deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-5184
Published: 2024-06-05
Description: The EmailGPT service contains a prompt injection vulnerability. The service uses an API service that allows a malicious user to inject a direct prompt and take over the service logic. Attackers can exploit the issue by forcing the AI service to leak the standard hard-coded system prompts and/or execute unwanted prompts. When engaging with EmailGPT by submitting a malicious prompt that requests harmful information, the system will respond by providing the requested data. This vulnerability can be exploited by any individual with access to the service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-74, CWE-74
References: https://www.synopsys.com/blogs/software-security/cyrc-advisory-prompt-injection-emailgpt.html; https://www.synopsys.com/blogs/software-security/cyrc-advisory-prompt-injection-emailgpt.html
CVE: CVE-2023-49927
Published: 2024-06-05
Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 9110, Exynos W920, Exynos Modem 5123, Exynos Modem 5300. The baseband software does not properly check format types specified by the RRC. This can lead to a lack of encryption.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-311, CWE-331
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2023-49928
Published: 2024-06-05
Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 9110, Exynos W920, Exynos Modem 5123, Exynos Modem 5300. The baseband software does not properly check states specified by the RRC. This can lead to disclosure of sensitive information.
CVSS Score: 7.5 (HIGH)
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2023-50803
Published: 2024-06-05
Description: An issue was discovered in Samsung Mobile Processor, and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos Modem 5123, Exynos Modem 5300. The baseband software does not properly check replay protection specified by the NAS (Non-Access-Stratum) module. This can lead to denial of service.
CVSS Score: 3.7 (LOW)
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2023-50804
Published: 2024-06-05
Description: An issue was discovered in Samsung Mobile Processor, and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos Modem 5123, Exynos Modem 5300. The baseband software does not properly check format types specified by the NAS (Non-Access-Stratum) module. This can lead to bypass of authentication.
CVSS Score: 3.7 (LOW)
CWE: CWE-287, CWE-287
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-27370
Published: 2024-06-05
Description: An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_config_get_nl_params(), there is no input validation check on hal_req->num_config_discovery_attr coming from userspace, which can lead to a heap overwrite.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-27371
Published: 2024-06-05
Description: An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_followup_get_nl_params(), there is no input validation check on hal_req->service_specific_info_len coming from userspace, which can lead to a heap overwrite.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-1288
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-27372
Published: 2024-06-05
Description: An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_config_get_nl_params(), there is no input validation check on disc_attr->infrastructure_ssid_len coming from userspace, which can lead to a heap overwrite.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-122
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-27373
Published: 2024-06-05
Description: An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_config_get_nl_params(), there is no input validation check on disc_attr->mesh_id_len coming from userspace, which can lead to a heap overwrite.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-27374
Published: 2024-06-05
Description: An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_publish_get_nl_params(), there is no input validation check on hal_req->service_specific_info_len coming from userspace, which can lead to a heap overwrite.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-122
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-27375
Published: 2024-06-05
Description: An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_followup_get_nl_params(), there is no input validation check on hal_req->sdea_service_specific_info_len coming from userspace, which can lead to a heap overwrite.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-1288
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-27376
Published: 2024-06-05
Description: An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_subscribe_get_nl_params(), there is no input validation check on hal_req->rx_match_filter_len coming from userspace, which can lead to a heap overwrite.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-27377
Published: 2024-06-05
Description: An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_get_security_info_nl(), there is no input validation check on sec_info->key_info.body.pmk_info.pmk_len coming from userspace, which can lead to a heap overwrite.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-27378
Published: 2024-06-05
Description: An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_send_action_frame_cert(), there is no input validation check on len coming from userspace, which can lead to a heap over-read.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-125, CWE-20
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-27379
Published: 2024-06-05
Description: An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_nan_subscribe_get_nl_params(), there is no input validation check on hal_req->num_intf_addr_present coming from userspace, which can lead to a heap overwrite.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-27380
Published: 2024-06-05
Description: An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_set_delayed_wakeup_type(), there is no input validation check on a length of ioctl_args->args[i] coming from userspace, which can lead to a heap over-read.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-27381
Published: 2024-06-05
Description: An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_send_action_frame_ut(), there is no input validation check on len coming from userspace, which can lead to a heap over-read.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-27382
Published: 2024-06-05
Description: An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. In the function slsi_send_action_frame(), there is no input validation check on len coming from userspace, which can lead to a heap over-read.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-28818
Published: 2024-06-05
Description: An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exynos 1330, Exynos 2400, Exynos Modem 5123, Exynos Modem 5300. The baseband software does not properly check states specified by the RRC (Radio Resource Control) module. This can lead to disclosure of sensitive information.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-284
References: https://semiconductor.samsung.com/support/quality-support/product-security-updates/; https://semiconductor.samsung.com/support/quality-support/product-security-updates/
CVE: CVE-2024-36667
Published: 2024-06-05
Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/idcProType_deal.php?mudi=add&nohrefStr=close
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/sigubbs/cms/blob/main/36/csrf.md; https://github.com/sigubbs/cms/blob/main/36/csrf.md
CVE: CVE-2024-36668
Published: 2024-06-05
Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/type_deal.php?mudi=del
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/sigubbs/cms/blob/main/35/csrf.md; https://github.com/sigubbs/cms/blob/main/35/csrf.md
CVE: CVE-2024-36669
Published: 2024-06-05
Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/type_deal.php?mudi=add.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/sigubbs/cms/blob/main/34/csrf.md; https://github.com/sigubbs/cms/blob/main/34/csrf.md
CVE: CVE-2024-36670
Published: 2024-06-05
Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/vpsClass_deal.php?mudi=del
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/sigubbs/cms/blob/main/33/csrf.md; https://github.com/sigubbs/cms/blob/main/33/csrf.md
CVE: CVE-2023-6734
Published: 2024-06-05
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-33679. Reason: This candidate is a reservation duplicate of CVE-2024-33679. Notes: All CVE users should reference CVE-2024-33679 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-5171
Published: 2024-06-05
Description: Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers:


  *  Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.
  *  Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.
  *  Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-190
References: https://issues.chromium.org/issues/332382766; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5NRNCEYS246CYGOR32MF7OGKWOWER22/
CVE: CVE-2024-5653
Published: 2024-06-05
Description: A vulnerability, which was classified as critical, has been found in Chanjet Smooth T+system 3.5. This issue affects some unknown processing of the file /tplus/UFAQD/keyEdit.aspx. The manipulation of the argument KeyID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-267185 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/vulreport3r/cve-reports/blob/main/There_is_a_SQL_injection_vulnerability_in_the_Changjietong_T%2Bsystem/report.md; https://vuldb.com/?ctiid.267185; https://vuldb.com/?id.267185
CVE: CVE-2024-0912
Published: 2024-06-06
Description: Under certain circumstances the Microsoft® Internet Information Server (IIS) used to host the C•CURE 9000 Web Server will log Microsoft Windows credential details within logs. There is no impact to non-web service interfaces C•CURE 9000 or prior versions
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-03; https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2024/jci-psa-2024-04.pdf; https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-03
CVE: CVE-2023-6956
Published: 2024-06-06
Description: The EasyAzon – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘easyazon-cloaking-locale’ parameter in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wordpress.org/plugins/easyazon/; https://www.wordfence.com/threat-intel/vulnerabilities/id/3d13454c-0c46-4b16-8e0e-bbfcf2338230?source=cve; https://wordpress.org/plugins/easyazon/
CVE: CVE-2023-6966
Published: 2024-06-06
Description: The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX functions in the /core/core_ajax.php file in all versions up to, and including, 9.6.3. This makes it possible for authenticated attackers, with subscriber access and above, to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lower-severity actions.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284, CWE-862
References: https://plugins.trac.wordpress.org/browser/the-moneytizer/trunk/core/core_ajax.php; https://plugins.trac.wordpress.org/changeset/3099347/the-moneytizer/trunk/core/core_ajax.php?old=3038641&old_path=the-moneytizer%2Ftrunk%2Fcore%2Fcore_ajax.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=cve
CVE: CVE-2023-6968
Published: 2024-06-06
Description: The The Moneytizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.6.3. This is due to missing or incorrect nonce validation on multiple AJAX functions. This makes it possible for unauthenticated attackers to to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lower-severity actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.1 (HIGH)
CWE: CWE-284, CWE-352
References: https://plugins.trac.wordpress.org/changeset/3099347/the-moneytizer/trunk/core/core_ajax.php?old=3038641&old_path=the-moneytizer%2Ftrunk%2Fcore%2Fcore_ajax.php; https://wordpress.org/plugins/the-moneytizer/; https://www.wordfence.com/threat-intel/vulnerabilities/id/14351561-bd31-4aaa-931a-e[PII_REDACTED]3?source=cve
CVE: CVE-2024-0910
Published: 2024-06-06
Description: The Restrict for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 due to improper restrictions on hidden data that make it accessible through the REST API. This makes it possible for unauthenticated attackers to extract potentially sensitive data from post content.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3104418%40restrict-for-elementor&new=3104418%40restrict-for-elementor; https://wordpress.org/plugins/restrict-for-elementor/; https://www.wordfence.com/threat-intel/vulnerabilities/id/14993c04-7fe3-4c42-a605-2e431df14d79?source=cve
CVE: CVE-2024-2350
Published: 2024-06-06
Description: The Clever Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CAFE Icon, CAFE Team Member, and CAFE Slider widgets in all versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3105517%40cafe-lite&new=3105517%40cafe-lite&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ca5befe9-7769-4367-84cf-05aabeced67a?source=cve; https://plugins.trac.wordpress.org/browser/cafe-lite/trunk/src/widgets/class-clever-icon.php#L396
CVE: CVE-2024-4194
Published: 2024-06-06
Description: The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/album-and-image-gallery-plus-lightbox/trunk/includes/shortcode/aigpl-gallery-album-slider.php#L207; https://plugins.trac.wordpress.org/browser/album-and-image-gallery-plus-lightbox/trunk/includes/shortcode/aigpl-gallery-album.php#L185; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3097986%40album-and-image-gallery-plus-lightbox&new=3097986%40album-and-image-gallery-plus-lightbox&sfp_email=&sfph_mail=
CVE: CVE-2024-4705
Published: 2024-06-06
Description: The Testimonials Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonials shortcode in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/testimonials-widget/trunk/includes/class-testimonials-widget-premium.php#L2198; https://www.wordfence.com/threat-intel/vulnerabilities/id/ef4603b2-bd41-4f65-ba2a-8d06e32e67c1?source=cve; https://plugins.trac.wordpress.org/browser/testimonials-widget/trunk/includes/class-testimonials-widget-premium.php#L2198
CVE: CVE-2024-4788
Published: 2024-06-06
Description: The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_bhf_post function in all versions up to, and including, 1.3.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to create pages or posts with arbitrary content.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/boostify-header-footer-builder/trunk/inc/admin/class-admin.php#L280; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3108382%40boostify-header-footer-builder&new=3108382%40boostify-header-footer-builder&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/1090acfc-5b0c-478a-ac71-db54fdaefdf5?source=cve
CVE: CVE-2024-4942
Published: 2024-06-06
Description: The Custom Dash plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wordpress.org/plugins/custom-dash/; https://www.wordfence.com/threat-intel/vulnerabilities/id/13344366-feb0-4987-9543-222e3d35dab3?source=cve; https://wordpress.org/plugins/custom-dash/