Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ba965a6a-68ed-4383-93a7-593418df34a5?source=cve - https://plugins.trac.wordpress.org/browser/spoki/trunk/spoki.php#L1256 - https://wordpress.org/plugins/spoki/
CVE ID: CVE-2024-11894 State: PUBLISHED Published: 2024-12-14T04:23:46.460Z Last Updated: 2024-12-16T20:05:54.059Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: theandystratton Products: The Permalinker Problem Types: CWE-79 Description: The The Permalinker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'permalink' shortcode in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user a
s, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d03dbe48-371f-4fb7-8902-a013338ac7d4?source=cve - https://plugins.trac.wordpress.org/browser/the-permalinker/trunk/the-permalinker.php#L14
CVE ID: CVE-2024-11895 State: PUBLISHED Published: 2025-02-18T07:28:13.206Z Last Updated: 2025-02-18T15:33:20.996Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: vcita Products: Online Payments – Get Paid with PayPal, Square & Stripe Problem Types: CWE-79 Description: The Online Payments – Get Paid with PayPal, Square & Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.20.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitr
ttributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aab33299-f02d-44a1-9522-5309eed6fd38?source=cve - https://plugins.trac.wordpress.org/browser/paypal-payment-button-by-vcita/tags/3.10.0/core/shortcodes.php#L22 - https://plugins.trac.wordpress.org/browser/paypal-payment-button-by-vcita/tags/3.10.0/core/shortcodes.php#L50 - https://plugins.trac.wordpress.org/browser/paypal-payment-button-by-vcita/tags/3.10.0/core/shortc
e/shortcodes.php#L50 - https://plugins.trac.wordpress.org/browser/paypal-payment-button-by-vcita/tags/3.10.0/core/shortcodes.php#L91 - https://plugins.trac.wordpress.org/browser/paypal-payment-button-by-vcita/tags/3.10.0/core/shortcodes.php#L129 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3241650%40paypal-payment-button-by-vcita&new=3241650%40paypal-payment-button-by-vcita&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11896 State: PUBLISHED Published: 2024-12-24T08:22:03.283Z Last Updated: 2024-12-24T16:30:53.717Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: flippercode Products: Text Prompter – Unlimited chatgpt text prompts for openai tasks Problem Types: CWE-79 Description: The Text Prompter – Unlimited chatgpt text prompts for openai tasks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'text_prompter' shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-leve
d output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/165f988d-ec6d-44f7-8884-23aedc2fcb08?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3212197%40ai-content&new=3212197%40ai-content&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11897 State: PUBLISHED Published: 2024-12-04T02:40:26.838Z Last Updated: 2024-12-04T14:09:10.105Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mightyforms Products: Contact Form, Survey & Form Builder – MightyForms Problem Types: CWE-79 Description: The Contact Form, Survey & Form Builder – MightyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mightyforms' shortcode in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject
lied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c691e469-3bd2-415d-8feb-9ae94aeaf339?source=cve - https://plugins.trac.wordpress.org/browser/mightyforms/trunk/shortcode.php#L13 - https://wordpress.org/plugins/mightyforms/
CVE ID: CVE-2024-11898 State: PUBLISHED Published: 2024-12-03T07:34:58.010Z Last Updated: 2024-12-03T11:23:42.605Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: akashmalik Products: Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more Problem Types: CWE-79 Description: The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swin-campaign' shortcode in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping on user suppl
ode in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5b7f3f0f-5f02-41d7-ac37-ecdde74fc532?source=cve - https://plugins.trac.wordpress.org/browser/scratch-win-giveaways-for-website-facebook/tags/2.6.9/socialscratchwin.php#L155 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&repo
-facebook/tags/2.6.9/socialscratchwin.php#L155 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3199234%40scratch-win-giveaways-for-website-facebook&new=3199234%40scratch-win-giveaways-for-website-facebook&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11899 State: PUBLISHED Published: 2025-01-07T03:21:58.788Z Last Updated: 2025-01-07T16:27:26.131Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bqworks Products: Slider Pro Lite Problem Types: CWE-79 Description: The Slider Pro Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sliderpro' shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d10036de-940f-4772-9aca-13bc647548d2?source=cve - https://plugins.trac.wordpress.org/browser/slider-pro-lite/tags/1.4.1/public/class-sliderpro.php#L98 - https://plugins.trac.wordpress.org/browser/slider-pro-lite/tags/1.4.1/public/class-sliderpro.php#L447 - https://plugins.trac.wordpress.org/browser/slider-pro-lite/tags/1.4.1/public/class-sliderpro.php#L310 - https://plugins.trac.wordpress.org/browser/slider-pro-lite/tags/1.4.1/public/c
s/1.4.1/public/class-sliderpro.php#L310 - https://plugins.trac.wordpress.org/browser/slider-pro-lite/tags/1.4.1/public/class-slider-renderer.php#L181
CVE ID: CVE-2024-11900 State: PUBLISHED Published: 2024-12-16T23:24:16.828Z Last Updated: 2024-12-17T14:33:59.661Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: logichunt Products: Portfolio – Filterable Masonry Portfolio Gallery for Professionals Problem Types: CWE-79 Description: The Portfolio – Filterable Masonry Portfolio Gallery for Professionals plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'portfolio-pro' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-
n and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1989fe85-5c32-4671-bd20-f9d05cb5034c?source=cve - https://plugins.trac.wordpress.org/browser/portfolio-pro/trunk/public/class-portfolio-pro-public.php#L358
CVE ID: CVE-2024-11901 State: PUBLISHED Published: 2024-12-12T03:23:09.627Z Last Updated: 2024-12-12T15:52:23.379Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cyberlord92 Products: PowerBI Embed Reports Problem Types: CWE-79 Description: The PowerBI Embed Reports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MO_API_POWER_BI' shortcode in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whe
cated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c62aa119-98bc-485e-92f2-43bf21756ebd?source=cve - https://plugins.trac.wordpress.org/browser/embed-power-bi-reports/tags/1.1.7/Controller/powerBIConfig.php#L306
CVE ID: CVE-2024-11902 State: PUBLISHED Published: 2024-12-16T23:24:17.375Z Last Updated: 2024-12-17T14:34:31.170Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: slopeit Products: Slope Widgets Problem Types: CWE-79 Description: The Slope Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slope-reservations' shortcode in all versions up to, and including, 4.2.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acc
with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7700f1f3-90e2-450d-9cfe-c922d0cc6a1e?source=cve - https://plugins.trac.wordpress.org/browser/slope-widgets/trunk/slope-reservations.php#L298 - https://wordpress.org/plugins/slope-widgets/
CVE ID: CVE-2024-11903 State: PUBLISHED Published: 2024-12-04T07:32:27.563Z Last Updated: 2024-12-04T14:09:09.499Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: timsayshey Products: WP eCards Problem Types: CWE-79 Description: The WP eCards plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ecard' shortcode in all versions up to, and including, 1.3.904 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected
-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fa8e1df5-2e8a-4c84-83f8-6f6d53d00356?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3199511%40wp-ecards-invites&new=3199511%40wp-ecards-invites&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11904 State: PUBLISHED Published: 2024-12-07T01:45:50.835Z Last Updated: 2024-12-09T18:03:34.927Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: codemstory Products: 코드엠샵 소셜톡 Problem Types: CWE-79 Description: The 코드엠샵 소셜톡 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'msntt_add_plus_talk' shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a
ontributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8e501b31-a7f4-4d0d-bf83-af7b6c023a6b?source=cve - https://plugins.trac.wordpress.org/changeset/3202813/
CVE ID: CVE-2024-11905 State: PUBLISHED Published: 2024-12-16T23:24:17.743Z Last Updated: 2024-12-17T14:34:54.321Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: freeben Products: Animated Counters Problem Types: CWE-79 Description: The Animated Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'animatedcounte' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user ac
, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/afd2f09c-4bd5-47a5-8d4f-7345aa8925f8?source=cve - https://plugins.trac.wordpress.org/browser/animated-counters/trunk/animated-counters.php#L32 - https://wordpress.org/plugins/animated-counters/
CVE ID: CVE-2024-11906 State: PUBLISHED Published: 2024-12-16T23:24:18.112Z Last Updated: 2024-12-17T14:35:14.559Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cswaim Products: TPG Get Posts Problem Types: CWE-79 Description: The TPG Get Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tpg_get_posts' shortcode in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a
ontributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c22288e6-76f3-4c5a-bd7b-30681334bab7?source=cve - https://plugins.trac.wordpress.org/browser/tpg-get-posts/trunk/inc/class-tpg-gp-process.php#L478 - https://wordpress.org/plugins/tpg-get-posts/
CVE ID: CVE-2024-11907 State: PUBLISHED Published: 2025-01-09T11:10:59.760Z Last Updated: 2025-01-09T14:29:00.571Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: skyword Products: Skyword API Plugin Problem Types: CWE-79 Description: The Skyword API Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skyword_iframe' shortcode in all versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a use
kers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/615eb349-c5ed-4b6e-bd60-b92b8790427f?source=cve - https://plugins.trac.wordpress.org/browser/skyword-plugin/trunk/php/class-skyword-shortcode.php#L93 - https://wordpress.org/plugins/skyword-plugin/
CVE ID: CVE-2024-11910 State: PUBLISHED Published: 2024-12-13T08:24:50.965Z Last Updated: 2024-12-16T20:07:18.828Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themeum Products: WP Crowdfunding Problem Types: CWE-79 Description: The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search block in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional
above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b1541aaf-9f35-44b5-a985-1b8d33228f0a?source=cve - https://plugins.trac.wordpress.org/browser/wp-crowdfunding/trunk/includes/blocks/Search.php#L70 - https://wordpress.org/plugins/wp-crowdfunding/ - https://plugins.trac.wordpress.org/changeset/3206336/wp-crowdfunding/trunk/includes/blocks/Search.php
CVE ID: CVE-2024-11911 State: PUBLISHED Published: 2024-12-13T08:24:50.235Z Last Updated: 2024-12-16T20:07:27.042Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: themeum Products: WP Crowdfunding Problem Types: CWE-862 Description: The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_woocommerce_plugin() function action in all versions up to, and including, 2.1.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install WooCommerce. This has a limited impact on most sites because WooCommerce is a requirement. Additional Analy
, to install WooCommerce. This has a limited impact on most sites because WooCommerce is a requirement. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/972be091-64c4-4cb7-9563-70249c0db157?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3206336%40wp-crowdfunding%2Ftrunk&old=3174230%40wp-crowdfunding%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-11912 State: PUBLISHED Published: 2024-12-18T11:09:32.113Z Last Updated: 2024-12-18T16:29:47.106Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ShineTheme Products: Travel Booking WordPress Theme Problem Types: CWE-89 Description: The Travel Booking WordPress Theme theme for WordPress is vulnerable to blind time-based SQL Injection via the ‘order_id’ parameter in all versions up to, and including, 3.1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that
This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/febd1ff3-3a1a-49c2-b210-9e72051e3172?source=cve - https://travelerwp.com/traveler-changelog/
CVE ID: CVE-2024-11913 State: PUBLISHED Published: 2025-01-24T13:40:57.391Z Last Updated: 2025-01-27T14:54:56.269Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: buddydev Products: Activity Plus Reloaded for BuddyPress Problem Types: CWE-918 Description: The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 via the 'ajax_preview_link' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify infor
make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/69485409-8e91-4651-b9b8-69beb2364fa8?source=cve - https://plugins.trac.wordpress.org/browser/bp-activity-plus-reloaded/tags/1.1.2/src/handlers/class-bpapr-preview-handler.php
CVE ID: CVE-2024-11914 State: PUBLISHED Published: 2024-12-12T03:23:06.981Z Last Updated: 2024-12-12T15:09:09.581Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: shafayat-alam Products: Gutenberg Blocks and Page Layouts – Attire Blocks Problem Types: CWE-79 Description: The Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'attire-blocks/post-carousel' block in all versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts i
akes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5c7973be-cf39-4452-9e41-19d2e6aa5e97?source=cve - https://plugins.trac.wordpress.org/browser/attire-blocks/trunk/blocks/dynamic/post-carousel/index.php#L445 - https://wordpress.org/plugins/attire-blocks/