deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-0344
Published: 2025-01-09
Description: A vulnerability has been found in leiyuxi cy-fast 1.0 and classified as critical. Affected by this vulnerability is the function listData of the file /commpara/listData. The manipulation of the argument order leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/d3do-23/cvelist/blob/main/cy-fast/sqli3.md; https://vuldb.com/?ctiid.290857; https://vuldb.com/?id.290857
CVE: CVE-2024-12802
Published: 2025-01-09
Description: SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when integrated with Microsoft Active Directory, allowing MFA to be configured independently for each login method and potentially enabling attackers to bypass MFA by exploiting the alternative account name.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-305
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0001
CVE: CVE-2024-13153
Published: 2025-01-09
Description: The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.5.135 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: Since the widget code isn't part of the code base, to apply the patch, the affected widgets: Image Tooltip, Notification, Simple Popup, Video Play Button, and Card Carousel, must be deleted and reinstalled manually.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://unlimited-elements.com/change-log/; https://wordpress.org/plugins/unlimited-elements-for-elementor/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/99625a3e-b8a4-42f8-8996-f7c5c0ff2d5f?source=cve
CVE: CVE-2025-0345
Published: 2025-01-09
Description: A vulnerability was found in leiyuxi cy-fast 1.0 and classified as critical. Affected by this issue is the function listData of the file /sys/menu/listData. The manipulation of the argument order leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/d3do-23/cvelist/blob/main/cy-fast/sqli4.md; https://vuldb.com/?ctiid.290858; https://vuldb.com/?id.290858
CVE: CVE-2025-0346
Published: 2025-01-09
Description: A vulnerability was found in code-projects Content Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/publishnews.php of the component Publish News Page. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://code-projects.org/; https://gist.github.com/Lytes/266e5fa6eb4506fe2c7e[PII_REDACTED]9a; https://vuldb.com/?ctiid.290859
CVE: CVE-2025-0347
Published: 2025-01-09
Description: A vulnerability was found in code-projects Admission Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file index.php of the component Login. The manipulation of the argument u_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Curious-L/-/issues/3; https://vuldb.com/?ctiid.290860
CVE: CVE-2025-0348
Published: 2025-01-09
Description: A vulnerability was found in CampCodes DepEd Equipment Inventory System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /data/add_employee.php. The manipulation of the argument data leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/shaturo1337/POCs/blob/main/Stored%20XSS%20Vulnerability%20in%20DepEd%20Equipment%20Inventory%20System.md; https://vuldb.com/?ctiid.290861; https://vuldb.com/?id.290861
CVE: CVE-2024-11328
Published: 2025-01-09
Description: The CLUEVO LMS, E-Learning Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.13.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/cluevo-lms/tags/1.13.2/admin-views/class.module-ratings-page.php#L173; https://plugins.trac.wordpress.org/browser/cluevo-lms/tags/1.13.2/functions/functions.module-management.inc.php#L1228; https://plugins.trac.wordpress.org/browser/cluevo-lms/tags/1.13.2/functions/functions.module-management.inc.php#L1230
CVE: CVE-2024-11642
Published: 2025-01-09
Description: The Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.4.12 via the 'locate_template' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The file included must have a .php extension.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/ajax-filter-posts/tags/3.4.12/inc/Shortcode.php#L624; https://plugins.trac.wordpress.org/browser/ajax-filter-posts/tags/3.4.13/inc/Shortcode.php#L624; https://www.wordfence.com/threat-intel/vulnerabilities/id/b299a932-8167-4547-845b-637c4971360d?source=cve
CVE: CVE-2024-11686
Published: 2025-01-09
Description: The WhatsApp 🚀 click to chat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'manycontacts_code' parameter in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/manycontacts-bar/; https://www.wordfence.com/threat-intel/vulnerabilities/id/7d623840-30d1-4599-a52d-08c28e190699?source=cve
CVE: CVE-2024-11815
Published: 2025-01-09
Description: The Pósturinn\&#039;s Shipping with WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the printed_marked and nonprinted_marked parameters in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3218788/posturinn/trunk/inc/admin.class.php; https://wordpress.org/plugins/posturinn/; https://www.wordfence.com/threat-intel/vulnerabilities/id/6a8dc0e3-ff3a-4abc-afca-eb[PII_REDACTED]?source=cve
CVE: CVE-2024-11907
Published: 2025-01-09
Description: The Skyword API Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skyword_iframe' shortcode in all versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/skyword-plugin/trunk/php/class-skyword-shortcode.php#L93; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3226503%40skyword-plugin&new=3226503%40skyword-plugin&sfp_email=&sfph_mail=; https://wordpress.org/plugins/skyword-plugin/
CVE: CVE-2024-11929
Published: 2025-01-09
Description: The Responsive FlipBook Plugin Wordpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the rfbwp_save_settings() functionin all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-862
References: https://codecanyon.net/item/responsive-flipbook-plugin/2372863; https://www.wordfence.com/threat-intel/vulnerabilities/id/53b24f9a-f225-40b5-9937-f7449d4832df?source=cve
CVE: CVE-2024-12067
Published: 2025-01-09
Description: The WP Travel – Ultimate Travel Booking System, Tour Management Engine plugin for WordPress is vulnerable to SQL Injection via the 'booking_itinerary' parameter of the 'wptravel_get_booking_data' function in all versions up to, and including, 10.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/wp-travel/trunk/app/inc/admin/class-wptravel-admin-assets.php#L17; https://plugins.trac.wordpress.org/browser/wp-travel/trunk/app/inc/admin/class-wptravel-admin-assets.php#L31; https://plugins.trac.wordpress.org/browser/wp-travel/trunk/inc/helpers/helpers-stat.php#L14
CVE: CVE-2024-12122
Published: 2025-01-09
Description: The ResAds plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/resads/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/1c0a544a-b5f3-41bf-9[PII_REDACTED]2ea56?source=cve
CVE: CVE-2024-12206
Published: 2025-01-09
Description: The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.8. This is due to missing or incorrect nonce validation on the stm_header_builder page. This makes it possible for unauthenticated attackers to delete arbitrary headers via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3218670%40pearl-header-builder&new=3218670%40pearl-header-builder&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/4de0d05f-2f51-4fea-9520-ff07a882d95e?source=cve
CVE: CVE-2024-12218
Published: 2025-01-09
Description: The Woocommerce check pincode/zipcode for shipping plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/woocommerce-check-pincode-zipcode-for-shipping/trunk/classes/pincode-list.php#L93; https://wordpress.org/plugins/woocommerce-check-pincode-zipcode-for-shipping/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/5b79b5ae-7ce5-4065-8d7c-487df6752bc7?source=cve
CVE: CVE-2024-12222
Published: 2025-01-09
Description: The Deliver via Shipos for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘dvsfw_bulk_label_url’ parameter in all versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3219605%40wc-shipos-delivery&new=3219605%40wc-shipos-delivery&sfp_email=&sfph_mail=; https://wordpress.org/plugins/wc-shipos-delivery/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/377afb95-02d9-46b9-936d-3d58257dd928?source=cve
CVE: CVE-2024-12249
Published: 2025-01-09
Description: The GS Insever Portfolio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings() function in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's CSS settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/gs-instagram-portfolio/tags/1.4.5/admin/Backend_Builder.php; https://plugins.trac.wordpress.org/browser/gs-instagram-portfolio/tags/1.4.5/admin/includes/Ajax.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/36f3e9be-9a4e-458d-92b3-687afc44696a?source=cve
CVE: CVE-2024-12285
Published: 2025-01-09
Description: The SEMA API plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘catid’ parameter in all versions up to, and including, 5.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3219805%40sema-api&new=3219805%40sema-api&sfp_email=&sfph_mail=; https://wordpress.org/plugins/sema-api/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/42b9e16c-8e53-452d-9c0b-34c424d6f508?source=cve
CVE: CVE-2024-12330
Published: 2025-01-09
Description: The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.3 via publicly accessible back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including all information stored in the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-530
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3209380%40wp-database-backup&new=3209380%40wp-database-backup&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3209387%40wp-database-backup&new=3209387%40wp-database-backup&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/3f36839b-850e-4c39-aa61-4fd7a89cd5bc?source=cve
CVE: CVE-2024-12394
Published: 2025-01-09
Description: The Action Network plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3391261%40wp-action-network&new=3391261%40wp-action-network&sfp_email=&sfph_mail=; https://wordpress.org/plugins/wp-action-network/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/c90dadc9-0109-4ebd-8135-3efd26682ad9?source=cve
CVE: CVE-2024-12491
Published: 2025-01-09
Description: The SimplyRETS Real Estate IDX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sr_search_form' shortcode in all versions up to, and including, 2.11.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3219948%40simply-rets&new=3219948%40simply-rets&sfp_email=&sfph_mail=; https://wordpress.org/plugins/simply-rets/; https://www.wordfence.com/threat-intel/vulnerabilities/id/aa5c2d05-f6cb-4f97-b174-653ad3577b02?source=cve
CVE: CVE-2024-12493
Published: 2025-01-09
Description: The Files Download Delay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fddwrap' shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/files-download-delay/trunk/post.php; https://wordpress.org/plugins/files-download-delay/; https://www.wordfence.com/threat-intel/vulnerabilities/id/217f3595-3c35-46c1-a02c-e8829732a719?source=cve
CVE: CVE-2024-12496
Published: 2025-01-09
Description: The Linear plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linear_block_buy_commissions' shortcode in all versions up to, and including, 2.7.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/linear/trunk/blocks/buy-commissions/buy-commissions.php#L213; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3226733%40linear&new=3226733%40linear&sfp_email=&sfph_mail=#file4; https://wordpress.org/plugins/linear
CVE: CVE-2024-12514
Published: 2025-01-09
Description: The 3DVieweronline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's '3Dvo-model' shortcode in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3240457%403dvieweronline-wp&new=3240457%403dvieweronline-wp&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ee1c9c62-d5b5-4213-ae5a-d3d4e9103d15?source=cve
CVE: CVE-2024-12515
Published: 2025-01-09
Description: The Muslim Prayer Time-Salah/Iqamah plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Masjid ID parameter in all versions up to, and including, 1.8.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3223319%40masjidal&new=3223319%40masjidal&sfp_email=&sfph_mail=; https://wordpress.org/plugins/masjidal/; https://www.wordfence.com/threat-intel/vulnerabilities/id/9e34b3df-ac18-4409-b8fe-b27c931f3aa3?source=cve
CVE: CVE-2024-12542
Published: 2025-01-09
Description: The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 0.1.2. This makes it possible for unauthenticated attackers to read configuration settings and predefined variables on the site's server. The plugin does not need to be activated for the vulnerability to be exploited.
CVSS Score: 8.6 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/linkid/trunk/lib/linkid/linkid-sdk-php/util/index.php#L1; https://www.wordfence.com/threat-intel/vulnerabilities/id/b2fe5315-37b7-4009-b2e5-909e6b5ed1da?source=cve
CVE: CVE-2024-12605
Published: 2025-01-09
Description: The AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5. This is due to missing or incorrect nonce validation on the "al_scribe_content_data" actions. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/ai-scribe-the-chatgpt-powered-seo-content-creation-wizard/trunk/article_builder.php#L713; https://plugins.trac.wordpress.org/changeset/3308461; https://www.wordfence.com/threat-intel/vulnerabilities/id/52a8718f-2c4d-4da1-a81f-e93dff3fa43b?source=cve
CVE: CVE-2024-12616
Published: 2025-01-09
Description: The Bitly&#039;s WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 2.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and retrieve plugin settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wp-bitly/trunk/includes/class-wp-bitly-auth.php#L115; https://plugins.trac.wordpress.org/changeset/3272740/; https://www.wordfence.com/threat-intel/vulnerabilities/id/b1312c34-45c6-41e5-b6fc-a45ac2c8a0ca?source=cve
CVE: CVE-2024-12618
Published: 2025-01-09
Description: The Newsletter2Go plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resetStyles' AJAX action in all versions up to, and including, 4.0.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset styles.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/newsletter2go/trunk/gui/N2Go_Gui.php#L294; https://www.wordfence.com/threat-intel/vulnerabilities/id/09b2d763-63ce-4cc7-aa04-589bb8697ce9?source=cve