'os.system', as a callback, enabling the execution of arbitrary commands when a chat response is processed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/1d98bebb-6cf4-46c9-87c3-d3b1972973b5 - https://github.com/berriai/litellm/commit/441c7275ed2715f47650a7c2e525055c804073a9
CVE ID: CVE-2024-6826 State: PUBLISHED Published: 2024-10-24T09:30:58.183Z Last Updated: 2024-10-24T12:56:42.887Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. A denial of service could occur via importing a malicious crafted XML manifest file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/472928 - https://hackerone.com/reports/2571364
CVE ID: CVE-2024-6827 State: PUBLISHED Published: 2025-03-20T10:09:55.725Z Last Updated: 2025-10-15T12:50:33.638Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: benoitc Products: benoitc/gunicorn Problem Types: CWE-444 Description: Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.
anipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/1b4f8f38-39da-44b6-9f98-f618639d0dd7
CVE ID: CVE-2024-6828 State: PUBLISHED Published: 2024-07-23T02:01:39.248Z Last Updated: 2024-08-01T21:45:38.314Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: davidanderson Products: Redux Framework Problem Types: CWE-434 Description: The Redux Framework plugin for WordPress is vulnerable to unauthenticated JSON file uploads due to missing authorization and capability checks on the Redux_Color_Scheme_Import function in versions 4.4.12 to 4.4.17. This makes it possible for unauthenticated attackers to upload JSON files, which can be used to conduct stored cross-site scripting attacks and, in some rare cases, when the wp_filesystem fails to initialize - to Re
conduct stored cross-site scripting attacks and, in some rare cases, when the wp_filesystem fails to initialize - to Remote Code Execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/18a37063-31aa-4b1f-b1a5-1ea921a20686?source=cve - https://core.trac.wordpress.org/browser/tags/6.5.4/src/wp-includes/class-wp-theme-json.php#L1690 - https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.4.17/redux-core/inc/extensions/color_scheme/color_scheme/class-redux-color-scheme-import.php#L75 - https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.4.17/redux-core/inc/classes/cla
cheme-import.php#L75 - https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.4.17/redux-core/inc/classes/class-redux-helpers.php#L938 - https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.4.17/redux-core/inc/fields/typography/redux-typography.js#L646 - https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/classes/class-redux-filesystem.php#L166 - https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.4.17/redux-core/inc/classes/class-redux-filesystem.php#L614
CVE ID: CVE-2024-6829 State: PUBLISHED Published: 2025-03-20T10:10:50.251Z Last Updated: 2025-03-20T18:15:48.518Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: aimhubio Products: aimhubio/aim Problem Types: CWE-73 Description: A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the `tarfile.extractall()` function to extract the contents of a maliciously crafted tarfile to arbitrary locations on the host server. The attacker can control `repo.path` and `run_hash` to bypass directory existence checks and extract files to unintended locations, potentially overwriting critical files. This can lead to arbitrary data being written to a
iles to unintended locations, potentially overwriting critical files. This can lead to arbitrary data being written to arbitrary locations on the remote tracking server, which could be used for further attacks such as writing a new SSH key to the target server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/7c97065c-1b63-4982-82c1-8038be0ed570
CVE ID: CVE-2024-6830 State: PUBLISHED Published: 2024-07-17T16:00:06.881Z Last Updated: 2024-08-01T21:45:38.083Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Simple Inventory Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Simple Inventory Management System 1.0. Affected is an unknown function of the file action.php of the component Order Handler. The manipulation of the argument order_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271812
motely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271812. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.271812 - https://vuldb.com/?ctiid.271812 - https://vuldb.com/?submit.375233 - https://github.com/Xu-Mingming/cve/blob/main/sql1.md
CVE ID: CVE-2024-6831 State: PUBLISHED Published: 2024-11-26T07:14:58.823Z Last Updated: 2024-11-26T14:09:25.685Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Axis Communications AB Products: AXIS Camera Station Pro, AXIS Camera Station Problem Types: CWE-602 Description: Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program has found that it is possible to edit and/or remove views without the necessary permission due to a client-side-only check. Axis has released patched versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
Axis security advisory for more information and solution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.axis.com/dam/public/a2/9a/41/cve-2024-6831-en-US-455107.pdf
CVE ID: CVE-2024-6833 State: PUBLISHED Published: 2024-07-17T14:41:37.598Z Last Updated: 2024-08-01T21:45:38.354Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C/CR:M/IR:X/AR:X/MAV:L/MAC:L/MPR:L/MUI:R/MS:C/MC:H/MI:N/MA:N) Vendors: Open Mainframe Project Products: Zowe Problem Types: CWE-257: Storing Passwords in a Recoverable Format, CWE-313: Cleartext Storage in a File or on Disk Description: A vulnerability in Zowe CLI allows local, privileged actors to store previously entered secure credentials in a plaintext file as part of an auto-init operation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://githu
-init operation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/zowe/zowe-cli/
CVE ID: CVE-2024-6834 State: PUBLISHED Published: 2024-07-17T14:44:06.283Z Last Updated: 2024-08-13T21:00:07.595Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:T/RC:C/CR:H/IR:H/AR:M/MAV:N/MAC:L/MPR:N/MUI:N/MS:C/MC:H/MI:H/MA:H) Vendors: Open Mainframe Project Products: Zowe Description: A vulnerability in APIML Spring Cloud Gateway which leverages user privileges by unexpected signing proxied request by Zowe's client certificate. This allows access to a user to the endpoints requiring an internal client certificate without any credentials. It could lead to managing components in there and allow an attacker to handle the whole communication including user crede
could lead to managing components in there and allow an attacker to handle the whole communication including user credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/zowe/api-layer
CVE ID: CVE-2024-6835 State: PUBLISHED Published: 2024-09-05T06:41:38.540Z Last Updated: 2024-09-05T13:15:09.899Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: vinod-dalvi Products: Ivory Search – WordPress Search Plugin Problem Types: CWE-200 Description: The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.5.6 via the ajax_load_posts function. This makes it possible for unauthenticated attackers to extract text data from password-protected posts using the boolean-based attack on the AJAX search form Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
ng the boolean-based attack on the AJAX search form Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/013f7c26-8348-4c54-af61-473a720a5095?source=cve - https://plugins.trac.wordpress.org/browser/add-search-to-menu/tags/5.5.6/public/class-is-ajax.php#L45 - https://plugins.trac.wordpress.org/browser/add-search-to-menu/tags/5.5.6/public/partials/is-ajax-results.php#L57 - https://plugins.trac.wordpress.org/changeset/3145289/
CVE ID: CVE-2024-6836 State: PUBLISHED Published: 2024-07-24T05:31:55.874Z Last Updated: 2024-08-01T21:45:38.349Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: amans2k Products: Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells Problem Types: CWE-862 Description: The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple functions in all versions up to, and including, 3.4.6. T
ification of data due to a missing capability check on multiple functions in all versions up to, and including, 3.4.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to update multiple settings, including templates, designs, checkouts, and other plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d9022afe-0c79-413b-ac0a-a1d32ec09619?source=cve - https://plugins.trac.wordpress.org/browser/funnel-builder/trunk/modules/checkouts/includes/class-wfacp-ajax-controller.php - https://plugins.trac.wordpress.org/changeset/3123202/
CVE ID: CVE-2024-6838 State: PUBLISHED Published: 2025-03-20T10:09:11.431Z Last Updated: 2025-03-20T14:25:56.917Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: mlflow Products: mlflow/mlflow Problem Types: CWE-400 Description: In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of service. Additionally, there is no character limit in the `artifact_location` parameter while creating the experiment. Additional Analyst N
ly, there is no character limit in the `artifact_location` parameter while creating the experiment. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/8ad52cb2-2cda-4eb0-aec9-586060ee43e0
CVE ID: CVE-2024-6839 State: PUBLISHED Published: 2025-03-20T10:09:42.595Z Last Updated: 2025-11-03T19:34:39.531Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: corydolphin Products: corydolphin/flask-cors Problem Types: CWE-41 Description: corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex pattern priority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential info
ority allows unauthorized cross-origin access to sensitive data or functionality, potentially exposing confidential information and increasing the risk of unauthorized actions by malicious actors. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/403eb1fc-86f4-4820-8eba-0f3dfae9f2b4
CVE ID: CVE-2024-6840 State: PUBLISHED Published: 2024-09-12T16:35:08.921Z Last Updated: 2025-11-20T20:56:28.081Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 2.4 for RHEL 8, Red Hat Ansible Automation Platform 2.4 for RHEL 9 Problem Types: CWE-285 Description: An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account. Additional Analyst Notes: - CISA ADP Vulnrichment: Referen
rue`, resulting in privilege escalation to a service account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:6428 - https://access.redhat.com/security/cve/CVE-2024-6840 - https://bugzilla.redhat.com/show_bug.cgi?id=2298492
CVE ID: CVE-2024-6841 State: PUBLISHED Published: 2025-03-20T10:10:14.484Z Last Updated: 2025-03-20T18:24:12.639Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: vanna-ai Products: vanna-ai/vanna Problem Types: CWE-352 Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in the latest commit (56b782bcefd2e59b19cd7ba7878b95f54884f502) of the vanna-ai/vanna repository. Two endpoints in the built-in web app that provide SQL functionality are implemented as simple GET requests, making them susceptible to CSRF attacks. This vulnerability allows an attacker to run arbitrary SQL commands via CSRF without the target intending to expose the web app t
erability allows an attacker to run arbitrary SQL commands via CSRF without the target intending to expose the web app to the network or other users. The impact is limited to data alteration or deletion, as the attacker cannot read the results of the query. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/7c6cf388-6399-4e37-99f6-3f052eb1136e
CVE ID: CVE-2024-6842 State: PUBLISHED Published: 2025-03-20T10:10:27.588Z Last Updated: 2025-10-15T12:49:47.299Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: mintplex-labs Products: mintplex-labs/anything-llm Problem Types: CWE-306 Description: In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
rs to steal these keys and cause loss of user assets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/cd911fc7-ac6b-4974-acd0-9cc926fa8d9e - https://github.com/mintplex-labs/anything-llm/commit/8b1ceb30c159cf3a10efa16275bc6849d84e4ea8
CVE ID: CVE-2024-6843 State: PUBLISHED Published: 2024-08-19T06:00:05.662Z Last Updated: 2024-08-21T14:18:21.909Z Vendors: Unknown Products: Chatbot with ChatGPT WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not sanitise and escape user inputs, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9a5cb440-065a-445a-9a09-55bd5f782e85/
CVE ID: CVE-2024-6844 State: PUBLISHED Published: 2025-03-20T10:10:51.818Z Last Updated: 2025-11-03T19:34:40.918Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: corydolphin Products: corydolphin/flask-cors Problem Types: CWE-346 Description: A vulnerability in corydolphin/flask-cors version 4.0.1 allows for inconsistent CORS matching due to the handling of the '+' character in URL paths. The request.path is passed through the unquote_plus function, which converts the '+' character to a space ' '. This behavior leads to incorrect path normalization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to the
lization, causing potential mismatches in CORS configuration. As a result, endpoints may not be matched correctly to their CORS settings, leading to unexpected CORS policy application. This can cause unauthorized cross-origin access or block valid requests, creating security vulnerabilities and usability issues. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/731a6cd4-d05f-4fe6-8f5b-fe088d7b34e0
CVE ID: CVE-2024-6845 State: PUBLISHED Published: 2024-09-25T06:00:04.626Z Last Updated: 2024-09-25T13:43:40.694Z Vendors: Unknown Products: Chatbot with ChatGPT WordPress Problem Types: CWE-863 Incorrect Authorization Description: The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cfaaa843-d89e-42d4-90d9-988293499d26/
CVE ID: CVE-2024-6846 State: PUBLISHED Published: 2024-09-05T06:00:01.905Z Last Updated: 2025-08-27T12:00:37.587Z Vendors: Unknown Products: Chatbot with ChatGPT WordPress Problem Types: CWE-862 Missing Authorization Description: The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d48fdab3-669c-4870-a2f9-6c39a7c25fd8/
CVE ID: CVE-2024-6847 State: PUBLISHED Published: 2024-08-20T06:00:03.192Z Last Updated: 2024-08-20T18:50:30.236Z Vendors: Unknown Products: Chatbot with ChatGPT WordPress Problem Types: CWE-89 SQL Injection Description: The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when submitting messages to the chatbot. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/baa860bb-3b7d-438a-ad54-92bf8e21e851/
CVE ID: CVE-2024-6848 State: PUBLISHED Published: 2024-07-20T11:18:27.812Z Last Updated: 2024-08-01T21:45:38.338Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: boldgrid Products: Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Problem Types: CWE-79 Description: The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file uploads in all versions up to, and including, 1.26.6 due to insufficient input sanitization and output escaping affecting the boldgrid_canvas_image AJAX endpoint. This makes it possible for authenticated attackers, with Contributor-level acces
he boldgrid_canvas_image AJAX endpoint. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4d5dcec8-fa36-43ab-9a35-0b391fe1d88e?source=cve - https://plugins.trac.wordpress.org/browser/post-and-page-builder/tags/1.26.6/includes/class-boldgrid-editor-ajax.php#L372 - https://wordpress.org/plugins/post-and-page-builder/#developers - https://github.com/BoldGrid/post-and-page-builder/pull/613/commits/64c33a6d0c9dbb
ns/post-and-page-builder/#developers - https://github.com/BoldGrid/post-and-page-builder/pull/613/commits/64c33a6d0c9dbb0151d3af5fee9e026df6c5a2f6 - https://github.com/BoldGrid/post-and-page-builder/issues/612