ansulev/circl-vulnerability-scores huggingface dataset:
CVE-2017-5944: The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name.
CVSS v3.0: 8.8
CVSS v2.0: 6.5
GHSA-753j-hw6q-hx3c: A flaw has been found in Comfast CF-N1 2.6.0. Affected is the function ntp_timezone of the file /usr/bin/webmgnt. Executing manipulation of the argument timestr can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used.
CVSS v4.0: 2.1
CVSS v3.1: 6.3
GHSA-fm88-5jvj-hhfm: A vulnerability has been identified in JT2Go (All versions < V13.2), Teamcenter Visualization (All versions < V13.2). The BMP_Loader.dll library in affected applications lacks proper validation of user-supplied data prior to performing further free operations on an object when parsing BMP files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13196)
GHSA-vq3c-gpmf-8p9q: The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when deleting groups or emails, which could allow attackers to make a logged in admin remove them via a CSRF attack
CVSS v3.1: 8.8
GHSA-cv52-82gr-h293: Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and  9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVSS v3.1: 4.9
GHSA-x3fm-96g7-h798: Barracuda Network Access Client before 5.2.2 creates a Temporary File in a Directory with Insecure Permissions. This file is executed with SYSTEM privileges when an unprivileged user performs a repair operation.
CVE-2025-47957: Microsoft Word Remote Code Execution Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVSS v3.1: 8.4
GHSA-v6wr-wpj4-wj6v: Multiple PHP remote file inclusion vulnerabilities in awzMB 4.2 beta 1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the Setting[OPT_includepath] parameter to (1) adminhelp.php; and (2) admin.incl.php, (3) reg.incl.php, (4) help.incl.php, (5) gbook.incl.php, and (6) core/core.incl.php in modules/.
CVE-2023-37958: A cross-site request forgery (CSRF) vulnerability in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers to connect to an attacker-specified URL.
CVSS v3.1: 8.8
CVE-2013-2453: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier allows remote attackers to affect integrity via vectors related to JMX.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is due to a missing check for "package access" by the MBeanServer Introspector.
CVSS v2.0: 5
GHSA-mw63-q92x-5p9w: In toBARK of floor0.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-199680600
GHSA-grw3-6rpx-r7fw: Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than other CVEs listed in the February 2013 CPU.
GHSA-mp73-9w68-gx32: Heap-based buffer overflow in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 7.8
CVE-2025-49675: Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.
CVSS v3.1: 7.8
CVE-2025-70747: Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serviceName parameter of the sub_65A28 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVSS v3.1: 7.5
CVE-2022-45410: When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec and then in browsers. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.
CVSS v3.1: 6.5
CVE-2024-11978: Interinfo DreamMaker - Arbitrary File Reading through Path Traversal
DreamMaker from Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.
CVSS v3.1: 7.5
CVE-2022-24007: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the cfm binary.
CVSS v3.0: 9.6
RHSA-2025:7863: Red Hat Security Advisory: OpenShift Container Platform 4.18.14 bug fix and security update
openshift-console: OpenShift Console:  Server-Side Request Forgery golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws
CVSS v3.1: 7.5
GHSA-r2qw-hw78-874v: A CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web root directory to leak when an attacker sends a HTTP request to the web server of the device. Affected Product: Modicon M340 CPUs: BMXP34 (Versions prior to V3.40), Modicon M340 X80 Ethernet Communication Modules: BMXNOE0100 (H), BMXNOE0110 (H), BMXNOC0401, BMXNOR0200H RTU (All Versions), Modicon Premium Processors with integrated Ethernet (Copro): TSXP574634, TSXP575634, TSXP576634 (All Versions), Modicon Quantum Processors with Integrated Ethernet (Copro): 140CPU65xxxxx (All Versions), Modicon Quantum Communication Modules: 140NOE771x1, 140NOC78x00, 140NOC77101 (All Versions), Modicon Premium Communication Modules: TSXETY4103, TSXETY5103 (All Versions)
CVSS v3.1: 7.5
GHSA-hx9m-6f9p-cjmr: In the Linux kernel, the following vulnerability has been resolved:drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panelsSince commit 56de5e305d4b ("clk: renesas: r9a07g044: Add MSTOP for RZ/G2L")
we may get the following kernel panic, for some panels, when rebooting:systemd-shutdown[1]: Rebooting.
  Call trace:
   ...
   do_serror+0x28/0x68
   el1h_64_error_handler+0x34/0x50
   el1h_64_error+0x6c/0x70
   rzg2l_mipi_dsi_host_transfer+0x114/0x458 (P)
   mipi_dsi_device_transfer+0x44/0x58
   mipi_dsi_dcs_set_display_off_multi+0x9c/0xc4
   ili9881c_unprepare+0x38/0x88
   drm_panel_unprepare+0xbc/0x108This happens for panels that need to send MIPI-DSI commands in their
unprepare() callback. Since the MIPI-DSI interface is stopped at that
point, rzg2l_mipi_dsi_host_transfer() triggers the kernel panic.Fix by moving rzg2l_mipi_dsi_stop() to new callback function
rzg2l_mipi_dsi_atomic_post_disable().With this change we now have the correct power-down/stop sequence:systemd-shutdown[1]: Rebooting.
  rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_disable(): entry
  ili9881c-dsi 10850000.dsi.0: ili9881c_unprepare(): entry
  rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_post_disable(): entry
  reboot: Restarting system
CVSS v3.1: 5.5
CVE-2024-1299: Privilege Chaining in GitLab
A privilege escalation vulnerability was discovered in GitLab affecting versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. It was possible for a user with custom role of `manage_group_access_tokens` to rotate group access tokens with owner privileges.
CVSS v3.1: 6.5
GHSA-x3g3-292j-jr4g: An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Information Disclosure Vulnerability'.
GHSA-jh4v-gqwq-hfrr: When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of TLS certificate verification and encryption. This flaw affects PgBouncer versions prior to 1.16.1.
CVSS v3.1: 8.1
CVE-2007-3304: Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1 killer."
CVSS v2.0: 4.7
GHSA-74ww-2fqf-6xpf: Substance3D - Stager versions 3.1.7 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 7.8
CVE-2011-4851: The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in server/google-tools/ and certain other files.
CVSS v2.0: 9.3
CVE-2025-59227: Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVSS v3.1: 7.8
GHSA-w2gv-7447-6h8c: This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to reflected XSS.
CVSS v3.1: 6.1
CVE-2020-25926: The DNS client in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Insufficient entropy in the DNS transaction id. The impact is: DNS cache poisoning (remote). The component is: dns_query_type(). The attack vector is: a specific DNS response packet.
CVSS v3.1: 7.5
CVSS v2.0: 5
GHSA-q8qh-g793-c4pf: Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier allows local users to bypass file permissions, and read, modify, or create arbitrary files, via an "overload" of the command-line utility, aka Bug ID CSCui58229.
GHSA-jr35-f8wh-wr59: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Pets Land petsland allows PHP Local File Inclusion.This issue affects Pets Land: from n/a through <= 1.2.8.
CVSS v3.1: 8.2
GHSA-q96q-h836-9q4h: Armoury Crate Service’s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary system file, causing the logging function to overwrite the system file and disrupt the system.
CVSS v3.1: 5.9
GHSA-8vh3-ccc6-pgwp: Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Coupon Affiliates: from n/a through 6.4.0.
CVSS v3.1: 6.5
CVE-2022-29332: D-LINK DIR-825 AC1200 R2 is vulnerable to Directory Traversal. An attacker could use the "../../../../" setting of the FTP server folder to set the router's root folder for FTP access. This allows you to access the entire router file system via the FTP server.
CVSS v3.1: 6.5
CVSS v2.0: 4
CVE-2026-10061: TRENDnet TEW-432BRP formWPS command injection
A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected is the function formWPS of the file /goform/formWPS. The manipulation of the argument peerPin results in command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor explains: "This product has been EOL for 15 years (since 2009). As the item has been EOL for such a long time, we are not able to replicate or fix any vulnerabilities." This vulnerability only affects products that are no longer supported by the maintainer.
CVSS v4.0: 5.3
CVSS v3.1: 6.3
CVSS v3.0: 6.3
CVSS v2.0: 6.5
GHSA-ff7x-cjfp-39rh: In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement.
CVSS v3.1: 9.8
CVE-2025-27585: A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Print Name parameter at /rest/staffResource/update.
CVSS v3.1: 5.4
GHSA-cpm5-cqr9-7p79: Jenkins BigPanda Notifier Plugin Missing Password Field Masking
BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file `BigpandaGlobalNotifier.xml` on the Jenkins controller as part of its configuration.This API key can be viewed by users with access to the Jenkins controller file system.Additionally, the global configuration form does not mask the API key, increasing the potential for attackers to observe and capture it.
CVSS v3.1: 3.3
RHSA-2017:3475: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 security update
httpd: ap_get_basic_auth_pw() authentication bypass httpd: mod_ssl NULL pointer dereference httpd: mod_mime buffer overread httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed) apr: Out-of-bounds array deref in apr_time_exp*() functions
CVSS v3.0: 7.4
CVE-2021-38497: Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to possible user confusion and spoofing attacks. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2.
CVSS v3.1: 6.5
CVSS v2.0: 4.3
GHSA-3gv2-v3jx-r9fh: Chall-Manager is vulnerable to Path Traversal when extracting/decoding a zip archive
ImpactWhen decoding a scenario (i.e. a zip archive), the path of the file to write is not checked, potentially leading to zip slips.
Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is **highly** recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system.PatchesPatch has been implemented by [commit `47d188f`](https://github.com/ctfer-io/chall-manager/commit/47d188fda5e3f86285e820f12ad9fb6f9930662c) and shipped in [`v0.1.4`](https://github.com/ctfer-io/chall-manager/releases/tag/v0.1.4).WorkaroundsNo workaround exist.ReferencesN/A.
CVSS v4.0: 8.8
CVSS v3.1: 9.1
CVE-2020-24890: libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which may result in context-dependent arbitrary code execution. Note: this vulnerability occurs only if you compile the software in a certain way
CVSS v3.1: 5.5
CVSS v2.0: 2.6
CVE-2014-8997: Unrestricted file upload vulnerability in the Photo functionality in DigitalVidhya Digi Online Examination System 2.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in assets/uploads/images/.
CVSS v2.0: 7.5
RHSA-2013:0911: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
kernel: kvm: pv_eoi guest updates with interrupts disabled kernel: kvm: missing check in kvm_set_memory_region() kernel: veth: double-free flaw in case of congestion kernel: fs: filp leak on ro filesystem
GHSA-24rj-frg4-2q98: Buffer Overflow vulnerability in Tenda AC10V4 v.US_AC10V4.0si_V16.03.10.13_cn_TDC01 allows a remote attacker to cause a denial of service via the mac parameter in the GetParentControlInfo function.
CVSS v3.1: 9.8
GHSA-qjmm-xqq2-c7fr: VSNS Lemon 3.2.0 allows remote attackers to bypass authentication and access password-protected articles by setting the vsns[topic_id] cookie to the targeted topic.
GHSA-w2fw-m3gj-2pvm: An issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operations and the IORING_OP_MADVISE implementation, aka CID-bc0c4d1e176e.
CVSS v3.1: 4.7
CVE-2026-9789: NitroSense V3: Security Vulnerability Information
A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulnerability stems from the the PSAdminAgent service, which creates a Named Pipe with a weak Access Control List (ACL). This allows any authenticated local user to connect and send commands. Because the service does not check the caller's privileges before running file deletion commands, a low-privileged local user can exploit this to delete arbitrary files with system authority.
CVSS v4.0: 8.5
GHSA-gqc6-rvh5-fvj3: Adobe Dimension versions 3.4.7 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS v3.1: 5.5
GHSA-339m-4qw5-j2g3: Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization
A critical deserialization vulnerability exists in Tendenci Helpdesk module (NOTE, by default, Helpdesk is NOT enabled), affecting the version 15.3.11 and earlier. This vulnerability allows remote code execution (RCE) by an authenticated user with staff security level due to using Python's pickle module on the helpdesk /reports/. The damage is contained to the user that your Tendenci application runs.**Key Finding:** The original CVE-2020-14942 was incompletely patched. While `ticket_list()` was fixed to use safe JSON deserialization, the `run_report()` function still uses unsafe `pickle.loads()`.**Permission Scoping:** The impact is limited to the permissions of the user running the application, typically www-data, which generally lacks write (except for upload directories) and execute permissions.Vulnerability DetailsAffected Version**Version:** Tendenci 15.3.11 and earlier (all versions since incomplete CVE-2020-14942 patch)**Component:** `tendenci/apps/helpdesk/views/staff.py`Related CVE**CVE-2020-14942:** Original pickle deserialization vulnerability (partially patched)**GitHub Advisory:** GHSA-jqmc-fxxp-r589**Original Issue:** https://github.com/tendenci/tendenci/issues/867Tendenci User Role Hierarchy| Level | Role | Description |
|-------|------|-------------|
| 0 | `is_superuser` | Highest privilege - full Django admin |
| 1 | `is_staff` | user with Staff security level - can access helpdesk module |
| 2 | Authenticated User | Basic user access |
| 3 | Anonymous User | Public read-only access |`is_staff` is a commonly assigned role (by a superuser) for helpdesk operators who manage support tickets - not system administrators.Code Comparison (Patched vs Vulnerable)| Function | Line | Deserialization | Status |
|----------|------|-----------------|--------|
| `ticket_list()` | 763 | `simplejson.loads()` | ✅ SAFE |
| `run_report()` | 1062 | `pickle.loads()` | ❌ VULNERABLE |Why This Qualifies for CVE AssignmentThis vulnerability represents an **incomplete patch bypass** for CVE-2020-14942 with a clear exploitation path. The flaw allows a malicious user with Staff security level to achieve Remote Code Execution via Python's pickle.loads. Though the damage is contained to the user that your Tendenci application runs.RemediationUpdate Tendenci to the latest version (v15.3.12 as of now) immediately if you have Helpdesk enabled. Note that Helpdesk is not enabled by default. All of our hosted sites have been patched, although **none** of our client sites have the Helpdesk enabled.ReferencesTendenci GitHub: https://github.com/tendenci/tendenciCVE-2020-14942: https://nvd.nist.gov/vuln/detail/CVE-2020-14942GitHub Advisory: https://github.com/advisories/GHSA-jqmc-fxxp-r589Original Issue: https://github.com/tendenci/tendenci/issues/867CWE-502: https://cwe.mitre.org/data/definitions/502.htmlPython Pickle Security: https://docs.python.org/3/library/pickle.html#restricting-globals
CVSS v3.1: 6.8
CVE-2024-54852: When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper sanitization of user input, an unauthenticated attacker is then able to perform various malicious actions, such as creating arbitrary accounts and spraying passwords.
CVSS v3.1: 9.8
GHSA-3hg2-rh4r-8qf6: Apache StreamPark: Use the user’s password as the secret key Vulnerability
When encrypting sensitive data, weak encryption keys that are fixed or directly generated based on user passwords are used. Attackers can obtain these keys through methods such as reverse engineering, code leaks, or password guessing, thereby decrypting stored or transmitted encrypted data, leading to the leakage of sensitive information.This issue affects Apache StreamPark: from 2.0.0 before 2.1.7.Users are recommended to upgrade to version 2.1.7, which fixes the issue.
CVSS v4.0: 8.2
CVSS v3.1: 5.9
CVE-2025-23487: WordPress Easy Gallery plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in odihost Easy Gallery simple-gallery-odihost allows Reflected XSS.This issue affects Easy Gallery: from n/a through <= 1.4.
CVSS v3.1: 7.1
CVE-2021-1971: Possible assertion due to lack of physical layer state validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
CVSS v3.1: 7.5
RHSA-2020:0274: Red Hat Security Advisory: openjpeg2 security update
openjpeg: Heap-based buffer overflow in opj_t1_clbl_decode_processor()
CVSS v3.1: 8.1
GHSA-m6x7-7j96-472m: For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the Content Explorer application grants users the ability to upload files to shares and this image was rendered in the browser in the device's origin instead of prompting to download the asset. The application does not prevent the user from uploading SVG images and returns these images within their origin. As a result, malicious users can upload SVG images that contain arbitrary JavaScript that is evaluated when the victim issues a request to download the file.
CVSS v3.0: 8.8
GHSA-5gr3-hcq9-fp58: In memory management driver, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-185195268
CVE-2025-67630: WordPress WH Tweaks plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webheadcoder WH Tweaks wh-tweaks allows Stored XSS.This issue affects WH Tweaks: from n/a through <= 1.0.2.
CVSS v3.1: 5.9
GHSA-h3h9-3wxx-wwcf: The Custom User Profile Fields for User Registration WordPress plugin before 1.8.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS v3.1: 5.4