deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-23943
Published: 2025-01-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aruvi PDF.js Shortcode pdfjs-shortcode allows Stored XSS.This issue affects PDF.js Shortcode: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/pdfjs-shortcode/vulnerability/wordpress-pdf-js-shortcode-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23946
Published: 2025-01-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Le-Pixel-Solitaire Enhanced YouTube Shortcode enhanced-youtube-shortcode allows Stored XSS.This issue affects Enhanced YouTube Shortcode: from n/a through <= 2.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/enhanced-youtube-shortcode/vulnerability/wordpress-enhanced-youtube-shortcode-plugin-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23947
Published: 2025-01-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M.J WP-Player wp-player allows Stored XSS.This issue affects WP-Player: from n/a through <= 2.6.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-player/vulnerability/wordpress-wp-player-plugin-2-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23950
Published: 2025-01-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ezmarketing EZPlayer ezplayer allows Stored XSS.This issue affects EZPlayer: from n/a through <= 1.0.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ezplayer/vulnerability/wordpress-ezplayer-plugin-1-0-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23951
Published: 2025-01-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DIVENGINE Gallery: Hybrid – Advanced Visual Gallery hybrid-gallery allows Stored XSS.This issue affects Gallery: Hybrid – Advanced Visual Gallery: from n/a through <= 1.4.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/hybrid-gallery/vulnerability/wordpress-gallery-hybrid-advanced-visual-gallery-plugin-1-4-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23954
Published: 2025-01-16
Description: Missing Authorization vulnerability in awcode Salvador – AI Image Generator salvador-ai-image-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salvador – AI Image Generator: from n/a through <= 1.0.11.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/salvador-ai-image-generator/vulnerability/wordpress-salvador-ai-image-generator-plugin-1-0-11-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-23955
Published: 2025-01-16
Description: Missing Authorization vulnerability in xola Xola xola-bookings-for-tours-activities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xola: from n/a through <= 1.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/xola-bookings-for-tours-activities/vulnerability/wordpress-xola-plugin-1-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-23957
Published: 2025-01-16
Description: Missing Authorization vulnerability in surdotly Sur.ly surly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sur.ly: from n/a through <= 3.0.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/surly/vulnerability/wordpress-sur-ly-plugin-3-0-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-23961
Published: 2025-01-16
Description: Missing Authorization vulnerability in wptasker WordPress Graphs & Charts graph-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Graphs & Charts: from n/a through <= 2.0.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/graph-lite/vulnerability/wordpress-wordpress-graphs-charts-plugin-2-0-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-23962
Published: 2025-01-16
Description: Missing Authorization vulnerability in jjtrabucco Goldstar goldstar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Goldstar: from n/a through <= 2.1.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/goldstar/vulnerability/wordpress-goldstar-plugin-2-1-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-23963
Published: 2025-01-16
Description: Missing Authorization vulnerability in flymke Mark Posts mark-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mark Posts: from n/a through <= 2.2.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/mark-posts/vulnerability/wordpress-mark-posts-plugin-2-2-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-23965
Published: 2025-01-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kopatheme Kopa Nictitate Toolkit kopa-nictitate-toolkit allows Stored XSS.This issue affects Kopa Nictitate Toolkit: from n/a through <= 1.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/kopa-nictitate-toolkit/vulnerability/wordpress-kopa-nictitate-toolkit-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-46450
Published: 2025-01-16
Description: Incorrect access control in Tenda AC1200 Smart Dual-Band WiFi Router Model AC6 v2.0 Firmware v15.03.06.50 allows attackers to bypass authentication via a crafted web request.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://pastebin.com/BXxTqsZk
CVE: CVE-2024-48460
Published: 2025-01-16
Description: An issue in Eugeny Tabby 1.0.213 allows a remote attacker to obtain sensitive information via the server and sends the SSH username and password even when the host key verification fails.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-295
References: https://github.com/Eugeny/tabby/issues/9955
CVE: CVE-2024-54660
Published: 2025-01-16
Description: A JNDI injection issue was discovered in Cloudera JDBC Connector for Hive before 2.6.26 and JDBC Connector for Impala before 2.6.35. Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This could lead to remote code execution. JNDI injection is possible via the JDBC connection property krbJAASFile for the Java Authentication and Authorization Service (JAAS). Using untrusted parameters in the krbJAASFile and/or remote host can trigger JNDI injection in the JDBC URL through the krbJAASFile.
CVSS Score: 8.7 (HIGH)
CWE: CWE-77
References: https://www.blackhat.com/eu-24/briefings/schedule/index.html#a-novel-attack-surface-java-authentication-and-authorization-service-jaas-42179
CVE: CVE-2024-55511
Published: 2025-01-16
Description: A null pointer dereference vulnerability in Macrium Reflect prior to 8.1.8017 allows a local attacker to cause a system crash or potentially elevate their privileges via executing a specially crafted executable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://github.com/nikosecurity/CVE-2024-55511; https://updates.macrium.com/reflect/v8/v8.1.8017/details8.1.8017.htm
CVE: CVE-2019-3309
Published: 2025-01-16
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is mistakenly published by the other party.
CVE: CVE-2023-22139
Published: 2025-01-16
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is mistakenly published by the other party.
CVE: CVE-2024-40513
Published: 2025-01-16
Description: An issue in themesebrand Chatvia v.5.3.2 allows a remote attacker to execute arbitrary code via the User profile Upload image function.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-434
References: https://github.com/php-lover-boy/ChatVia
CVE: CVE-2024-40514
Published: 2025-01-16
Description: Insecure Permissions vulnerability in themesebrand Chatvia v.5.3.2 allows a remote attacker to escalate privileges via the User profile name and image upload functions.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-276
References: https://github.com/php-lover-boy/ChatVia
CVE: CVE-2024-53553
Published: 2025-01-16
Description: An issue in OPEXUS FOIAXPRESS PUBLIC ACCESS LINK v11.1.0 allows attackers to bypass authentication via crafted web requests.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863
References: https://github.com/Turbul3nce/Vulnerability.Research/tree/main/CVE-2024-53553; https://infosecwriteups.com/exploiting-execute-after-redirect-ear-vulnerability-in-htb-previse-92ea3f1dbf3d
CVE: CVE-2024-56144
Published: 2025-01-16
Description: librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters (Replace $DEVICE_ID with your specific $DEVICE_ID value):`/device/$DEVICE_ID/edit` -> param: display. Librenms versions up to 24.11.0 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.12.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/security/advisories/GHSA-2f4w-6mc7-4w78
CVE: CVE-2024-57703
Published: 2025-01-16
Description: Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability. Affected by this vulnerability is the function setSchedWifi of the file /goform/openSchedWifi. The manipulation of the argument schedEndTime leads to stack-based buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-120
References: https://github.com/Pr0b1em/IoT/blob/master/Tenda%20AC8v4%20V16.03.34.06.md
CVE: CVE-2024-57704
Published: 2025-01-16
Description: Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability. Affected by this vulnerability is the function setSchedWifi of the file /goform/openSchedWifi. The manipulation of the argument schedStartTime leads to stack-based buffer overflow.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/Pr0b1em/IoT/blob/master/Tenda%20AC8v4%20V16.03.34.06.md
CVE: CVE-2024-57784
Published: 2025-01-16
Description: An issue in the component /php/script_uploads.php of Zenitel AlphaWeb XE v11.2.3.10 allows attackers to execute a directory traversal.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://gist.github.com/s4fv4n/8cc4e4cb6fd028e803898837b73aa342
CVE: CVE-2024-57785
Published: 2025-01-16
Description: Zenitel AlphaWeb XE v11.2.3.10 was discovered to contain a local file inclusion vulnerability via the component amc_uploads.php.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-706
References: https://gist.github.com/s4fv4n/56c326450dcb3ab808b5ce8242a11e30
CVE: CVE-2025-23198
Published: 2025-01-16
Description: librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters (Replace $DEVICE_ID with your specific $DEVICE_ID value):`/device/$DEVICE_ID/edit` -> param: display. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/security/advisories/GHSA-pm8j-3v64-92cq
CVE: CVE-2025-23199
Published: 2025-01-16
Description: librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: `/ajax_form.php` -> param: descr. Librenms version up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/security/advisories/GHSA-27vf-3g4f-6jp7
CVE: CVE-2025-23200
Published: 2025-01-16
Description: librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: `ajax_form.php` -> param: state. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/security/advisories/GHSA-c66p-64fj-jmc2
CVE: CVE-2025-23201
Published: 2025-01-16
Description: librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to Cross-site Scripting (XSS) on the parameters:`/addhost` -> param: community. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/librenms/librenms/security/advisories/GHSA-g84x-g96g-rcjc
CVE: CVE-2024-34579
Published: 2025-01-17
Description: Fuji Electric Alpha5 SMART 

is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-016-05
CVE: CVE-2025-21325
Published: 2025-01-17
Description: Windows Secure Kernel Mode Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21325
CVE: CVE-2024-52363
Published: 2025-01-17
Description: IBM InfoSphere Information Server 11.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.ibm.com/support/pages/node/7176515
CVE: CVE-2024-51462
Published: 2025-01-17
Description: IBM QRadar WinCollect Agent 10.0.0 through 10.1.12 could allow a remote attacker to inject XML data into parameter values due to improper input validation of assumed immutable data.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-471
References: https://www.ibm.com/support/pages/node/7176043
CVE: CVE-2024-13398
Published: 2025-01-17
Description: The Checkout for PayPal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'checkout_for_paypal' shortcode in all versions up to, and including, 1.0.32 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3223256%40checkout-for-paypal&new=3223256%40checkout-for-paypal&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c2e552b8-84ad-436d-b029-f7dd4534f7d5?source=cve
CVE: CVE-2024-13401
Published: 2025-01-17
Description: The Payment Button for PayPal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_paypal_checkout' shortcode in all versions up to, and including, 1.2.3.35 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-paypal/trunk/main.php#L72; https://plugins.trac.wordpress.org/browser/wp-paypal/trunk/wp-paypal-checkout.php#L3; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3223257%40wp-paypal&new=3223257%40wp-paypal&sfp_email=&sfph_mail=
CVE: CVE-2024-13434
Published: 2025-01-17
Description: The WP Inventory Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3223184%40wp-inventory-manager&new=3223184%40wp-inventory-manager&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/7e3069d4-12b8-4949-9daf-0e01590799da?source=cve
CVE: CVE-2024-10799
Published: 2025-01-17
Description: The Eventer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.9.7 via the eventer_woo_download_tickets() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://codecanyon.net/item/eventer-wordpress-event-manager-plugin/20972534; https://www.wordfence.com/threat-intel/vulnerabilities/id/aea5f970-243f-4642-83e1-34db11c4ca63?source=cve
CVE: CVE-2024-11146
Published: 2025-01-17
Description: TrueFiling is a collaborative, web-based electronic filing system where attorneys, paralegals, court reporters and self-represented filers collect public legal documentation into cases. TrueFiling is an entirely cloud-hosted application. Prior to version 3.1.112.19, TrueFiling trusted some client-controlled identifiers passed in URL requests to retrieve information. Platform users must self-register for an account, and once authenticated, could manipulate those identifiers to gain partial access to case information and the ability to partially change user access to case information. This vulnerability was addressed in version 3.1.112.19 and all instances were updated by 2024-11-08.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-639, CWE-807, CWE-639
References: https://infosec.exchange/@abreacher; https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2024/va-25-017-01.json
CVE: CVE-2024-13333
Published: 2025-01-17
Description: The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fma_local_file_system' function in versions 5.2.12 to 5.2.13. This makes it possible for authenticated attackers, with Subscriber-level access and above and upload permissions granted by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. The function can be exploited only if the "Display .htaccess?" setting is enabled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/file-manager-advanced/trunk/application/class_fma_connector.php?rev=3200092#L78; https://plugins.trac.wordpress.org/changeset/3222740/; https://www.wordfence.com/threat-intel/vulnerabilities/id/1c8bcbf8-1848-4f7a-89d8-5894de0bb18b?source=cve
CVE: CVE-2024-12203
Published: 2025-01-17
Description: The RSS Icon Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link_color’ parameter in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/rss-icon-widget/trunk/rss-icon-widget.php#L195; https://plugins.trac.wordpress.org/browser/rss-icon-widget/trunk/rss-icon-widget.php#L83; https://www.wordfence.com/threat-intel/vulnerabilities/id/fbd8fec7-c95a-4c03-ac0d-894a54906863?source=cve
CVE: CVE-2024-12466
Published: 2025-01-17
Description: The Proofreading plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 1.2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/proofreading/tags/1.2.1.1/admin/partials/proofreading-admin-display.php#L103; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3223417%40proofreading&new=3223417%40proofreading&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/b3f666a3-6287-4c9b-94d3-7bc457701af2?source=cve
CVE: CVE-2024-12508
Published: 2025-01-17
Description: The Glofox Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'glofox' and 'glofox_lead_capture ' shortcodes in all versions up to, and including, 2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/glofox-shortcodes/; https://www.wordfence.com/threat-intel/vulnerabilities/id/3ed59d5b-0922-44e9-98e8-07b91d1f4840?source=cve
CVE: CVE-2024-12598
Published: 2025-01-17
Description: The MyBookProgress by Stormhill Media plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘book’ parameter in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/mybookprogress/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/b20a11c1-9aa0-4f5d-af3d-89fb9bf4e1d0?source=cve