deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-65959
Published: 2025-12-04
Description: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Stored XSS vulnerability was discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing them to execute arbitrary JavaScript code and steal session tokens when a victim downloads the note as PDF. This vulnerability can be exploited by any authenticated user, and unauthenticated external attackers can steal session tokens from users (both admin and regular users) by sharing specially crafted markdown files. This vulnerability is fixed in 0.6.37.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://github.com/open-webui/open-webui/commit/03cc6ce8eb5c055115406e2304fbf7e3338b8dce; https://github.com/open-webui/open-webui/security/advisories/GHSA-8wvc-869r-xfqf; https://github.com/open-webui/open-webui/security/advisories/GHSA-8wvc-869r-xfqf
CVE: CVE-2025-66237
Published: 2025-12-04
Description: DCIM dcTrack platforms utilize default and hard-coded credentials for access. An attacker could use these credentials to administer the database, escalate privileges on the platform or execute system commands on the host.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-798
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-338-05.json; https://www.cisa.gov/news-events/ics-advisories/icsa-25-338-05
CVE: CVE-2025-66479
Published: 2025-12-04
Description: Anthropic Sandbox Runtime is a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container. Prior to 0.0.16, due to a bug in sandboxing logic, sandbox-runtime did not properly enforce a network sandbox if the sandbox policy did not configure any allowed domains. This could allow sandboxed code to make network requests outside of the sandbox. A patch for this was released in v0.0.16.
CWE: CWE-693
References: https://github.com/anthropic-experimental/sandbox-runtime/commit/bea2930cc1db9c73a1b15acf6dc19c5261aec1f3; https://github.com/anthropic-experimental/sandbox-runtime/security/advisories/GHSA-9gqj-5w7c-vx47
CVE: CVE-2025-66555
Published: 2025-12-04
Description: AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type arbitrary keystrokes directly into the victim's iOS device in real-time without user interaction, resulting in full remote input control.
CWE: CWE-306
References: https://airkeyboardapp.com; https://apps.apple.com/us/app/air-keyboard/id[PII_REDACTED]; https://www.exploit-db.com/exploits/52333
CVE: CVE-2025-66571
Published: 2025-12-04
Description: UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially write and execute arbitrary PHP code.
CWE: CWE-502
References: https://github.com/unacms/una; https://karmainsecurity.com/KIS-2025-01; https://unacms.com
CVE: CVE-2025-66572
Published: 2025-12-04
Description: Loaded Commerce 6.6 contains a client-side template injection vulnerability that allows unauthenticated attackers to execute code on the server via the search parameter.
CWE: CWE-78
References: https://loadedcommerce.com/; https://www.exploit-db.com/exploits/52084; https://www.vulncheck.com/advisories/loaded-commerce-66-client-side-template-injectioncsti
CVE: CVE-2025-66573
Published: 2025-12-04
Description: Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint (`/api/config`) that exposes sensitive information such as the session key, server version, product details, and display name. Unauthorized users can extract live session information by accessing this endpoint without authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://documentation.mersive.com/en/solstice/about-solstice.html; https://www.exploit-db.com/exploits/52104; https://www.mersive.com/
CVE: CVE-2025-66574
Published: 2025-12-04
Description: TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the `Open Object in Tree` endpoint, allowing attackers to steal session cookies and potentially escalate privileges.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://compassplustechnologies.com/; https://www.exploit-db.com/exploits/52086; https://www.vulncheck.com/advisories/tranzaxis-32411026-stored-cross-site-scripting-xss
CVE: CVE-2025-66575
Published: 2025-12-04
Description: VeeVPN 1.6.1 contains an unquoted service path vulnerability in the VeePNService that allows remote attackers to execute code during startup or reboot with escalated privileges. Attackers can exploit this by providing a malicious service name, allowing them to inject commands and run as LocalSystem.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://github.com/veepn/veepn; https://veepn.com/; https://www.exploit-db.com/exploits/52088
CVE: CVE-2025-66576
Published: 2025-12-04
Description: Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://apps.microsoft.com/detail/9n0jw8v5sc9m?hl=neutral&gl=US&ocid=pdpshare; https://remotecontrolio.web.app/; https://www.exploit-db.com/exploits/52299
CVE: CVE-2025-10285
Published: 2025-12-04
Description: The web interface of the Silicon Labs Simplicity Device Manager is exposed publicly and can be used to extract the NTLMv2 hash which an attacker could use to crack the user's domain password.
CWE: CWE-200
References: https://community.silabs.com/a45Vm0000003UcfIAE
CVE: CVE-2025-11838
Published: 2025-12-04
Description: A memory corruption vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker to trigger a Denial of Service (DoS) condition in the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.

This vulnerability affects Fireware OS 12.6.1 up to and including 12.11.4 and 2025.1 up to and including 2025.1.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-763
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00018
CVE: CVE-2025-12026
Published: 2025-12-04
Description: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS’s certificate request command could allow an authenticated privileged user to execute arbitrary code via specially crafted CLI commands.This vulnerability affects Fireware OS 12.0 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00017
CVE: CVE-2025-12195
Published: 2025-12-04
Description: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via specially crafted IPSec configuration CLI commands.This vulnerability affects Fireware OS 11.0 up to and including 11.12.4+541730, 12.0 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00019
CVE: CVE-2025-12196
Published: 2025-12-04
Description: An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially crafted CLI command.This vulnerability affects Fireware OS 12.0 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00020
CVE: CVE-2025-12986
Published: 2025-12-04
Description: When a WF200/WGM160P device is configured to operate as an Access Point, it may be vulnerable to a denial of service triggered by a malformed packet. The device may recover automatically or require a hard reset.
CWE: CWE-410
References: https://community.silabs.com/068Vm00000akaGr
CVE: CVE-2025-13932
Published: 2025-12-04
Description: The SolisCloud API suffers from a Broken Access Control vulnerability, specifically an Insecure Direct Object Reference (IDOR), where any authenticated user can access detailed data of any plant by altering the plant_id in the request.
CWE: CWE-639
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-338-06
CVE: CVE-2025-13936
Published: 2025-12-04
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Tigerpaw Technology Integration module) allows Stored XSS.This issue affects Fireware OS 12.4 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00021
CVE: CVE-2025-13937
Published: 2025-12-04
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (ConnectWise Technology Integration module) allows Stored XSS.This issue affects Fireware OS 12.4 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00022
CVE: CVE-2025-13938
Published: 2025-12-04
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Autotask Technology Integration module) allows Stored XSS.This issue affects Fireware OS 12.4 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00023
CVE: CVE-2025-13939
Published: 2025-12-04
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS (Gateway Wireless Controller module) allows Stored XSS.This issue affects Fireware OS 11.7.2 up to and including 11.12.4+541730, 12.0 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00024
CVE: CVE-2025-13940
Published: 2025-12-04
Description: An Expected Behavior Violation [CWE-440] vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS boot time system integrity check and prevent the Firebox from shutting down in the event of a system integrity check failure. The on-demand system integrity check in the Fireware Web UI will correctly show a failed system integrity check message in the event of a failure.This issue affects Fireware OS: from 12.8.1 through 12.11.4, from 2025.1 through 2025.1.2.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-440
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00026
CVE: CVE-2025-1545
Published: 2025-12-04
Description: An XPath Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from the Firebox configuration through an exposed authentication or management web interface. This vulnerability only affects Firebox systems that have at least one authentication hotspot configured.This issue affects Fireware OS 11.11 up to and including 11.12.4+541730, 12.0 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-91
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00025
CVE: CVE-2025-1547
Published: 2025-12-04
Description: A stack-based buffer overflow vulnerability [CWE-121] in WatchGuard Fireware OS's certificate request command could allow an authenticated privileged user to execute arbitrary code via specially crafted CLI commands.This issue affects Fireware OS: from 12.0 through 12.5.12+701324, from 12.6 through 12.11.2.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00013
CVE: CVE-2025-1910
Published: 2025-12-04
Description: The WatchGuard Mobile VPN with SSL Client on Windows allows a locally 
authenticated non-administrative Windows user to escalate their 
privileges to NT AUTHORITY/SYSTEM on the Windows machine where the VPN 
Client is installed.This issue affects the Mobile VPN with SSL Client 12.0 up to and including 12.11.2.
CWE: CWE-77
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00008
CVE: CVE-2025-53704
Published: 2025-12-04
Description: The password reset mechanism for the Pivot client application is weak, and it may allow an attacker to take over the account.
CVSS Score: 7.5 (HIGH)
CWE: CWE-640
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-338-02.json; https://www.cisa.gov/news-events/ics-advisories/icsa-25-338-02; https://www.maxhub.com/en/support/
CVE: CVE-2025-65899
Published: 2025-12-04
Description: Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users (user_not_found) versus valid users with incorrect passwords (invalid_password). This observable response discrepancy allows unauthenticated attackers to enumerate valid usernames on the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204
References: https://github.com/DifuseHQ/Kalmia; https://github.com/Noxurge/CVE-2025-65899/blob/main/README.md
CVE: CVE-2025-65900
Published: 2025-12-04
Description: Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all platform users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/DifuseHQ/Kalmia; https://github.com/Noxurge/CVE-2025-65900/blob/main/README.md
CVE: CVE-2025-66238
Published: 2025-12-04
Description: DCIM dcTrack allows an attacker to misuse certain remote access features. An authenticated user with access to the appliance's virtual console could exploit these features to redirect network traffic, potentially accessing restricted services or data on the host machine.
CVSS Score: 7.2 (HIGH)
CWE: CWE-288
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-338-05.json; https://www.cisa.gov/news-events/ics-advisories/icsa-25-338-05
CVE: CVE-2025-66506
Published: 2025-12-04
Description: Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This vulnerability is fixed in 1.8.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-405
References: https://github.com/sigstore/fulcio/commit/765a0e57608b9ef390e1eeeea8595b9054c63a5a; https://github.com/sigstore/fulcio/security/advisories/GHSA-f83f-xpx7-ffpw
CVE: CVE-2025-66509
Published: 2025-12-04
Description: LaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow trusts the Host header, allowing attackers to redirect the administrator’s reset token to an attacker-controlled server. This can be combined with the module installation process to automatically execute the ServiceProvider::boot() method, enabling arbitrary PHP code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/laradashboard/laradashboard/commit/cc42f9cdf8e59bce794ee2d812a9709b1e6efa87; https://github.com/laradashboard/laradashboard/security/advisories/GHSA-j9mm-c9cj-pc82
CVE: CVE-2025-6946
Published: 2025-12-04
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the IPS module. This vulnerability requires an authenticated administrator session to a locally managed Firebox.

This issue affects Firebox: from 12.0 through 12.11.2.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00011
CVE: CVE-2025-13373
Published: 2025-12-04
Description: Advantech iView versions 5.7.05.7057 and prior do not properly sanitize SNMP v1 trap (Port 162) requests, which could allow an attacker to inject SQL commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-338-07.json; https://www.advantech.com/zh-tw/support/details/firmware?id=1-HIPU-183; https://www.cisa.gov/news-events/ics-advisories/icsa-25-338-07
CVE: CVE-2025-14051
Published: 2025-12-04
Description: A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function getById/updateAddress/deleteAddress of the file /mall-ums/app-api/v1/addresses/. Executing manipulation can lead to improper control of dynamically-identified variables. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-913, CWE-914
References: https://github.com/Hwwg/cve/issues/18; https://github.com/Hwwg/cve/issues/19; https://vuldb.com/?ctiid.334367
CVE: CVE-2025-66559
Published: 2025-12-04
Description: Taiko Alethia is an Ethereum-equivalent, permissionless, based rollup designed to scale Ethereum without compromising its fundamental properties. In 2.3.1 and earlier, TaikoInbox._verifyBatches (packages/protocol/contracts/layer1/based/TaikoInbox.sol:627-678) advanced the local tid to whatever transition matched the current blockHash before knowing whether that batch would actually be verified. When the loop later broke (e.g., cooldown window not yet passed or transition invalidated), the function still wrote that newer tid into batches[lastVerifiedBatchId].verifiedTransitionId after decrementing batchId. Result: the last verified batch could end up pointing at a transition index from the next batch (often zeroed), corrupting the verified chain pointer.
CWE: CWE-129
References: https://github.com/taikoxyz/taiko-mono/commit/379f5cb4ffe9e1945563ab2c7740bc9f4ea004d8; https://github.com/taikoxyz/taiko-mono/security/advisories/GHSA-5mxh-r33p-6h5x
CVE: CVE-2025-66561
Published: 2025-12-04
Description: SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated users to execute malicious JavaScript in the context of other logged-in users by uploading malicious JavaScript files in the web UI. This vulnerability is fixed in 2025.102.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://github.com/Syslifters/sysreptor/security/advisories/GHSA-64vw-v5c4-mgvm
CVE: CVE-2025-66563
Published: 2025-12-04
Description: Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user input which allows an attacker to execute malicious javascript on anyone viewing a malicious quote submission. quote.text and quote.source are user input, and they're inserted straight into the DOM. If they contain HTML tags, they will be rendered (after some escaping using quotes and textarea tags).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/monkeytypegame/monkeytype/commit/d6d062a77132ba7d6ba3b482d46ae329d3b8d695; https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-mfjh-9552-8g27; https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-mfjh-9552-8g27
CVE: CVE-2025-66564
Published: 2025-12-04
Description: Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which is also untrusted data) on an application string. As a result, in the face of a malicious request with either an excessively long OID in the payload containing many period characters or a malformed Content-Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-405
References: https://github.com/sigstore/timestamp-authority/commit/0cae34e197d685a14904e0bad135b89d13b69421; https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-4qg8-fj49-pxjh
CVE: CVE-2025-14052
Published: 2025-12-05
Description: A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected by this vulnerability is the function getMemberById of the file /mall-ums/app-api/v1/members/. The manipulation of the argument memberId leads to improper access controls. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://github.com/Hwwg/cve/issues/21; https://vuldb.com/?ctiid.334368; https://vuldb.com/?id.334368
CVE: CVE-2025-62223
Published: 2025-12-05
Description: User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-451
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62223
CVE: CVE-2025-11759
Published: 2025-12-05
Description: The Backup, Restore and Migrate your sites with XCloner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.2. This is due to missing or incorrect nonce validation on the Xcloner_Remote_Storage:save() function. This makes it possible for unauthenticated attackers to add or modify an FTP backup configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation allows an attacker to set an attacker-controlled FTP site for backup storage and exfiltrate potentially sensitive site data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset/3398881/xcloner-backup-and-restore; https://www.wordfence.com/threat-intel/vulnerabilities/id/a76a8e36-635a-48a3-8683-c24a0395212e?source=cve
CVE: CVE-2025-12804
Published: 2025-12-05
Description: The Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin 'bookingcalendar' shortcode in all versions up to, and including, 10.14.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3391614/booking; https://www.wordfence.com/threat-intel/vulnerabilities/id/ad993a62-457a-494f-a7c8-256b808d18c0?source=cve