deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-6166
Published: 2024-07-09
Description: The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘addons_order’ parameter in all versions up to, and including, 1.5.112 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above and granted plugin setting edit permissions by an administrator, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_addons.class.php#L79; https://plugins.trac.wordpress.org/changeset/3112307/; https://www.wordfence.com/threat-intel/vulnerabilities/id/9826c91c-0f6e-4d3b-bc14-4af6b60ef246?source=cve
CVE: CVE-2024-6169
Published: 2024-07-09
Description: The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘username’ parameter in all versions up to, and including, 1.5.112 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above and granted plugin setting edit permissions by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/hakluke/weaponised-XSS-payloads/blob/master/wordpress_create_admin_user.js; https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/framework/instagram/helper.class.php#L168; https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/framework/instagram/helper.class.php#L178
CVE: CVE-2024-6170
Published: 2024-07-09
Description: The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘email’ parameter in all versions up to, and including, 1.5.112 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/hakluke/weaponised-XSS-payloads/blob/master/wordpress_create_admin_user.js; https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_settings_output.class.php#L398; https://plugins.trac.wordpress.org/changeset/3112307/
CVE: CVE-2024-6171
Published: 2024-07-09
Description: The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 1.5.112 due to insufficient IP address validation and/or use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers  to bypass antispam functionality in the Form Builder widgets.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-348
References: https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/framework/functions.class.php#L3407; https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_form.class.php#L742; https://plugins.trac.wordpress.org/changeset/3112307/
CVE: CVE-2024-3410
Published: 2024-07-09
Description: The DN Footer Contacts WordPress plugin before 1.6.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e2067637-45f3-4b42-96ca-85867c4c0409/; https://wpscan.com/vulnerability/e2067637-45f3-4b42-96ca-85867c4c0409/
CVE: CVE-2024-5441
Published: 2024-07-09
Description: The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image function in all versions up to, and including, 7.11.0. This makes it possible for authenticated attackers, with subscriber access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The plugin allows administrators (via its settings) to extend the ability to submit events to unauthenticated users, which would allow unauthenticated attackers to exploit this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://webnus.net/modern-events-calendar/; https://www.wordfence.com/threat-intel/vulnerabilities/id/0c007090-9d9b-4ee7-8f77-91abd4373051?source=cve; https://webnus.net/modern-events-calendar/
CVE: CVE-2024-5488
Published: 2024-07-09
Description: The SEOPress  WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://wpscan.com/vulnerability/28507376-ded0-4e1a-b2fc-2182895aa14c/; https://wpscan.com/vulnerability/28507376-ded0-4e1a-b2fc-2182895aa14c/
CVE: CVE-2024-5802
Published: 2024-07-09
Description: The URL Shortener by Myhop WordPress plugin through 1.0.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/cd37f702-9144-4c98-9b08-c63e510cd97f/; https://wpscan.com/vulnerability/cd37f702-9144-4c98-9b08-c63e510cd97f/
CVE: CVE-2024-6334
Published: 2024-07-09
Description: The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/6c09083c-6960-4369-8c5c-ad20e34aaa8b/; https://wpscan.com/vulnerability/6c09083c-6960-4369-8c5c-ad20e34aaa8b/
CVE: CVE-2024-22062
Published: 2024-07-09
Description: There is a permissions and access control vulnerability in ZXCLOUD IRAI.An attacker can elevate non-administrator permissions to administrator permissions by modifying the configuration.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-346, CWE-276
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1036204; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1036204
CVE: CVE-2024-28747
Published: 2024-07-09
Description: An unauthenticated remote attacker can use the hard-coded credentials to access the SmartSPS devices with high privileges.

CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://cert.vde.com/en/advisories/VDE-2024-012; https://cert.vde.com/en/advisories/VDE-2024-012
CVE: CVE-2024-28748
Published: 2024-07-09
Description: A remote attacker with high privileges may use a reading file function to inject OS commands.

CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://cert.vde.com/en/advisories/VDE-2024-012; https://cert.vde.com/en/advisories/VDE-2024-012
CVE: CVE-2024-28749
Published: 2024-07-09
Description: A remote attacker with high privileges may use a writing file function to inject OS commands.

CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://cert.vde.com/en/advisories/VDE-2024-012; https://cert.vde.com/en/advisories/VDE-2024-012
CVE: CVE-2024-28750
Published: 2024-07-09
Description: A remote attacker with high privileges may use a deleting file function to inject OS commands.

CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://cert.vde.com/en/advisories/VDE-2024-012; https://cert.vde.com/en/advisories/VDE-2024-012
CVE: CVE-2024-28751
Published: 2024-07-09
Description: An high privileged remote attacker can enable telnet access that accepts hardcoded credentials.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-798
References: https://cert.vde.com/en/advisories/VDE-2024-012; https://cert.vde.com/en/advisories/VDE-2024-012
CVE: CVE-2024-37555
Published: 2024-07-09
Description: Unrestricted Upload of File with Dangerous Type vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7.This issue affects Generate PDF using Contact Form 7: from n/a through <= 4.1.2.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/generate-pdf-using-contact-form-7/vulnerability/wordpress-generate-pdf-using-contact-form-7-plugin-4-0-6-arbitrary-file-upload-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/generate-pdf-using-contact-form-7/wordpress-generate-pdf-using-contact-form-7-plugin-4-0-6-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-37923
Published: 2024-07-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in cliengo Cliengo – Chatbot cliengo allows Cross Site Request Forgery.This issue affects Cliengo – Chatbot: from n/a through <= 3.0.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/cliengo/vulnerability/wordpress-cliengo-chatbot-plugin-3-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cliengo/wordpress-cliengo-chatbot-plugin-3-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-5881
Published: 2024-07-09
Description: The Webico Slider Flatsome Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wbc_image shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/webico-slider-flatsome-addons/trunk/shortcodes/wbc_slider.php#L4; https://www.wordfence.com/threat-intel/vulnerabilities/id/71eeddf4-5693-41bc-93ad-3c93dafdd3bc?source=cve; https://plugins.trac.wordpress.org/browser/webico-slider-flatsome-addons/trunk/shortcodes/wbc_slider.php#L4
CVE: CVE-2024-6123
Published: 2024-07-09
Description: The Bit Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'iconUpload' function in all versions up to, and including, 2.13.3. This makes it possible for authenticated attackers, with administrator-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/bit-form/tags/2.12.2/includes/Admin/AdminAjax.php#L1176; https://plugins.trac.wordpress.org/changeset/3114814/bit-form/trunk/includes/Admin/AdminAjax.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/6d1b255f-d775-4bd5-892e-42bf82dd5632?source=cve
CVE: CVE-2024-6161
Published: 2024-07-09
Description: The Default Thumbnail Plus plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'get_cache_image' function in all versions up to, and including, 1.0.2.3. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/default-thumbnail-plus/trunk/default-thumbnail-plus.php?rev=597280#L337; https://www.wordfence.com/threat-intel/vulnerabilities/id/046f11b6-7d1a-4bd3-8250-4c5a50fab3ff?source=cve; https://plugins.trac.wordpress.org/browser/default-thumbnail-plus/trunk/default-thumbnail-plus.php?rev=597280#L337
CVE: CVE-2024-6180
Published: 2024-07-09
Description: The EventON plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eventon_import_settings' ajax action in all versions up to, and including, 2.2.15. This makes it possible for unauthenticated attackers to update plugin settings, including adding stored cross-site scripting to settings options displayed on event calendar pages.
CVSS Score: 7.2 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3121634/eventon-lite/trunk/includes/admin/class-admin-ajax.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/12f3dc64-322d-4015-8c57-eaa41c9a1829?source=cve; https://plugins.trac.wordpress.org/browser/eventon-lite/trunk/assets/js/admin/wp_admin.js#L714
CVE: CVE-2024-6309
Published: 2024-07-09
Description: The Attachment File Icons (AF Icons) plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.3. This is due to missing nonce validation in the 'afi_overview' function and missing file type validation in the 'upload_icons' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/attachment-file-icons/tags/1.3/attachment-file-icons.php#L130; https://plugins.trac.wordpress.org/browser/attachment-file-icons/tags/1.3/attachment-file-icons.php#L337; https://www.wordfence.com/threat-intel/vulnerabilities/id/7e3fd472-c8ea-42dc-93df-872361ec97f3?source=cve
CVE: CVE-2024-6310
Published: 2024-07-09
Description: The Advanced AJAX Page Loader plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.7.7. This is due to missing nonce validation in the 'admin_init_AAPL' function and missing file type validation in the 'AAPL_options_validate' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/advanced-ajax-page-loader/tags/2.7.7/advanced-ajax-page-loader.php#L131; https://plugins.trac.wordpress.org/browser/advanced-ajax-page-loader/tags/2.7.7/advanced-ajax-page-loader.php#L41; https://www.wordfence.com/threat-intel/vulnerabilities/id/ccc75dee-1cf8-4fda-b2a1-f5d68e6c7887?source=cve
CVE: CVE-2024-6313
Published: 2024-07-09
Description: The Gutenberg Forms plugin for WordPress is vulnerable to arbitrary file uploads due to the users can specify the allowed file types in the 'upload' function in versions up to, and including, 2.2.9. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/forms-gutenberg/tags/2.2.9/Utils/Bucket.php#L19; https://plugins.trac.wordpress.org/browser/forms-gutenberg/tags/2.2.9/triggers/email.php#L268; https://www.wordfence.com/threat-intel/vulnerabilities/id/b0315b53-46a1-46b4-a53e-0d914866ca50?source=cve
CVE: CVE-2024-6314
Published: 2024-07-09
Description: The IQ Testimonials plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'process_image_upload' function in versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This can only be exploited if the 'gd' php extension is not loaded on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/iq-testimonials/tags/2.2.7/lib/iq-testimonials-form.php#L296; https://www.wordfence.com/threat-intel/vulnerabilities/id/bec50640-a550-49a8-baf6-2dd53995f90b?source=cve; https://plugins.trac.wordpress.org/browser/iq-testimonials/tags/2.2.7/lib/iq-testimonials-form.php#L296
CVE: CVE-2024-6316
Published: 2024-07-09
Description: The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and missing file type validation in the 'wp_cf7_pdf_dashboard_html_page' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2024-37555 is a duplicate of this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/generate-pdf-using-contact-form-7/tags/4.0.6/inc/templates/cf7-pdf-generation.admin.html.php#L72; https://plugins.trac.wordpress.org/changeset/3146943/generate-pdf-using-contact-form-7; https://www.wordfence.com/threat-intel/vulnerabilities/id/52cce49b-49b3-49b0-9f18-4829f07a420f?source=cve
CVE: CVE-2024-6317
Published: 2024-07-09
Description: The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and the plugin not properly validating a file or its path prior to deleting it in the 'wp_cf7_pdf_dashboard_html_page' function. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://plugins.trac.wordpress.org/browser/generate-pdf-using-contact-form-7/tags/4.0.6/inc/templates/cf7-pdf-generation.admin.html.php#L74; https://plugins.trac.wordpress.org/changeset/3146943/generate-pdf-using-contact-form-7; https://www.wordfence.com/threat-intel/vulnerabilities/id/455b9695-e140-4bdb-b626-5c[PII_REDACTED]?source=cve
CVE: CVE-2024-6320
Published: 2024-07-09
Description: The ScrollTo Top plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.2.2. This is due to missing nonce validation and missing file type validation in the 'options_page' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/scrollto-top/trunk/scrollto-top.php?rev=662578#L238; https://www.wordfence.com/threat-intel/vulnerabilities/id/e11f1a56-d5a2-47a4-a5cc[PII_REDACTED]5a?source=cve; https://plugins.trac.wordpress.org/browser/scrollto-top/trunk/scrollto-top.php?rev=662578#L238
CVE: CVE-2024-6321
Published: 2024-07-09
Description: The ScrollTo Bottom plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.1.1. This is due to missing nonce validation and missing file type validation in the 'options_page' function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/scrollto-bottom/trunk/scrollto-bottom.php?rev=516875#L256; https://www.wordfence.com/threat-intel/vulnerabilities/id/d560f28f-899c-44cf-8640-55647c1de7dc?source=cve; https://plugins.trac.wordpress.org/browser/scrollto-bottom/trunk/scrollto-bottom.php?rev=516875#L256
CVE: CVE-2024-37112
Published: 2024-07-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/wishlist-member-x/wordpress-wishlist-member-x-plugin-3-25-1-unauthenticated-arbitrary-sql-query-execution-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wishlist-member-x/wordpress-wishlist-member-x-plugin-3-25-1-unauthenticated-arbitrary-sql-query-execution-vulnerability?_s_id=cve
CVE: CVE-2024-37225
Published: 2024-07-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Marketing Automation.This issue affects Zoho Marketing Automation: from n/a through 1.2.7.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/zoho-marketinghub/wordpress-zoho-marketing-automation-plugin-1-2-7-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/zoho-marketinghub/wordpress-zoho-marketing-automation-plugin-1-2-7-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-37256
Published: 2024-07-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/tutor/wordpress-tutor-lms-plugin-2-7-1-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tutor/wordpress-tutor-lms-plugin-2-7-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-37486
Published: 2024-07-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 3.0.5.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/paid-memberships-pro/wordpress-paid-memberships-pro-plugin-3-0-5-authenticated-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/paid-memberships-pro/wordpress-paid-memberships-pro-plugin-3-0-5-authenticated-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-37494
Published: 2024-07-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in KaineLabs Youzify.This issue affects Youzify: from n/a through 1.2.5.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/youzify/wordpress-youzify-plugin-1-2-5-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/youzify/wordpress-youzify-plugin-1-2-5-sql-injection-vulnerability?_s_id=cve