Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12500 State: PUBLISHED Published: 2024-12-18T02:24:11.231Z Last Updated: 2024-12-18T16:36:36.340Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: philantro Products: Philantro – Donations and Donor Management Problem Types: CWE-79 Description: The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'donate' in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scr
This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0cd2ad77-c5de-470d-bc17-729233e4ab92?source=cve - https://plugins.trac.wordpress.org/browser/philantro/tags/5.13/philantro.php#L398 - https://plugins.trac.wordpress.org/browser/philantro/tags/5.13/philantro.php#L75 - https://plugins.trac.wordpress.org/browser/philantro/tags/5.13/philantro.php#L107 - https://plugins.trac.wordpress.org/browser/philantro/tags/5.13/philantro.php#L140
ilantro/tags/5.13/philantro.php#L107 - https://plugins.trac.wordpress.org/browser/philantro/tags/5.13/philantro.php#L140 - https://plugins.trac.wordpress.org/browser/philantro/tags/5.13/philantro.php#L167 - https://plugins.trac.wordpress.org/browser/philantro/tags/5.13/philantro.php#L203 - https://plugins.trac.wordpress.org/browser/philantro/tags/5.13/philantro.php#L229 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3207274%40philantro&new=3207274%40philantro&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3207777%40philantro&new=3207777%40philantro&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12501 State: PUBLISHED Published: 2024-12-14T05:34:13.245Z Last Updated: 2024-12-16T17:49:11.072Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kylephillips Products: Simple Locator Problem Types: CWE-79 Description: The Simple Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injec
tor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/38cb5e43-56d0-40b6-936a-f10f15d2e72f?source=cve - https://plugins.trac.wordpress.org/browser/simple-locator/tags/2.0.3/app/API/AllLocationsShortcode.php#L19 - https://plugins.trac.wordpress.org/browser/simple-locator/tags/2.0.3/app/API/FormShortcode.php#L31 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3207747%40simple-locator&new=3207747%40simple-locator&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12502 State: PUBLISHED Published: 2024-12-14T04:23:46.808Z Last Updated: 2024-12-16T20:05:44.244Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: homeasap Products: My IDX Home Search Problem Types: CWE-79 Description: The My IDX Home Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'homeasap-idx-landing' shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute wheneve
d attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d17aca2b-5ac6-46cd-a439-f492e6573a46?source=cve - https://plugins.trac.wordpress.org/browser/my-idx-home-search/trunk/includes/class-homeasap-search-loader.php#L147
CVE ID: CVE-2024-12503 State: PUBLISHED Published: 2024-12-12T00:00:12.835Z Last Updated: 2024-12-12T15:47:52.404Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: ClassCMS Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in ClassCMS 4.8. Affected by this vulnerability is an unknown functionality of the file /index.php/admin of the component Model Management Page. The manipulation of the argument URL leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287875
e public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.287875 - https://vuldb.com/?ctiid.287875 - https://vuldb.com/?submit.461085 - https://github.com/Jack-Black-13/blob/blob/main/classCMS_v4.8_model_xss.md
CVE ID: CVE-2024-12504 State: PUBLISHED Published: 2025-01-23T11:13:28.100Z Last Updated: 2025-01-23T14:39:57.630Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: videowhisper Products: Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP Problem Types: CWE-79 Description: The Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_hls' shortcode in all versions up to, and including, 6.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wit
ut sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/74b27798-3c6f-4c4e-80f8-7aa40f704fb7?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3218331%40videowhisper-live-streaming-integration&new=3218331%40videowhisper-live-streaming-integration&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12505 State: PUBLISHED Published: 2025-01-11T02:20:54.513Z Last Updated: 2025-01-13T19:53:40.448Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: tinuzz Products: Trackserver Problem Types: CWE-79 Description: The Trackserver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tsmap' shortcode in all versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected p
evel access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/63ade911-f9e7-4b1c-87c8-78e7664feff7?source=cve - https://plugins.trac.wordpress.org/browser/trackserver/trunk/class-trackserver-shortcode.php#L46 - https://plugins.trac.wordpress.org/browser/trackserver/trunk/class-trackserver-shortcode.php#L57 - https://plugins.trac.wordpress.org/browser/trackserver/trunk/class-trackserver-shortcode.php#L281 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3219730%40trackserver&n
code.php#L281 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3219730%40trackserver&new=3219730%40trackserver&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12506 State: PUBLISHED Published: 2024-12-20T06:59:10.804Z Last Updated: 2024-12-20T17:36:51.869Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: magblogapi Products: NACC WordPress Plugin Problem Types: CWE-79 Description: The NACC WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nacc' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user
ers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d992b9dd-dfd1-497c-b09f-cca02dc87e34?source=cve - https://plugins.trac.wordpress.org/browser/nacc-wordpress-plugin/tags/4.1.0/nacc-wordpress-plugin.php#L68 - https://plugins.trac.wordpress.org/browser/nacc-wordpress-plugin/tags/4.1.0/nacc-wordpress-plugin.php#L85 - https://plugins.trac.wordpress.org/browser/nacc-wordpress-plugin/tags/4.1.0/nacc-wordpress-plugin.php#L98 - https://plugins.trac.wordpress.org/browser/nacc-wordpre
nacc-wordpress-plugin/tags/4.1.0/nacc-wordpress-plugin.php#L98 - https://plugins.trac.wordpress.org/browser/nacc-wordpress-plugin/tags/4.1.0/nacc-wordpress-plugin.php#L135
CVE ID: CVE-2024-12507 State: PUBLISHED Published: 2024-12-24T04:22:45.364Z Last Updated: 2024-12-25T02:43:41.840Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: optio Products: Optio Dentistry Problem Types: CWE-79 Description: The Optio Dentistry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'optio-lightbox' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4241118f-9bcb-4dec-abd2-7172db2cf445?source=cve - https://plugins.trac.wordpress.org/browser/optio-dentistry/tags/2.1/optio-dentistry.php#L18 - https://plugins.trac.wordpress.org/browser/optio-dentistry/tags/2.1/optio-dentistry.php#L92 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3208800%40optio-dentistry&new=3208800%40optio-dentistry&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12508 State: PUBLISHED Published: 2025-01-17T07:01:26.281Z Last Updated: 2025-02-12T17:15:59.992Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: glofoxwebdev Products: Glofox Shortcodes Problem Types: CWE-79 Description: The Glofox Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'glofox' and 'glofox_lead_capture ' shortcodes in all versions up to, and including, 2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will e
r authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3ed59d5b-0922-44e9-98e8-07b91d1f4840?source=cve - https://wordpress.org/plugins/glofox-shortcodes/
CVE ID: CVE-2024-12509 State: PUBLISHED Published: 2024-12-20T06:59:06.967Z Last Updated: 2024-12-20T16:00:17.295Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: rluks Products: Embed Twine Problem Types: CWE-79 Description: The Embed Twine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'embed_twine' shortcode in all versions up to, and including, 0.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injec
tor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/647f0b46-ac12-445b-9d41-66eba3eb2b1a?source=cve - https://wordpress.org/plugins/embed-twine/
CVE ID: CVE-2024-12510 State: PUBLISHED Published: 2025-02-03T18:52:16.942Z Last Updated: 2025-02-27T14:56:42.166Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: Xerox Products: Versalink B400, Versalink B405, Versalink C400, Versalink C405, Versalink B600/B610, Versalink B605/B615, Versalink C500/C600, Versalink C505/C605, Versalink C7000, Versalink C7020/C7025/C7030, Versalink B7025/B7030/B7035, Versalink B7125/B7130/B7135, Versalink C7120/C7125/C7130, Versalink C8000/C9000, Versalink C8000W, Phaser 6510, WorkCentre 6515 Problem Types: CWE-287 Description: If LDAP settings are accessed, authentication could be redirected to another server, potentially exp
WE-287 Description: If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. This requires admin access and an active LDAP setup. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2025/02/Xerox-Security-Bulletin-XRX25-003-for-Xerox%C2%AE-for-VersaLinkPhaser-and-WorkCentre.pdf
CVE ID: CVE-2024-12511 State: PUBLISHED Published: 2025-02-03T19:23:52.125Z Last Updated: 2025-09-17T11:09:16.202Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Xerox Products: Versalink B400, Versalink B405, Versalink C400, Versalink C405, Versalink B600/B610, Versalink B605/B615, Versalink C500/C600, Versalink C505/C605, Versalink C7000, Versalink C7020/C7025/C7030, Versalink B7025/B7030/B7035, Versalink B7125/B7130/B7135, Versalink C7120/C7125/C7130, Versalink C8000/C9000, Versalink C8000W, Phaser 6510, WorkCentre 6515 Problem Types: CWE-306, CWE-522 Description: With address book access, SMB/FTP settings could be modified, redirecting scans and possibly
-306, CWE-522 Description: With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and printer access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://securitydocs.business.xerox.com/wp-content/uploads/2025/02/Xerox-Security-Bulletin-XRX25-003-for-Xerox%C2%AE-for-VersaLinkPhaser-and-WorkCentre.pdf
CVE ID: CVE-2024-12512 State: PUBLISHED Published: 2025-01-25T07:24:13.494Z Last Updated: 2025-01-27T15:33:55.443Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: arunbasillal Products: Ask Me Anything (Anonymously) Problem Types: CWE-79 Description: The Ask Me Anything (Anonymously) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'askmeanythingpeople' shortcode in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages th
ssible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0f204d39-8a4a-4008-adc6-3ba72531f5a2?source=cve - https://wordpress.org/plugins/ask-me-anything-anonymously/
CVE ID: CVE-2024-12513 State: PUBLISHED Published: 2024-12-18T02:24:12.262Z Last Updated: 2024-12-18T16:36:10.126Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: rewardsfuel Products: Contests by Rewards Fuel Problem Types: CWE-79 Description: The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RF_CONTEST' shortcode in all versions up to, and including, 2.0.65 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute w
ticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c89934b1-5e3c-4bf2-8d36-17c4268ccd4e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3208765%40contests-from-rewards-fuel&new=3208765%40contests-from-rewards-fuel&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12514 State: PUBLISHED Published: 2025-01-09T11:11:04.826Z Last Updated: 2025-01-09T14:26:13.183Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: 3dvieweronline Products: 3DVieweronline Problem Types: CWE-79 Description: The 3DVieweronline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's '3Dvo-model' shortcode in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acc
with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ee1c9c62-d5b5-4213-ae5a-d3d4e9103d15?source=cve - https://plugins.trac.wordpress.org/browser/3dvieweronline-wp/trunk/public/class-threedvieweronline-iframe-public.php - https://wordpress.org/plugins/3dvieweronline-wp/
CVE ID: CVE-2024-12515 State: PUBLISHED Published: 2025-01-09T11:11:02.567Z Last Updated: 2025-01-09T14:40:33.150Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: masjidal Products: Muslim Prayer Time-Salah/Iqamah Problem Types: CWE-79 Description: The Muslim Prayer Time-Salah/Iqamah plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Masjid ID parameter in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inj
butor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9e34b3df-ac18-4409-b8fe-b27c931f3aa3?source=cve - https://wordpress.org/plugins/masjidal/
CVE ID: CVE-2024-12516 State: PUBLISHED Published: 2025-01-07T07:22:33.935Z Last Updated: 2025-01-07T15:54:46.017Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: vickydalmia Products: Coupon Plugin Problem Types: CWE-79 Description: The Coupon Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Coupon Code' parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analys
to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/827c0459-1328-4fb1-b044-ae80298fa5ea?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3215992%40coupon-lite&new=3215992%40coupon-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12517 State: PUBLISHED Published: 2024-12-14T04:23:43.418Z Last Updated: 2024-12-16T17:50:19.050Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: prontotools Products: WooCommerce Cart Count Shortcode Problem Types: CWE-79 Description: The WooCommerce Cart Count Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cart_button' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages tha
sible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8373938c-060a-4579-a133-d25b4d065d36?source=cve - https://plugins.trac.wordpress.org/browser/woo-cart-count-shortcode/trunk/woocommerce-cart-count-shortcode.php#L79
CVE ID: CVE-2024-12518 State: PUBLISHED Published: 2024-12-24T04:22:44.710Z Last Updated: 2024-12-25T02:43:48.478Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: denischerniatev Products: ShMapper by Teplitsa Problem Types: CWE-79 Description: The ShMapper by Teplitsa plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shmMap' shortcode in all versions up to, and including, 1.4.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever
attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/18e2a443-381c-46cd-85c7-20716f4e59c1?source=cve - https://plugins.trac.wordpress.org/changeset/3211065/shmapper-by-teplitsa/trunk/shortcode/shmMap.shortcode.php
CVE ID: CVE-2024-12519 State: PUBLISHED Published: 2025-01-11T07:21:51.888Z Last Updated: 2025-01-13T17:16:09.532Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: tcoder Products: TCBD Auto Refresher Problem Types: CWE-79 Description: The TCBD Auto Refresher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcbd_auto_refresh' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a u