deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-22346
Published: 2023-02-13
Description: Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing template information. Having a user of Screen Creator Advance 2 to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://jvn.jp/en/vu/JVNVU98917488/; https://www.electronics.jtekt.co.jp/en/topics/[PII_REDACTED]33/; https://www.electronics.jtekt.co.jp/jp/topics/[PII_REDACTED]454/
CVE: CVE-2023-22347
Published: 2023-02-13
Description: Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing file structure information. Having a user of Screen Creator Advance 2 to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://jvn.jp/en/vu/JVNVU98917488/; https://www.electronics.jtekt.co.jp/en/topics/[PII_REDACTED]33/; https://www.electronics.jtekt.co.jp/jp/topics/[PII_REDACTED]454/
CVE: CVE-2023-22349
Published: 2023-02-13
Description: Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing screen management information. Having a user of Screen Creator Advance 2 to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://jvn.jp/en/vu/JVNVU98917488/; https://www.electronics.jtekt.co.jp/en/topics/[PII_REDACTED]33/; https://www.electronics.jtekt.co.jp/jp/topics/[PII_REDACTED]454/
CVE: CVE-2023-22350
Published: 2023-02-13
Description: Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing parts management information. Having a user of Screen Creator Advance 2 to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://jvn.jp/en/vu/JVNVU98917488/; https://www.electronics.jtekt.co.jp/en/topics/[PII_REDACTED]33/; https://www.electronics.jtekt.co.jp/jp/topics/[PII_REDACTED]454/
CVE: CVE-2023-22353
Published: 2023-02-13
Description: Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing control management information. Having a user of Screen Creator Advance 2 to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://jvn.jp/en/vu/JVNVU98917488/; https://www.electronics.jtekt.co.jp/en/topics/[PII_REDACTED]33/; https://www.electronics.jtekt.co.jp/jp/topics/[PII_REDACTED]454/
CVE: CVE-2023-22360
Published: 2023-02-13
Description: Use-after free vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error handling process even when an error was detected. Having a user of Screen Creator Advance 2 to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://jvn.jp/en/vu/JVNVU98917488/; https://www.electronics.jtekt.co.jp/en/topics/[PII_REDACTED]33/; https://www.electronics.jtekt.co.jp/jp/topics/[PII_REDACTED]454/
CVE: CVE-2023-22362
Published: 2023-02-13
Description: SUSHIRO App for Android outputs sensitive information to the log file, which may result in an attacker obtaining a credential information from the log file. Affected products/versions are as follows: SUSHIRO Ver.4.0.31, Thailand SUSHIRO Ver.1.0.0, Hong Kong SUSHIRO Ver.3.0.2, Singapore SUSHIRO Ver.2.0.0, and Taiwan SUSHIRO Ver.2.0.1
CVSS Score: 7.5 (HIGH)
CWE: CWE-532, CWE-532
References: https://jvn.jp/en/jp/JVN84642320/; https://play.google.com/store/apps/details?id=hk.co.akindo_sushiro.sushiroapp; https://play.google.com/store/apps/details?id=jp.co.akindo_sushiro.sushiroapp
CVE: CVE-2023-22367
Published: 2023-02-13
Description: Ichiran App for iOS versions prior to 3.1.0 and Ichiran App for Android versions prior to 3.1.0 improperly verify server certificates, which may allow a remote unauthenticated attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://apps.apple.com/jp/app/%E4%B8%80%E8%98%AD%E5%85%AC%E5%BC%8F%E3%82%A2%E3%83%97%E3%83%AA/id[PII_REDACTED]; https://jvn.jp/en/jp/JVN11257333/; https://play.google.com/store/apps/details?id=jp.co.ichiran.app&hl=ja
CVE: CVE-2022-25937
Published: 2023-02-13
Description: Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory. This is related to but distinct from the vulnerability reported in [CVE-2018-3715](https://security.snyk.io/vuln/npm:glance:20180129).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22, CWE-22
References: https://github.com/jarofghosts/glance/commit/8cecfe90286e0c45a5494067f1b592d0ccfeabac; https://security.snyk.io/vuln/SNYK-JS-GLANCE-3318395; https://github.com/jarofghosts/glance/commit/8cecfe90286e0c45a5494067f1b592d0ccfeabac
CVE: CVE-2022-48322
Published: 2023-02-13
Description: NETGEAR Nighthawk WiFi Mesh systems and routers are affected by a stack-based buffer overflow vulnerability. This affects MR60 before 1.1.7.132, MS60 before 1.1.7.132, R6900P before 1.3.3.154, R7000P before 1.3.3.154, R7960P before 1.4.4.94, and R8000P before 1.4.4.94.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://kb.netgear.com/000065265/Security-Advisory-for-Pre-authentication-Buffer-Overflow-on-Multiple-Products-PSV-2022-0155; https://kb.netgear.com/000065265/Security-Advisory-for-Pre-authentication-Buffer-Overflow-on-Multiple-Products-PSV-2022-0155
CVE: CVE-2022-48323
Published: 2023-02-13
Description: Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker can execute arbitrary programs on the victim host by sending a crafted HTTP request, as demonstrated by /check?cmd=ping../ followed by the pathname of the powershell.exe program.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://asec.ahnlab.com/en/47088/; https://github.com/projectdiscovery/nuclei-templates/blob/8500efb7c5c52261229bb87b3af8a6e4e5afc877/cnvd/2022/CNVD-2022-03672.yaml; https://www.cnvd.org.cn/flaw/show/CNVD-2022-03672
CVE: CVE-2023-25727
Published: 2023-02-13
Description: In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.phpmyadmin.net/security/PMASA-2023-1/; https://lists.debian.org/debian-lts-announce/2025/04/msg00016.html; https://www.phpmyadmin.net/security/PMASA-2023-1/
CVE: CVE-2023-23697
Published: 2023-02-13
Description: Dell Command | Intel vPro Out of Band, versions before 4.4.0, contain an arbitrary folder delete vulnerability during uninstallation. A locally authenticated malicious user may potentially exploit this vulnerability leading to arbitrary folder deletion.


CVSS Score: 4.7 (MEDIUM)
CWE: CWE-1386, CWE-59
References: https://www.dell.com/support/kbdoc/en-us/000207929/dsa-2023-030; https://www.dell.com/support/kbdoc/en-us/000207929/dsa-2023-030
CVE: CVE-2023-24572
Published: 2023-02-13
Description: 
Dell Command | Integration Suite for System Center, versions before 6.4.0 contain an arbitrary folder delete vulnerability during uninstallation. A locally authenticated malicious user may potentially exploit this vulnerability leading to arbitrary folder deletion.


CVSS Score: 4.7 (MEDIUM)
CWE: CWE-1386, CWE-59
References: https://www.dell.com/support/kbdoc/en-us/000207931/dsa-2023-032; https://www.dell.com/support/kbdoc/en-us/000207931/dsa-2023-032
CVE: CVE-2022-34397
Published: 2023-02-13
Description: 
Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 10.0.0.5 and below contains an authorization bypass vulnerability, allowing users to perform actions in which they are not authorized.


CVSS Score: 6.9 (MEDIUM)
CWE: CWE-863
References: https://www.dell.com/support/kbdoc/en-us/000207177/dsa-2022-340-dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000207177/dsa-2022-340-dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities
CVE: CVE-2022-45454
Published: 2023-02-13
Description: Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Agent (Windows) before build 30161, Acronis Cyber Protect 15 (Windows) before build 30984.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-276
References: https://security-advisory.acronis.com/advisories/SEC-4379; https://security-advisory.acronis.com/advisories/SEC-4379
CVE: CVE-2022-45455
Published: 2023-02-13
Description: Local privilege escalation due to incomplete uninstallation cleanup. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107, Acronis Agent (Windows) before build 30025, Acronis Cyber Protect 15 (Windows) before build 30984.
CVSS Score: 7.8 (HIGH)
CWE: CWE-459, CWE-459
References: https://security-advisory.acronis.com/advisories/SEC-4459; https://security-advisory.acronis.com/advisories/SEC-4459
CVE: CVE-2023-0808
Published: 2023-02-13
Description: A vulnerability was found in Deye/Revolt/Bosswerk Inverter MW3_15U_5406_1.47/MW3_15U_5406_1.471. It has been rated as problematic. This issue affects some unknown processing of the component Access Point Setting Handler. The manipulation with the input 12345678 leads to use of hard-coded password. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version MW3_16U_5406_1.53 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-220769 was assigned to this vulnerability.
CVSS Score: 3.9 (LOW)
CWE: CWE-259, CWE-798
References: https://heise.de/-7483376; https://vuldb.com/?ctiid.220769; https://vuldb.com/?id.220769
CVE: CVE-2022-45724
Published: 2023-02-13
Description: Incorrect Access Control in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to perform any HTTP request to an unauthenticated page to force the server to generate a SESSION_ID, and using this SESSION_ID an attacker can then perform authenticated requests.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287, CWE-287
References: http://cf-wr6110n.com; http://comfast.com; http://sn0ox.com/research/2023/02/05/CVE-COMFAST-CF-WR610N.html
CVE: CVE-2022-45725
Published: 2023-02-13
Description: Improper Input Validation in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to execute arbitrary code on the target via an HTTP POST request
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://cf-wr6110n.com; http://comfast.com; http://sn0ox.com/research/2023/02/05/CVE-COMFAST-CF-WR610N.html
CVE: CVE-2022-3891
Published: 2023-02-13
Description: The WP FullCalendar WordPress plugin before 1.5 does not ensure that the post retrieved via an AJAX action is public and can be accessed by the user making the request, allowing unauthenticated attackers to get the content of arbitrary posts, including draft/private as well as password-protected ones.
CVSS Score: 5.3 (MEDIUM)
References: https://wpscan.com/vulnerability/5a69965d-d243-4d51-b7a4-d6f4b199abf1; https://wpscan.com/vulnerability/5a69965d-d243-4d51-b7a4-d6f4b199abf1
CVE: CVE-2022-40022
Published: 2023-02-13
Description: Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: http://packetstormsecurity.com/files/172907/Symmetricom-SyncServer-Unauthenticated-Remote-Command-Execution.html; https://www.microsemi.com/campaigns/network-time-servers/S650p/%3Fgd%3D1&id=5&gclid=Cj0KCQjwjbyYBhCdARIsAArC6LL-202ej5YfDB5lMIMSZ2735qjo5yaj2i-PrvLv2Cnh_kIJtFJ0oF8aAlMpEALw_wcB; https://www.microsemi.com/campaigns/network-time-servers/syncserver-s600/?url=
CVE: CVE-2022-4445
Published: 2023-02-13
Description: The FL3R FeelBox WordPress plugin through 8.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/9bb6fde0-1347-496b-be03-3512e6b7e8f8; https://wpscan.com/vulnerability/9bb6fde0-1347-496b-be03-3512e6b7e8f8
CVE: CVE-2022-4448
Published: 2023-02-13
Description: The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/ce467a2e-081e-4a6c-bfa4-29e4447ebd3b; https://wpscan.com/vulnerability/ce467a2e-081e-4a6c-bfa4-29e4447ebd3b
CVE: CVE-2022-4458
Published: 2023-02-13
Description: The amr shortcode any widget WordPress plugin through 4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/c85ceab3-7e79-402d-ad48-a028f1ee070c; https://wpscan.com/vulnerability/c85ceab3-7e79-402d-ad48-a028f1ee070c
CVE: CVE-2022-4471
Published: 2023-02-13
Description: The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/c6cf792b-054c-4d77-bcae-3b700f42130b; https://wpscan.com/vulnerability/c6cf792b-054c-4d77-bcae-3b700f42130b
CVE: CVE-2022-4473
Published: 2023-02-13
Description: The Widget Shortcode WordPress plugin through 0.3.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/5117b2e9-75b5-459a-b22a-b0e1b0744bd3; https://wpscan.com/vulnerability/5117b2e9-75b5-459a-b22a-b0e1b0744bd3
CVE: CVE-2022-4488
Published: 2023-02-13
Description: The Widgets on Pages WordPress plugin before 1.8.0 does not validate and escape its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/e52c18a9-550a-40b1-a413-0e06e5b4aabc; https://wpscan.com/vulnerability/e52c18a9-550a-40b1-a413-0e06e5b4aabc
CVE: CVE-2022-4512
Published: 2023-02-13
Description: The Better Font Awesome WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/7957f355-c767-4f59-bb28-0302d33386a6; https://wpscan.com/vulnerability/7957f355-c767-4f59-bb28-0302d33386a6
CVE: CVE-2022-4546
Published: 2023-02-13
Description: The Mapwiz WordPress plugin through 1.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://bulletin.iese.de/post/mapwiz_1-0-1/; https://wpscan.com/vulnerability/009578b9-016d-49c2-9577-49756c35e1e8; https://bulletin.iese.de/post/mapwiz_1-0-1/
CVE: CVE-2022-4551
Published: 2023-02-13
Description: The Rich Table of Contents WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/91c00b17-00ba-4c3f-8587-d54449a02659; https://wpscan.com/vulnerability/91c00b17-00ba-4c3f-8587-d54449a02659
CVE: CVE-2022-4562
Published: 2023-02-13
Description: The Meks Flexible Shortcodes WordPress plugin before 1.3.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/2013d79b-e9f6-4a5a-b421-e840a3bae063; https://wpscan.com/vulnerability/2013d79b-e9f6-4a5a-b421-e840a3bae063
CVE: CVE-2022-4580
Published: 2023-02-13
Description: The Twenty20 Image Before-After WordPress plugin through 1.5.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/e54804c7-68a9-4c4c-94f9-1c3c9b97e8ca; https://wpscan.com/vulnerability/e54804c7-68a9-4c4c-94f9-1c3c9b97e8ca
CVE: CVE-2022-4628
Published: 2023-02-13
Description: The Easy PayPal Buy Now Button WordPress plugin before 1.7.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/6ae719da-c43c-4b3a-bb8a-efa1de20100a; https://wpscan.com/vulnerability/6ae719da-c43c-4b3a-bb8a-efa1de20100a
CVE: CVE-2022-4656
Published: 2023-02-13
Description: The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.5 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/05976ed8-5a26-4eae-adb2-0ea3b2722391; https://wpscan.com/vulnerability/05976ed8-5a26-4eae-adb2-0ea3b2722391
CVE: CVE-2022-4678
Published: 2023-02-13
Description: The TemplatesNext ToolKit WordPress plugin before 3.2.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/6a36d665-a0ca-4346-8e55-cf9ba45966cc; https://wpscan.com/vulnerability/6a36d665-a0ca-4346-8e55-cf9ba45966cc
CVE: CVE-2022-4682
Published: 2023-02-13
Description: The Lightbox Gallery WordPress plugin before 0.9.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/5fc92954-20cf-4563-806e-e7a8e5ccfc72; https://wpscan.com/vulnerability/5fc92954-20cf-4563-806e-e7a8e5ccfc72
CVE: CVE-2022-4745
Published: 2023-02-13
Description: The WP Customer Area WordPress plugin before 8.1.4 does not have CSRF checks when performing some actions such as chmod, mkdir and copy, which could allow attackers to make a logged-in admin perform them and create arbitrary folders, copy file for example.
CVSS Score: 7.1 (HIGH)
References: https://wpscan.com/vulnerability/9703f42e-bdfe-4787-92c9-47963d9af425; https://wpscan.com/vulnerability/9703f42e-bdfe-4787-92c9-47963d9af425
CVE: CVE-2022-4759
Published: 2023-02-13
Description: The GigPress WordPress plugin before 2.3.28 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/63[PII_REDACTED]-4fa1-8f46-46ff0c8eb959; https://wpscan.com/vulnerability/63[PII_REDACTED]-4fa1-8f46-46ff0c8eb959
CVE: CVE-2022-4783
Published: 2023-02-13
Description: The Youtube Channel Gallery WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/38e4c7fe-94d5-48b9-8659-e114cbbb4252; https://wpscan.com/vulnerability/38e4c7fe-94d5-48b9-8659-e114cbbb4252
CVE: CVE-2022-4830
Published: 2023-02-13
Description: The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ae103336-a411-4ebf-a5f0-2f35701e364c; https://wpscan.com/vulnerability/ae103336-a411-4ebf-a5f0-2f35701e364c
CVE: CVE-2023-0034
Published: 2023-02-13
Description: The JetWidgets For Elementor WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/ffbdb8a1-19c3-45e9-81b0-ad47a0791c4a; https://wpscan.com/vulnerability/ffbdb8a1-19c3-45e9-81b0-ad47a0791c4a
CVE: CVE-2023-0060
Published: 2023-02-13
Description: The Responsive Gallery Grid WordPress plugin before 2.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/be2fc859-3158-4f06-861d-382381a7551b; https://wpscan.com/vulnerability/be2fc859-3158-4f06-861d-382381a7551b