deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-9423
Published: 2024-12-02
Description: In ihevcd_parse_slice_header of ihevcd_parse_slice_header.c there is a possible out of bound read due to missing bounds check. This could lead to denial of service with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://source.android.com/docs/security/bulletin/pixel/2018-07-01
CVE: CVE-2018-9426
Published: 2024-12-02
Description: In  RsaKeyPairGenerator::getNumberOfIterations of RSAKeyPairGenerator.java, an incorrect implementation could cause weak RSA key pairs being generated. This could lead to crypto vulnerability with no additional execution privileges needed. User interaction is not needed for exploitation. Bulletin Fix: The fix is designed to correctly implement the key generation according to FIPS standard.
CVSS Score: 7.5 (HIGH)
CWE: CWE-331, CWE-331
References: https://source.android.com/docs/security/bulletin/pixel/2018-07-01
CVE: CVE-2018-9429
Published: 2024-12-02
Description: In buildImageItemsIfPossible of ItemTable.cpp there is a possible out of bound read due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-908, CWE-125
References: https://source.android.com/docs/security/bulletin/pixel/2018-07-01
CVE: CVE-2018-9430
Published: 2024-12-02
Description: In prop2cfg of btif_storage.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-125
References: https://source.android.com/docs/security/bulletin/pixel/2018-07-01
CVE: CVE-2018-9431
Published: 2024-12-02
Description: In OSUInfo of OSUInfo.java, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/docs/security/bulletin/pixel/2018-07-01
CVE: CVE-2018-9435
Published: 2024-12-02
Description: In gatt_process_error_rsp of gatt_cl.cc, there is a possible out of bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://source.android.com/docs/security/bulletin/pixel/2018-08-01
CVE: CVE-2024-53375
Published: 2024-12-02
Description: An Authenticated Remote Code Execution (RCE) vulnerability affects the TP-Link Archer router series. A vulnerability exists in the "tmp_get_sites" function of the HomeShield functionality provided by TP-Link. This vulnerability is still exploitable without the activation of the HomeShield functionality.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/ThottySploity/CVE-2024-53375; https://thottysploity.github.io/posts/cve-2024-53375/
CVE: CVE-2024-53938
Published: 2024-12-02
Description: An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. The TELNET service is enabled by default and exposed over the LAN. The root account is accessible without a password, allowing attackers to achieve full control over the router remotely without any authentication.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://github.com/actuator/cve/blob/main/Victure/CVE-2024-53938.txt; https://github.com/actuator/cve/blob/main/Victure/Victure_RX1800_Security_Report.pdf
CVE: CVE-2024-53939
Published: 2024-12-02
Description: An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. The /cgi-bin/luci/admin/opsw/Dual_freq_un_apple endpoint is vulnerable to command injection through the 2.4 GHz and 5 GHz name parameters, allowing an attacker to execute arbitrary commands on the device (with root-level permissions) via crafted input.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/actuator/cve/blob/main/Victure/CVE-2024-53939.txt; https://github.com/actuator/cve/blob/main/Victure/RX1800-EN_V1.0.0_r12_110933-CMD-INJ-WIFI-SHELL.gif; https://github.com/actuator/cve/blob/main/Victure/Victure_RX1800_Security_Report.pdf
CVE: CVE-2024-53940
Published: 2024-12-02
Description: An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. Certain /cgi-bin/luci/admin endpoints are vulnerable to command injection. Attackers can exploit this by sending crafted payloads through parameters intended for the ping utility, enabling arbitrary command execution with root-level permissions on the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/actuator/cve/blob/main/Victure/CVE-2024-53940.txt
CVE: CVE-2024-53941
Published: 2024-12-02
Description: An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. A remote attacker (in proximity to a Wi-Fi network) can derive the default Wi-Fi PSK value via the last 4 octets of the BSSID.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://github.com/actuator/cve/blob/main/Victure/CVE-2024-53941.txt; https://github.com/actuator/cve/blob/main/Victure/Victure_RX1800_Security_Report.pdf
CVE: CVE-2024-53985
Published: 2024-12-02
Description: rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0 and Nokogiri < 1.15.7, or 1.16.x < 1.16.8. The XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags with both "math" and "style" elements or both both "svg" and "style" elements. This vulnerability is fixed in 1.6.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/rails/rails-html-sanitizer/commit/b0220b8850d52199a15f83c472d175a4122dd7b1; https://github.com/rails/rails-html-sanitizer/commit/cd18b0ef00aad1d4a9e1c5d860cd23f80f63c505; https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-w8gc-x259-rc7x
CVE: CVE-2024-53986
Published: 2024-12-02
Description: rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "math" and "style" elements are both explicitly allowed. This vulnerability is fixed in 1.6.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/rails/rails-html-sanitizer/commit/f02ffbb8465e73920b6de0da940f5530f855965e; https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-638j-pmjw-jq48
CVE: CVE-2024-53987
Published: 2024-12-02
Description: rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "style" element is explicitly allowed and the "svg" or "math" element is not allowed. This vulnerability is fixed in 1.6.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/rails/rails-html-sanitizer/commit/f02ffbb8465e73920b6de0da940f5530f855965e; https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-2x5m-9ch4-qgrr
CVE: CVE-2024-53988
Published: 2024-12-02
Description: rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "math", "mtext", "table", and "style" elements are allowed and either either "mglyph" or "malignmark" are allowed. This vulnerability is fixed in 1.6.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/rails/rails-html-sanitizer/commit/a0a3e8b76b696446ffc6bffcff3bc7b7c6393c72; https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cfjx-w229-hgx5
CVE: CVE-2024-53937
Published: 2024-12-02
Description: An issue was discovered on Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. The TELNET service is enabled by default with admin/admin as default credentials and is exposed over the LAN. The allows attackers to execute arbitrary commands with root-level permissions. Device setup does not require this password to be changed during setup in order to utilize the device. (However, the TELNET password is dictated by the current GUI password.)
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://github.com/actuator/cve/blob/main/Victure/CVE-2024-53937.txt; https://github.com/actuator/cve/blob/main/Victure/Victure_RX1800_Security_Report.pdf
CVE: CVE-2018-9441
Published: 2024-12-03
Description: In sdp_copy_raw_data of sdp_discovery.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://source.android.com/docs/security/bulletin/pixel/2018-08-01
CVE: CVE-2018-9449
Published: 2024-12-03
Description: In process_service_search_attr_rsp of sdp_discovery.cc, there is a possible out of bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://source.android.com/docs/security/bulletin/pixel/2018-08-01
CVE: CVE-2024-8748
Published: 2024-12-03
Description: A buffer overflow vulnerability in the packet parser of the third-party library "libclinkc" in Zyxel VMG8825-T50K firmware versions through V5.50(ABOM.8.4)C0 could allow an attacker to cause a temporary denial of service (DoS) condition against the web management interface by sending a crafted HTTP POST request to a vulnerable device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-and-post-authentication-command-injection-vulnerabilities-in-some-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wifi-extenders-12-03-2024
CVE: CVE-2024-9197
Published: 2024-12-03
Description: A post-authentication buffer overflow vulnerability in the parameter "action" of the CGI program in Zyxel VMG3625-T50B firmware versions through V5.50(ABPM.9.2)C0 could allow an authenticated attacker with administrator privileges to cause a temporary denial of service (DoS) condition against the web management interface by sending a crafted HTTP GET request to a vulnerable device if the function ZyEE is enabled.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-120
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-and-post-authentication-command-injection-vulnerabilities-in-some-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wifi-extenders-12-03-2024
CVE: CVE-2024-9200
Published: 2024-12-03
Description: A post-authentication command injection vulnerability in the "host" parameter of the diagnostic function in Zyxel VMG4005-B50A firmware versions through V5.15(ABQA.2.2)C0 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on a vulnerable device.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-and-post-authentication-command-injection-vulnerabilities-in-some-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wifi-extenders-12-03-2024
CVE: CVE-2024-45068
Published: 2024-12-03
Description: Authentication credentials leakage vulnerability in Hitachi Ops Center Common Services within Hitachi Ops Center OVA.


This issue affects Hitachi Ops Center Common Services: from 10.9.3-00 before 11.0.3-00; Hitachi Ops Center OVA: from 10.9.3-00 before 11.0.2-01.
CVSS Score: 7.1 (HIGH)
CWE: CWE-1392
References: https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-149/index.html
CVE: CVE-2024-9694
Published: 2024-12-03
Description: The CMSMasters Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.14.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://docs.cmsmasters.net/cmsmasters-elementor-addon-changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb78b64-ebe3-44e9-9061-d380693c5566?source=cve
CVE: CVE-2024-10484
Published: 2024-12-03
Description: The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Team' widget in all versions up to, and including, 2.16.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3180325/; https://wordpress.org/plugins/ultimate-addons-for-gutenberg/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/c218bf5e-b28b-4512-8bc7-7662b4a06f1e?source=cve
CVE: CVE-2024-10893
Published: 2024-12-03
Description: The WP Booking Calendar WordPress plugin before 10.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a230a552-3fda-4145-810f-58af540107db/
CVE: CVE-2024-49410
Published: 2024-12-03
Description: Out-of-bounds write in libswmfextractor.so prior to SMR Dec-2024 Release 1 allows local attackers to execute arbitrary code.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12
CVE: CVE-2024-49411
Published: 2024-12-03
Description: Path Traversal in ThemeCenter prior to SMR Dec-2024 Release 1 allows physical attackers to copy apk files to arbitrary path with ThemeCenter privilege.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12
CVE: CVE-2024-49412
Published: 2024-12-03
Description: Improper input validation in Settings prior to SMR Dec-2024 Release 1 allows local attackers to broadcast signal for discovering Bluetooth on Galaxy Watch.
CVSS Score: 5.5 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12
CVE: CVE-2024-49413
Published: 2024-12-03
Description: Improper Verification of Cryptographic Signature in SmartSwitch prior to SMR Dec-2024 Release 1 allows local attackers to install malicious applications.
CVSS Score: 7.1 (HIGH)
CWE: CWE-347
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12
CVE: CVE-2024-49414
Published: 2024-12-03
Description: Authentication Bypass Using an Alternate Path in Dex Mode prior to SMR Dec-2024 Release 1 allows physical attackers to temporarily access to recent app list.
CVSS Score: 2.4 (LOW)
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12
CVE: CVE-2024-49415
Published: 2024-12-03
Description: Out-of-bound write in libsaped.so prior to SMR Dec-2024 Release 1 allows remote attackers to execute arbitrary code.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=12
CVE: CVE-2024-49416
Published: 2024-12-03
Description: Use of implicit intent for sensitive communication in SmartThings prior to version 1.8.21 allows local attackers to get sensitive information.
CVSS Score: 4.0 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=12
CVE: CVE-2024-49417
Published: 2024-12-03
Description: Use of implicit intent for sensitive communication in Smart Touch Call prior to 1.0.0.8 allows local attackers to launch privileged activities. User interaction is required for triggering this vulnerability.
CVSS Score: 2.0 (LOW)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=12
CVE: CVE-2024-49418
Published: 2024-12-03
Description: Insufficient verification of url authenticity in GamingHub prior to version 6.1.03.4 in Korea, 7.1.02.4 in Global allows remote attackers to enable JavaScript in its webview.
CVSS Score: 6.5 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=12
CVE: CVE-2024-49419
Published: 2024-12-03
Description: Insufficient verification of url authenticity in GamingHub prior to version 6.1.03.4 in Korea, 7.1.02.4 in Global allows remote attackers to load an arbitrary URL in its webview.
CVSS Score: 4.3 (MEDIUM)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=12
CVE: CVE-2024-49420
Published: 2024-12-03
Description: Improper handling of responses in GamingHub prior to version 6.1.04.6 in Korea, 7.1.03.7 in Global allows remote attackers to launch arbitrary activity.
CVSS Score: 7.5 (HIGH)
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=12
CVE: CVE-2024-49421
Published: 2024-12-03
Description: Path traversal in Quick Share Agent prior to version 3.5.14.47 in Android 12, 3.5.19.41 in Android 13, and 3.5.19.42 in Android 14 allows adjacent attackers to write file in arbitrary location.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=12
CVE: CVE-2024-9058
Published: 2024-12-03
Description: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lightbox widget in all versions up to, and including, 5.10.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3189994/bdthemes-element-pack-lite; https://www.wordfence.com/threat-intel/vulnerabilities/id/3e343ea3-996c-47c7-9480-e6264cbded98?source=cve
CVE: CVE-2024-11453
Published: 2024-12-03
Description: The WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gs_pin_widget' shortcode in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/gs-pinterest-portfolio/tags/1.8.8/includes/shortcode.php#L202; https://plugins.trac.wordpress.org/changeset/3200115/gs-pinterest-portfolio/trunk/includes/shortcode.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/425cd0be-d17e-4c2b-bf29-3b850905a88e?source=cve
CVE: CVE-2024-11461
Published: 2024-12-03
Description: The Form Data Collector plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/form-data-collector/tags/2.2.3/index.php#L165; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3199031%40form-data-collector&new=3199031%40form-data-collector&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/6dba72ee-7c38-4e10-9c0c-35d12aa83442?source=cve
CVE: CVE-2024-11707
Published: 2024-12-03
Description: The My auctions allegro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 3.6.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3197924%40my-auctions-allegro-free-edition&new=3197924%40my-auctions-allegro-free-edition&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3198824%40my-auctions-allegro-free-edition&new=3198824%40my-auctions-allegro-free-edition&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/57a78696-5892-4621-992f-5e4a7d8fa965?source=cve
CVE: CVE-2024-11732
Published: 2024-12-03
Description: The BP Profile Shortcodes Extra plugin for WordPress is vulnerable to time-based SQL Injection via the ‘tab’ parameter in all versions up to, and including, 2.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/bp-profile-shortcodes-extra/tags/2.6.0/inc/bppsc-shortcodes-extra.php#L1694; https://wordpress.org/plugins/bp-profile-shortcodes-extra/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/d7324a4e-ff45-4908-bcaa-379b130f73c0?source=cve