deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-3016
Published: 2024-05-14
Description: NEC Platforms DT900 and DT900S Series 5.0.0.0 – v5.3.4.4, v5.4.0.0 – v5.6.0.20 allows an attacker to access a non-documented the system settings to change settings via local network with unauthenticated user.


CVSS Score: 9.1 (CRITICAL)
CWE: CWE-912
References: https://jpn.nec.com/security-info/secinfo/nv24-002_en.html; https://jpn.nec.com/security-info/secinfo/nv24-002_en.html
CVE: CVE-2024-3037
Published: 2024-05-14
Description: An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and be capable of executing low-privilege code directly on the server. 

Important: In most installations, this risk is mitigated by the default Windows Server configuration, which typically restricts local login access to Administrators only. However, this vulnerability could pose a risk to customers who allow non-administrative users to log in to the local console of the Windows environment hosting the PaperCut NG/MF application server.

Note: This CVE has been split into two separate CVEs (CVE-2024-3037 and CVE-2024-8404) and it’s been rescored with a "Privileges Required (PR)" rating of low, and “Attack Complexity (AC)” rating of low, reflecting the worst-case scenario where an Administrator has granted local login access to standard users on the host server.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-552
References: https://www.papercut.com/kb/Main/Security-Bulletin-May-2024/; https://www.papercut.com/kb/Main/security-bulletin-may-2024/
CVE: CVE-2024-3055
Published: 2024-05-14
Description: The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.102 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/tags/1.5.93/inc_php/framework/db.class.php#L238; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3081509%40unlimited-elements-for-elementor%2Ftrunk&old=3076456%40unlimited-elements-for-elementor%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ebc0c8e6-a365-4ef7-9c1a[PII_REDACTED]6c?source=cve
CVE: CVE-2024-3068
Published: 2024-05-14
Description: The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cfs[fields][*][name]' parameter in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/custom-field-suite/trunk/templates/field_html.php?order=date&desc=1#L46; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3080330%40custom-field-suite%2Ftrunk&old=3042177%40custom-field-suite%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/0ab546cc-b099-4d26-bf42-785952fcfd8c?source=cve
CVE: CVE-2024-3070
Published: 2024-05-14
Description: The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.0 via deserialization of untrusted input from the LastViewedPosts Cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3062246%40last-viewed-posts&new=3062246%40last-viewed-posts&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/b6c5cc05-b147-46f6-aaa9-4c82aae1b544?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3062246%40last-viewed-posts&new=3062246%40last-viewed-posts&sfp_email=&sfph_mail=
CVE: CVE-2024-3239
Published: 2024-05-14
Description: The Post Grid Gutenberg Blocks and WordPress Blog Plugin  WordPress plugin before 4.0.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/dfa1421b-41b0-4b25-95ef-0843103e1f5e/; https://wpscan.com/vulnerability/dfa1421b-41b0-4b25-95ef-0843103e1f5e/
CVE: CVE-2024-3263
Published: 2024-05-14
Description: YMS VIS Pro is an information system for veterinary and food administration, veterinarians and farm. Due to a combination of improper method for system credentials generation and weak password policy, passwords can be easily guessed and enumerated through brute force attacks. Successful attacks can lead to unauthorised access and execution of operations based on assigned user permissions. This vulnerability affects VIS Pro in versions <= 3.3.0.6. This vulnerability has been mitigated by changes in authentication mechanisms and implementation of additional authentication layer and strong password policies.








CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-521
References: https://remediata.com/blog/cve-2024-3263-improper-authentication-in-yms-vis-pro/; https://www.svps.sk/vis/; https://remediata.com/blog/cve-2024-3263-improper-authentication-in-yms-vis-pro/
CVE: CVE-2024-3459
Published: 2024-05-14
Description: KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened in an external PDF viewer. By using built-in functions of that viewer it is possible to launch a web browser, search through local files and, subsequently, launch any program with user privileges.


CVSS Score: 8.4 (HIGH)
CWE: CWE-424
References: https://cert.pl/en/posts/2024/04/CVE-2024-3459; https://cert.pl/posts/2024/04/CVE-2024-3459; https://www.kioware.com/
CVE: CVE-2024-3460
Published: 2024-05-14
Description: In KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened applications utilizing a short time window before the forced automatic logout occurs. Then, by using some built-in function of these applications, one may launch any other programs. 
In order to exploit this vulnerability external applications must be left running when the KioWare software is launched. Additionally, an attacker must know the PIN set for this Kioware instance and also slow down the application with some specific task which extends the usable time window.


CVSS Score: 7.4 (HIGH)
CWE: CWE-424
References: https://cert.pl/en/posts/2024/04/CVE-2024-3459; https://cert.pl/posts/2024/04/CVE-2024-3459; https://www.kioware.com/
CVE: CVE-2024-3461
Published: 2024-05-14
Description: KioWare for Windows (versions all through 8.35) allows to brute force the PIN number, which protects the application from being closed, as there are no mechanisms preventing a user from excessively guessing the number.

CVSS Score: 6.2 (MEDIUM)
CWE: CWE-307, CWE-307
References: https://cert.pl/en/posts/2024/04/CVE-2024-3459; https://cert.pl/posts/2024/04/CVE-2024-3459; https://www.kioware.com/
CVE: CVE-2024-3462
Published: 2024-05-14
Description: Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. 
All versions up to 2.9.0 (tested) and possibly newer ones are believed to be vulnerable as the vendor has not confirmed releasing a patch.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-302
References: https://antmedia.io/; https://cert.pl/en/posts/2024/05/CVE-2024-3462; https://cert.pl/posts/2024/05/CVE-2024-3462
CVE: CVE-2024-3547
Published: 2024-05-14
Description: The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'google_connect_error' parameter in all versions up to, and including, 1.5.102 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3071404/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_settings_output.class.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/f629fc93-84ce-4c33-b1c0-3a3194aac477?source=cve; https://plugins.trac.wordpress.org/changeset/3071404/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_settings_output.class.php
CVE: CVE-2024-3582
Published: 2024-05-14
Description: The UnGallery WordPress plugin through 2.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/5a348b5d-13aa-40c3-9d21-0554683f8019/; https://wpscan.com/vulnerability/5a348b5d-13aa-40c3-9d21-0554683f8019/
CVE: CVE-2024-3590
Published: 2024-05-14
Description: The LetterPress  WordPress plugin through 1.2.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as delete arbitrary subscribers
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/829f4d40-e5b0-4009-b753-85ca2a5b3d25/; https://wpscan.com/vulnerability/829f4d40-e5b0-4009-b753-85ca2a5b3d25/
CVE: CVE-2024-3595
Published: 2024-05-14
Description: The Pure Chat – Live Chat Plugin & More! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the purechatwid and purechatwname parameter in all versions up to, and including, 2.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3097440%40pure-chat&new=3097440%40pure-chat&sfp_email=&sfph_mail=; https://wordpress.org/plugins/pure-chat/; https://www.wordfence.com/threat-intel/vulnerabilities/id/5d03c798-dc77-407c-8674-d0bd2f1ada8c?source=cve
CVE: CVE-2024-3680
Published: 2024-05-14
Description: The Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animation Title widget's img tag in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3087147%40enteraddons%2Ftrunk&old=3063156%40enteraddons%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/29cc82cb-f3fd-4de5-9731-7ceb1212b0f9?source=cve; https://wordpress.org/plugins/enteraddons/
CVE: CVE-2024-3722
Published: 2024-05-14
Description: The Swift Performance Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the ajax_handler() function in all versions up to, and including, 2.3.6.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve and modify settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-863
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3082274%40swift-performance-lite&new=3082274%40swift-performance-lite&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/58b7736a-e3e0-4ecd-9adf-284568b02ef7?source=cve; https://plugins.trac.wordpress.org/browser/swift-performance-lite/trunk/includes/setup/setup.php#L97
CVE: CVE-2024-3727
Published: 2024-05-14
Description: A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
CVSS Score: 8.3 (HIGH)
CWE: CWE-354
References: https://access.redhat.com/errata/RHSA-2024:0045; https://access.redhat.com/errata/RHSA-2024:3718; https://access.redhat.com/errata/RHSA-2024:4159
CVE: CVE-2024-3787
Published: 2024-05-14
Description: Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through S3 disks (/admin/DeviceS3). Exploitation of this vulnerability could allow a remote user to execute arbitrary code.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions
CVE: CVE-2024-3788
Published: 2024-05-14
Description: Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through License (/admin/CDPUsers). Exploitation of this vulnerability could allow a remote user to execute arbitrary code.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-94
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions
CVE: CVE-2024-3789
Published: 2024-05-14
Description: Uncontrolled resource consumption vulnerability in White Bear Solutions WBSAirback, version 21.02.04. This vulnerability could allow an attacker to send multiple command injection payloads to influence the amount of resources consumed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions
CVE: CVE-2024-3790
Published: 2024-05-14
Description: Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/SystemUsers, login / description fields, passwd1/ passwd2 parameters. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions
CVE: CVE-2024-3791
Published: 2024-05-14
Description: Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/SystemConfiguration, name / free memory limit fields , type / password parameters. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions
CVE: CVE-2024-3792
Published: 2024-05-14
Description: Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/DeviceReplication, execution range field, all parameters. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions
CVE: CVE-2024-3793
Published: 2024-05-14
Description: Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/CloudAccounts, account name / user password / server fields, all parameters. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions
CVE: CVE-2024-3794
Published: 2024-05-14
Description: Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/AdvancedSystem, description field, all parameters. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions
CVE: CVE-2024-3795
Published: 2024-05-14
Description: Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/BackupTemplate, name / description fields. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions
CVE: CVE-2024-3796
Published: 2024-05-14
Description: Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting (XSS) through /admin/BackupSchedule, description field. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wbsairback-white-bear-solutions
CVE: CVE-2024-3806
Published: 2024-05-14
Description: The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via the 'porto_ajax_posts' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://themeforest.net/item/porto-responsive-wordpress-ecommerce-theme/9207399; https://www.wordfence.com/threat-intel/vulnerabilities/id/98ccc604-79c6-4be9-acb0-23fc82a31dfa?source=cve; https://themeforest.net/item/porto-responsive-wordpress-ecommerce-theme/9207399
CVE: CVE-2024-3807
Published: 2024-05-14
Description: The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via 'porto_page_header_shortcode_type', 'slideshow_type' and 'post_layout' post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included. This was partially patched in version 7.1.0 and fully patched in version 7.1.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-98
References: https://themeforest.net/item/porto-responsive-wordpress-ecommerce-theme/9207399; https://www.wordfence.com/threat-intel/vulnerabilities/id/4bc3da9e-4b5f-4200-9df9-0ae953571377?source=cve; https://themeforest.net/item/porto-responsive-wordpress-ecommerce-theme/9207399
CVE: CVE-2024-3808
Published: 2024-05-14
Description: The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via the 'porto_portfolios' shortcode 'portfolio_layout' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
CVSS Score: 8.8 (HIGH)
CWE: CWE-98
References: https://themeforest.net/item/porto-responsive-wordpress-ecommerce-theme/9207399; https://www.wordfence.com/threat-intel/vulnerabilities/id/fea96f84-f75b-4f02-9ca8-f8fda439d565?source=cve; https://themeforest.net/item/porto-responsive-wordpress-ecommerce-theme/9207399
CVE: CVE-2024-3809
Published: 2024-05-14
Description: The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.9 via the 'slideshow_type' post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
CVSS Score: 8.8 (HIGH)
CWE: CWE-98
References: https://themeforest.net/item/porto-responsive-wordpress-ecommerce-theme/9207399; https://www.wordfence.com/threat-intel/vulnerabilities/id/f5cdd3c1-6353-4bee-a4f9-5b7972f0970c?source=cve; https://themeforest.net/item/porto-responsive-wordpress-ecommerce-theme/9207399
CVE: CVE-2024-3828
Published: 2024-05-14
Description: The Spectra Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.5. This is due to the plugin allowing lower-privileged users to create registration forms and set the default role to administrator This makes it possible for authenticated attackers, with author-level access and above, to create administrator-level accounts.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://wpspectra.com/whats-new/; https://www.wordfence.com/threat-intel/vulnerabilities/id/e23e7d66-4b57-4feb-bf77-46238bc6ce7c?source=cve; https://wpspectra.com/whats-new/