deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-8878
Published: 2024-09-25
Description: The password recovery mechanism for the forgotten password in Riello Netman 204 allows an attacker to reset the admin password and take over control of the device.This issue affects Netman 204: through 4.05.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-640, CWE-640
References: https://cyberdanube.com/en/en-multiple-vulnerabilities-in-riello-netman-204/index.html; http://seclists.org/fulldisclosure/2024/Sep/50
CVE: CVE-2024-8914
Published: 2024-09-25
Description: The Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.1 due to incorrect use of the wp_kses_allowed_html function, which allows the 'onclick' attribute for certain HTML elements without sufficient restriction or context validation. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/trunk/inc/functions.php#L184; https://plugins.trac.wordpress.org/changeset/3349149/; https://wordpress.org/plugins/bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang/#developers
CVE: CVE-2024-8917
Published: 2024-09-25
Description: The AnWP Football Leagues plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.16.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/football-leagues-by-anwppro/trunk/class-anwp-football-leagues.php#L675; https://plugins.trac.wordpress.org/changeset/3153845/; https://plugins.trac.wordpress.org/changeset/3153845/football-leagues-by-anwppro/trunk/class-anwp-football-leagues.php
CVE: CVE-2024-8919
Published: 2024-09-25
Description: The Confetti Fall Animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'confetti-fall-animation' shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/confetti-fall-animation/trunk/confetti-fall-animation.php#L242; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3443829%40confetti-fall-animation&new=3443829%40confetti-fall-animation&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/5b80fc93-212e-481d-907c-275139782e77?source=cve
CVE: CVE-2024-8940
Published: 2024-09-25
Description: Vulnerability in the Scriptcase application version 9.4.019, which involves the arbitrary upload of a file via /scriptcase/devel/lib/third/jquery_plugin/jQuery-File-Upload/server/php/ via a POST request. An attacker could upload malicious files to the server due to the application not properly verifying user input.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-scriptcase
CVE: CVE-2024-8941
Published: 2024-09-25
Description: Path traversal vulnerability in Scriptcase version 9.4.019, in /scriptcase/devel/compat/nm_edit_php_edit.php (in the “subpage” parameter), which allows unauthenticated remote users to bypass SecurityManager's intended restrictions and list and/or read a parent directory via a “/...” or directly into a path used in the POST parameter “field_file” by a web application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-scriptcase
CVE: CVE-2024-8942
Published: 2024-09-25
Description: Vulnerability in Scriptcase version 9.4.019 that consists of a Cross-Site Scripting (XSS), due to the lack of input validation, affecting the “id_form_msg_title” parameter, among others. This vulnerability could allow a remote user to send a specially crafted URL to a victim and retrieve their credentials.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-scriptcase
CVE: CVE-2024-9063
Published: 2024-09-25
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-2143 Reason: This candidate is a reservation duplicate of CVE-2023-2143. Notes: All CVE users should reference 
CVE-2023-2143 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-9120
Published: 2024-09-25
Description: Use after free in Dawn in Google Chrome on Windows prior to 129.0.6668.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_24.html; https://issues.chromium.org/issues/365254285
CVE: CVE-2024-9121
Published: 2024-09-25
Description: Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_24.html; https://issues.chromium.org/issues/363538434
CVE: CVE-2024-9122
Published: 2024-09-25
Description: Type Confusion in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_24.html; https://issues.chromium.org/issues/365802567
CVE: CVE-2024-9123
Published: 2024-09-25
Description: Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-472, CWE-190, CWE-190
References: https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_24.html; https://issues.chromium.org/issues/365884464
CVE: CVE-2024-9141
Published: 2024-09-25
Description: Cross-Site Scripting (XSS) vulnerability in the Oct8ne system. This flaw could allow an attacker to embed harmful JavaScript code into the body of a chat message. This manipulation occurs when the chat content is intercepted and altered, leading to the execution of the JavaScript payload.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-xss-vulnerability-oct8ne
CVE: CVE-2024-9142
Published: 2024-09-25
Description: External Control of File Name or Path, : Incorrect Permission Assignment for Critical Resource vulnerability in Olgu Computer Systems e-Belediye allows Manipulating Web Input to File System Calls.This issue affects e-Belediye: before 2.0.642.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-73, CWE-732
References: https://www.usom.gov.tr/bildirim/tr-24-1527
CVE: CVE-2024-9148
Published: 2024-09-25
Description: Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://www.tenable.com/security/research/tra-2024-40
CVE: CVE-2024-6590
Published: 2024-09-25
Description: The Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as a Table. plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 3.8.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit post status, edit Google sheet integrations, and create Google sheet integrations.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-admin.php#L1168; https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-admin.php#L812; https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-admin.php#L863
CVE: CVE-2024-7386
Published: 2024-09-25
Description: The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.9.1. This is due to missing nonce validation on the addRefund() function. This makes it possible for unauthenticated attackers to perform actions such as initiating refunds via a forged request granted they can trick a site administrator or shop manager into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3156970%40wpdm-premium-packages&new=3156970%40wpdm-premium-packages&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/0a714536-c6fd-495b-b[PII_REDACTED]29a74?source=cve
CVE: CVE-2024-7426
Published: 2024-09-25
Description: The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 6.4.6.0. This is due to the plugin displaying errors and allowing direct access to the sse.php file. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-209
References: https://plugins.trac.wordpress.org/browser/peepso-core/tags/6.4.6.1/sse.php?rev=3157925; https://wordpress.org/plugins/peepso-core/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/2e69d666-50de-4c82-9ad4-9ed40fcc7218?source=cve
CVE: CVE-2024-7491
Published: 2024-09-25
Description: The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.6.1 via the woof_messenger_remove_subscr AJAX action due to missing validation on the 'key' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to unsubscribe users from a product notification sign-ups, if they can successfully obtain or brute force the key value for users who signed up to receive notifications. This vulnerability requires the plugin's Products Messenger extension to be enabled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3156511%40woocommerce-products-filter&old=3129454%40woocommerce-products-filter&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/daf6b0d5-79a6-4b8f-924e-9e78cb2b5742?source=cve
CVE: CVE-2024-7617
Published: 2024-09-25
Description: The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 form fields in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/contact-form-to-any-api/tags/1.2.4/admin/partials/cf7-to-any-api-admin-entries.php; https://plugins.trac.wordpress.org/changeset/3158253/contact-form-to-any-api/trunk/admin/class-cf7-to-any-api-admin.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/39487908-5cc5-42ac-8af4-65626694b1e4?source=cve
CVE: CVE-2024-8349
Published: 2024-09-25
Description: The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0.1. This is due to the plugin not properly restricting what users a group leader can edit. This makes it possible for authenticated attackers, with group leader-level access and above, to change admin account email addresses which can subsequently lead to admin account access.
CVSS Score: 7.2 (HIGH)
CWE: CWE-862
References: https://github.com/karlemilnikka/CVE-2024-8349-and-CVE-2024-8350; https://www.wordfence.com/threat-intel/vulnerabilities/id/64cf0ae2-8d66-40d1-8bb6-0cab1dafab0d?source=cve
CVE: CVE-2024-8350
Published: 2024-09-25
Description: The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgm_management/v1/add_user/ REST API endpoint in all versions up to, and including, 6.1.0.1. This makes it possible for authenticated attackers, with group leader-level access and above, to add users to their group which ultimately allows them to leverage CVE-2024-8349 and gain admin access to the site.
CVSS Score: 2.7 (LOW)
CWE: CWE-862
References: https://github.com/karlemilnikka/CVE-2024-8349-and-CVE-2024-8350; https://www.wordfence.com/threat-intel/vulnerabilities/id/a38a58de-5f7d-4033-9a65-41b590b7d510?source=cve
CVE: CVE-2024-8434
Published: 2024-09-25
Description: The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions hooked via AJAX in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform actions like updating plugin settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3156084/themehunk-megamenu-plus/tags/1.1.0/inc/megamenu-base.php; https://plugins.trac.wordpress.org/changeset/3156084/themehunk-megamenu-plus/tags/1.1.0/inc/megamenu-nav-menu-settings.php; https://plugins.trac.wordpress.org/changeset/3156084/themehunk-megamenu-plus/tags/1.1.0/inc/megamenu-setting.php
CVE: CVE-2024-8476
Published: 2024-09-25
Description: The Easy PayPal Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the wpeevent_plugin_buttons() function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/easy-paypal-events-tickets/tags/1.2.1/includes/private_buttons.php#L273; https://plugins.trac.wordpress.org/browser/easy-paypal-events-tickets/tags/1.2.1/includes/private_buttons.php#L5; https://plugins.trac.wordpress.org/changeset/3155809/easy-paypal-events-tickets/trunk/includes/private_buttons.php
CVE: CVE-2024-8481
Published: 2024-09-25
Description: The The Special Text Boxes plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.2.4. This is due to the plugin adding the filter add_filter('comment_text', 'do_shortcode'); which will run all shortcodes in comments. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/changeset/3166470/; https://plugins.trac.wordpress.org/tags/6.2.2/wp-special-textboxes/trunk/stb-class.php#L36; https://www.wordfence.com/threat-intel/vulnerabilities/id/15b2a08f-2122-4eaf-ab46-1945cf6a68ca?source=cve
CVE: CVE-2024-8483
Published: 2024-09-25
Description: The MAS Static Content plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.8 via the static_content() function. This makes it possible for authenticated attackers, with contributor-level access and above, to extract potentially sensitive information from private static content pages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/mas-static-content/tags/1.0.8/includes/class-mas-static-content-shortcodes.php#L35; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3151679%40mas-static-content&new=3151679%40mas-static-content&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/794bc5cd-c9ac-4583-ae3d-a92361374b5f?source=cve
CVE: CVE-2024-8484
Published: 2024-09-25
Description: The REST API TO MiniProgram plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/watch-life-net/v1/comment/getcomments REST API endpoint in all versions up to, and including, 4.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/rest-api-to-miniprogram/tags/4.7.0/includes/api/ram-rest-comments-controller.php#L247; https://plugins.trac.wordpress.org/changeset/3337740#file63; https://www.wordfence.com/threat-intel/vulnerabilities/id/6e0945eb-ceec-4536-822a-fe864c21b580?source=cve
CVE: CVE-2024-8485
Published: 2024-09-25
Description: The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and including, 4.7.1 via the updateUserInfo() due to missing validation on the 'openid' user controlled key that determines what user will be updated. This makes it possible for unauthenticated attackers to update arbitrary user's accounts, including their email to a @weixin.com email, which can the be leveraged to reset the password of the user's account, including administrators.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/rest-api-to-miniprogram/tags/4.7.0/includes/api/ram-rest-weixin-controller.php#L264; https://plugins.trac.wordpress.org/browser/rest-api-to-miniprogram/tags/4.7.6/includes/api/ram-rest-weixin-controller.php#L264; https://www.wordfence.com/threat-intel/vulnerabilities/id/b53066d3-2ff3-4460-896a-facd77455914?source=cve
CVE: CVE-2024-8549
Published: 2024-09-25
Description: The Simple Calendar – Google Calendar Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.4.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3156894/google-calendar-events/trunk/includes/admin/notices.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3156894%40google-calendar-events&new=3156894%40google-calendar-events&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/17ae3f22-6426-48f7-93e6-c0ad515b329a?source=cve
CVE: CVE-2024-8621
Published: 2024-09-25
Description: The Daily Prayer Time plugin for WordPress is vulnerable to SQL Injection via the 'max_word' attribute of the 'quran_verse' shortcode in all versions up to, and including, 2024.08.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/daily-prayer-time-for-mosques/tags/2024.08.26/Models/QuranADay/QuranDB.php#L72; https://plugins.trac.wordpress.org/changeset/3151906/; https://www.wordfence.com/threat-intel/vulnerabilities/id/866e4bc3-080a-4498-b210-e692d72d3db0?source=cve
CVE: CVE-2024-8713
Published: 2024-09-25
Description: The Kodex Posts likes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/kodex-posts-likes/trunk/admin/partials/settings.php#L14; https://www.wordfence.com/threat-intel/vulnerabilities/id/44780988-cadf-4ff2-9ba9-148b7b6650df?source=cve
CVE: CVE-2024-8741
Published: 2024-09-25
Description: The Beam me up Scotty – Back to Top Button plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/beam-me-up-scotty/tags/1.0.21/library/template-parts/tabs.php#L27; https://plugins.trac.wordpress.org/changeset/3156146/beam-me-up-scotty/trunk/library/template-parts/tabs.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/3428bc71-64f9-4f8d-85c8-7dda81b2ac18?source=cve
CVE: CVE-2024-9024
Published: 2024-09-25
Description: The Material Design Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mdi-icon shortcode in all versions up to, and including, 0.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/material-design-icons/trunk/js/mdi-icons.js#L1311; https://plugins.trac.wordpress.org/browser/material-design-icons/trunk/plugin.php#L87; https://wordpress.org/plugins/material-design-icons/#developers
CVE: CVE-2024-9027
Published: 2024-09-25
Description: The WPZOOM Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wpzoom-shortcodes/trunk/shortcodes/shortcodes.php#L38; https://wordpress.org/plugins/wpzoom-shortcodes/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/2cc03aa9-ad3d-4abb-9c22-cb40875ece47?source=cve