deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-12650
Published: 2025-12-12
Description: The Simple post listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_name' parameter in the postlist shortcode in all versions up to, and including, 0.2. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via mouse interaction.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/simple-post-listing/tags/0.2/simple-post-listing.php#L77; https://www.wordfence.com/threat-intel/vulnerabilities/id/dfdebeab-89f6-49b8-a38f-de2a8df7a7e8?source=cve
CVE: CVE-2025-12783
Published: 2025-12-12
Description: The Premmerce Brands for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveBrandsSettings function in all versions up to, and including, 1.2.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify brand permalink settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/premmerce-woocommerce-brands/tags/1.2.13/src/Admin/Admin.php#L101; https://plugins.trac.wordpress.org/changeset/3465319/; https://www.wordfence.com/threat-intel/vulnerabilities/id/6560ba0b-2190-4d30-b0c4-f07d524ccfde?source=cve
CVE: CVE-2025-12824
Published: 2025-12-12
Description: The Player Leaderboard plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.2 via the 'player_leaderboard' shortcode. This is due to the plugin using an unsanitized user-supplied value from the shortcode's 'mode' attribute in a call to include() without proper path validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve full remote code execution if combined with file upload capabilities.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/player-leaderboard/trunk/public/class-player-leaderboard-public.php#L1419; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3416129%40player-leaderboard&new=3416129%40player-leaderboard; https://www.wordfence.com/threat-intel/vulnerabilities/id/527f8f08-bab3-4319-99bf-845c8b378c19?source=cve
CVE: CVE-2025-12830
Published: 2025-12-12
Description: The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider widget in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/better-elementor-addons/tags/1.5.4/widgets/slider/styles/style1.php#L19; https://plugins.trac.wordpress.org/browser/better-elementor-addons/tags/1.5.4/widgets/slider/styles/style2.php#L17; https://plugins.trac.wordpress.org/browser/better-elementor-addons/tags/1.5.4/widgets/slider/styles/style5.php#L12
CVE: CVE-2025-12834
Published: 2025-12-12
Description: The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'failure_message' parameter in versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/accept-stripe-payments-using-contact-form-7/tags/3.1/inc/lib/class.cf7sa.lib.php#L696; https://plugins.trac.wordpress.org/changeset/3418155/; https://www.wordfence.com/threat-intel/vulnerabilities/id/d9e77e3f-dcd8-426a-be0f-24eb65c6709e?source=cve
CVE: CVE-2025-12883
Published: 2025-12-12
Description: The Campay Woocommerce Payment Gateway plugin for WordPress is vulnerable to Unauthenticated Payment Bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly validating that a transaction has occurred through the payment gateway. This makes it possible for unauthenticated attackers to bypass payments and mark orders as successfully completed resulting in a loss of income.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset?old_path=/campay-api/tags/1.2.2&new_path=/campay-api/tags/1.2.3&sfp_email=&sfph_mail=; https://wordpress.org/plugins/campay-api/; https://www.wordfence.com/threat-intel/vulnerabilities/id/2f12fa00-6108-4bd4-9[PII_REDACTED]f4d0f?source=cve
CVE: CVE-2025-12963
Published: 2025-12-12
Description: The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.29. This is due to the plugin not properly validating a user's identity via the 'wp-json/lazytasks/api/v1/user/role/edit/' REST API endpoint prior to updating their details like email address. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. It is also possible for attackers to abuse this endpoint to grant users with access to additional roles within the plugin
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://wordpress.org/plugins/lazytasks-project-task-management/; https://www.wordfence.com/threat-intel/vulnerabilities/id/c6998185-0f9b-48ab-9dca-05adf5ae603a?source=cve
CVE: CVE-2025-12968
Published: 2025-12-12
Description: The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up to, and including, 2.14.42. This is due to the `upload_file` function in the `infility_import_file` class only validating the MIME type which can be easily spoofed, and the `import_data` function missing capability checks. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3421596%40infility-global&new=3421596%40infility-global&sfp_email=&sfph_mail=; https://wordpress.org/plugins/infility-global/; https://www.wordfence.com/threat-intel/vulnerabilities/id/542a18f6-9d17-4e54-85e1-e01630ca371e?source=cve
CVE: CVE-2025-13314
Published: 2025-12-12
Description: The Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.1.6 due to a missing capability check on the 'filter_save_settings' and 'add_filter_options' AJAX actions. This makes it possible for unauthenticated attackers to modify the plugin's settings and create arbitrary filter options.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/filter-plus/tags/1.1.5/base/enqueue.php#L178; https://plugins.trac.wordpress.org/browser/filter-plus/tags/1.1.5/core/admin/settings/action.php#L23; https://plugins.trac.wordpress.org/browser/filter-plus/tags/1.1.5/core/admin/settings/action.php#L28
CVE: CVE-2025-13320
Published: 2025-12-12
Description: The WP User Manager plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including, 2.9.12. This is due to insufficient validation of user-supplied file paths in the profile update functionality combined with improper handling of array inputs by PHP's filter_input() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server via the 'current_user_avatar' parameter in a two-stage attack which can make remote code execution possible. This only affects sites with the custom avatar setting enabled.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-73
References: https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.12/includes/forms/trait-wpum-account.php#L70; https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.12/includes/forms/trait-wpum-account.php#L75; https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.12/includes/forms/trait-wpum-account.php#L86
CVE: CVE-2025-13334
Published: 2025-12-12
Description: The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized database resets and file deletion due to a missing capability check on the "blaze_demo_importer_install_demo" function in all versions up to, and including, 1.0.13. This makes it possible for authenticated attackers, with subscriber level access and above, to reset the database by truncating all tables (except options, usermeta, and users), delete all sidebar widgets, theme modifications, and content of the uploads folder.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/blaze-demo-importer/tags/1.0.13/blaze-demo-importer.php?marks=67-89#L68; https://www.wordfence.com/threat-intel/vulnerabilities/id/d83cd6a0-d69c-4e6c-b76f-00c398b5f7e6?source=cve
CVE: CVE-2025-13363
Published: 2025-12-12
Description: The IMAQ Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the URL structure settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's URL structure settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/imaq-core/tags/1.2.1/libs/AcademixCorePermalink.php#L58; https://plugins.trac.wordpress.org/browser/imaq-core/trunk/libs/AcademixCorePermalink.php#L58; https://www.wordfence.com/threat-intel/vulnerabilities/id/684de9c5-6f94-455d-b095-9f2df733ab95?source=cve
CVE: CVE-2025-13366
Published: 2025-12-12
Description: The Rabbit Hole plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the plugin's reset functionality. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The vulnerability is exacerbated by the fact that the reset operation is performed via a GET request, making exploitation trivial via image tags or hyperlinks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/rabbit-hole/tags/1.1/functions/admin.php#L7; https://plugins.trac.wordpress.org/browser/rabbit-hole/trunk/functions/admin.php#L7; https://www.wordfence.com/threat-intel/vulnerabilities/id/eab5de7e-ddab-4c6f-af87-acce7b5ff15b?source=cve
CVE: CVE-2025-13408
Published: 2025-12-12
Description: The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.2. This is due to missing or incorrect nonce validation on the foxtool_login_google() function. This makes it possible for unauthenticated attackers to establish an OAuth Connection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.svn.wordpress.org/foxtool/tags/2.5.2/inc/goo.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3416529%40foxtool&new=3416529%40foxtool&sfp_email=&sfph_mail=; https://wordpress.org/plugins/foxtool/
CVE: CVE-2025-13440
Published: 2025-12-12
Description: The Premmerce Wishlist for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.10. This is due to a missing capability check on the deleteWishlist() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary wishlists.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/premmerce-woocommerce-wishlist/tags/1.1.10/src/Admin/Admin.php#L334; https://plugins.trac.wordpress.org/browser/premmerce-woocommerce-wishlist/trunk/src/Admin/Admin.php#L334; https://plugins.trac.wordpress.org/changeset/3426971/
CVE: CVE-2025-13747
Published: 2025-12-12
Description: The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a regex bypass in nsp_shortcode function in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/newstatpress/tags/1.4.3/includes/nsp-core.php#L637; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3426875%40newstatpress&new=3426875%40newstatpress&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/e7ddc418-9458-4335-afdc-6d40c7e23060?source=cve
CVE: CVE-2025-13840
Published: 2025-12-12
Description: The BUKAZU Search widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode' parameter of the 'bukazu_search' shortcode in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/bukazu-search-widget/tags/3.3.2/bukazu-widget.php#L277; https://plugins.trac.wordpress.org/browser/bukazu-search-widget/trunk/bukazu-widget.php#L277; https://plugins.trac.wordpress.org/changeset/3427947/
CVE: CVE-2025-13843
Published: 2025-12-12
Description: The VigLink SpotLight By ShortCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'float' parameter of the 'spotlight' shortcode in all versions up to, and including, 1.0.a due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/viglink-spotlight-by-shortcode/tags/1.0.a/spotlight.php#L20; https://plugins.trac.wordpress.org/browser/viglink-spotlight-by-shortcode/trunk/spotlight.php#L20; https://www.wordfence.com/threat-intel/vulnerabilities/id/f1275a8f-c9ac-4cb3-8aa2-1393ffcc9dc8?source=cve
CVE: CVE-2025-13846
Published: 2025-12-12
Description: The Easy Map Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/easy-map-creator/tags/3.0.2/easy_map_creator.php#L139; https://plugins.trac.wordpress.org/browser/easy-map-creator/trunk/easy_map_creator.php#L139; https://www.wordfence.com/threat-intel/vulnerabilities/id/6e185479-843c-4748-83e5-ae0b300c3fc7?source=cve
CVE: CVE-2025-13850
Published: 2025-12-12
Description: The LS Google Map Router plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'map_type' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ls-gmap-route/tags/1.1.0/ls-gmap_route.php#L61; https://plugins.trac.wordpress.org/browser/ls-gmap-route/trunk/ls-gmap_route.php#L61; https://www.wordfence.com/threat-intel/vulnerabilities/id/e3581172-10d8-4b11-95f7-ee1835e29606?source=cve
CVE: CVE-2025-13866
Published: 2025-12-12
Description: The Flow-Flow Social Feed Stream plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the flow_flow_social_auth AJAX action in versions 3.0.0 to 4.7.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings and store arbitrary JavaScript that executes whenever the plugin settings page is viewed.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/flow-flow-social-streams/trunk/includes/FlowFlowActivator.php#L224; https://plugins.trac.wordpress.org/browser/flow-flow-social-streams/trunk/includes/db/FFDBManager.php#L24; https://www.wordfence.com/threat-intel/vulnerabilities/id/065d01b6-30e0-4bc8-bd70-25996c2df879?source=cve
CVE: CVE-2025-13884
Published: 2025-12-12
Description: The Hide Email Address plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inline_css' parameter in the `bg-hide-email-address` shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/bg-hide-email-address/tags/0.1/BgHideEmailAddress.php#L101; https://plugins.trac.wordpress.org/browser/bg-hide-email-address/trunk/BgHideEmailAddress.php#L101; https://www.wordfence.com/threat-intel/vulnerabilities/id/a770ab37-127a-4018-9ffa-1b326d5a016e?source=cve
CVE: CVE-2025-13885
Published: 2025-12-12
Description: The Zenost Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' and 'target' parameters in the `button` shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/zenost-shortcodes/tags/1.0/inc/shortcodes.php#L25; https://plugins.trac.wordpress.org/browser/zenost-shortcodes/trunk/inc/shortcodes.php#L25; https://www.wordfence.com/threat-intel/vulnerabilities/id/c88d378a-6c58-4670-b0b6-0e0d51c39bd1?source=cve
CVE: CVE-2025-13889
Published: 2025-12-12
Description: The Simple Nivo Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode parameter in all versions up to, and including, 0.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/simple-nivo-slider/tags/0.5.6/simple-nivo-slider.php#L208; https://plugins.trac.wordpress.org/browser/simple-nivo-slider/trunk/simple-nivo-slider.php#L208; https://www.wordfence.com/threat-intel/vulnerabilities/id/0c1c343c-ef16-4468-a983-0dc9fd152dd5?source=cve
CVE: CVE-2025-13904
Published: 2025-12-12
Description: The WPGancio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gancio-event' shortcode in all versions up to, and including, 1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wpgancio/tags/1.12/wc.php#L33; https://plugins.trac.wordpress.org/browser/wpgancio/trunk/wc.php#L33; https://www.wordfence.com/threat-intel/vulnerabilities/id/593fefe1-8813-440b-b8c7-fbfd5b71a737?source=cve
CVE: CVE-2025-13906
Published: 2025-12-12
Description: The WP Flot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linechart' shortcode in all versions up to, and including, 0.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-flot/tags/0.2.2/wpflot.php#L101; https://plugins.trac.wordpress.org/browser/wp-flot/trunk/wpflot.php#L101; https://www.wordfence.com/threat-intel/vulnerabilities/id/b4905ca1-3096-45c5-838b-1237888fb969?source=cve
CVE: CVE-2025-13960
Published: 2025-12-12
Description: The GPXpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gpxpress' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/gpxpress/tags/1.3/includes/Gpxpress.php#L152; https://plugins.trac.wordpress.org/browser/gpxpress/trunk/includes/Gpxpress.php#L152; https://www.wordfence.com/threat-intel/vulnerabilities/id/a2bf5c47-11e6-462d-a671-3f5e94e9e7e5?source=cve
CVE: CVE-2025-13961
Published: 2025-12-12
Description: The Data Visualizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'visualize' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/data-visualizer/tags/1.1/data-visualizer.php#L92; https://plugins.trac.wordpress.org/browser/data-visualizer/trunk/data-visualizer.php#L92; https://www.wordfence.com/threat-intel/vulnerabilities/id/ac7aeb6a-4e41-4301-8e79-ffe1468c0940?source=cve