deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-5724
Published: 2024-06-19
Description: The Photo Video Gallery Master plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.3 via deserialization of untrusted input 'PVGM_all_photos_details' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://plugins.trac.wordpress.org/browser/photo-video-gallery-master/trunk/photo-video-gallery-master.php#L301; https://www.wordfence.com/threat-intel/vulnerabilities/id/8376556e-ed78-4a0e-a23f-9b2a39db94d9?source=cve; https://plugins.trac.wordpress.org/browser/photo-video-gallery-master/trunk/photo-video-gallery-master.php#L301
CVE: CVE-2024-5768
Published: 2024-06-19
Description: The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mimo_update_provider' function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update shipping provider information, including adding stored cross-site scripting.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/mimo-woocommerce-order-tracking/tags/1.0.2/mimo-woocommerce-order-tracking.php#L304; https://www.wordfence.com/threat-intel/vulnerabilities/id/aa26e595-947c-4327-bbe1-c347688f1209?source=cve; https://plugins.trac.wordpress.org/browser/mimo-woocommerce-order-tracking/tags/1.0.2/mimo-woocommerce-order-tracking.php#L304
CVE: CVE-2024-35298
Published: 2024-06-19
Description: Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to lead a user to access an arbitrary website via another application installed on the user's device. As a result, the user may become a victim of a phishing attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-939
References: https://jvn.jp/en/jp/JVN37818611/; https://jvn.jp/en/jp/JVN37818611/
CVE: CVE-2024-3229
Published: 2024-06-19
Description: The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SLN_Action_Ajax_ImportAssistants function along with missing authorization checks in all versions up to, and including, 10.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://plugins.trac.wordpress.org/changeset/3103584/salon-booking-system/trunk/src/SLN/Action/Ajax/ImportAssistants.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/3bbbf5be-5c0a-4514-88ac-003083c0bba3?source=cve; https://plugins.trac.wordpress.org/changeset/3103584/salon-booking-system/trunk/src/SLN/Action/Ajax/ImportAssistants.php
CVE: CVE-2023-6692
Published: 2024-06-19
Description: The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tab anchor metabox in all versions up to, and including, 3.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3022998%40ultimate-blocks%2Ftrunk&old=3016254%40ultimate-blocks%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/33e7006f-3fb9-4493-9ce5-67698c877159?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3022998%40ultimate-blocks%2Ftrunk&old=3016254%40ultimate-blocks%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-5208
Published: 2024-06-19
Description: An uncontrolled resource consumption vulnerability exists in the `upload-link` endpoint of mintplex-labs/anything-llm. This vulnerability allows attackers to cause a denial of service (DOS) by shutting down the server through sending invalid upload requests. Specifically, the server can be made to shut down by sending an empty body with a 'Content-Length: 0' header or by sending a body with arbitrary content, such as 'asdasdasd', with a 'Content-Length: 9' header. The vulnerability is reproducible by users with at least a 'Manager' role, sending a crafted request to any workspace. This issue indicates that a previous fix was not effective in mitigating the vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/mintplex-labs/anything-llm/commit/e2439c6d4c3cfdacd96cd1b7b92d1f89c3cc8459; https://huntr.com/bounties/6c8bdfa1-ec56-4b02-bde9-cfc27470e6ca; https://github.com/mintplex-labs/anything-llm/commit/e2439c6d4c3cfdacd96cd1b7b92d1f89c3cc8459
CVE: CVE-2024-5343
Published: 2024-06-19
Description: The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.19. This is due to missing or incorrect nonce validation on the 'rbs_ajax_create_article' and 'rbs_ajax_reset_views' functions. This makes it possible for unauthenticated attackers to create new posts and reset gallery view counts via a forged request granted they can trick a Contributor+ level user into performing an action such as clicking on a link.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/robo-gallery/tags/3.2.19/includes/extensions/rbs_create_post_ajax.php#L247; https://plugins.trac.wordpress.org/browser/robo-gallery/tags/3.2.19/includes/extensions/rbs_create_post_ajax.php#L94; https://plugins.trac.wordpress.org/browser/robo-gallery/tags/3.2.19/includes/rbs_gallery_ajax.php#L19
CVE: CVE-2024-5574
Published: 2024-06-19
Description: The WP Magazine Modules Lite plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.2 via the 'blockLayout' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://plugins.trac.wordpress.org/browser/wp-magazine-modules-lite/trunk/includes/src/banner/element.php#L1363; https://plugins.trac.wordpress.org/changeset/3104046/; https://www.wordfence.com/threat-intel/vulnerabilities/id/0aeaf421-513b-4c9d-bd36-58af28c86bc1?source=cve
CVE: CVE-2024-5853
Published: 2024-06-19
Description: The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the sirv_upload_file_by_chanks AJAX action in all versions up to, and including, 7.2.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://plugins.trac.wordpress.org/changeset/3103410/sirv/trunk/sirv.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/e89b40ec-1952-46e3-a91b-bd38e62f8929?source=cve; https://plugins.trac.wordpress.org/changeset/3103410/sirv/trunk/sirv.php
CVE: CVE-2024-6132
Published: 2024-06-19
Description: The Pexels: Free Stock Photos plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'pexels_fsp_images_options_validate' function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/wp-pexels-free-stock-photos/trunk/settings.php#L239; https://www.wordfence.com/threat-intel/vulnerabilities/id/79dd492e-d4da-4209-83a8-d8059263ae92?source=cve; https://plugins.trac.wordpress.org/browser/wp-pexels-free-stock-photos/trunk/settings.php#L239
CVE: CVE-2024-1407
Published: 2024-06-19
Description: The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.10. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to subscribe to, modify, or cancel membership for a user via a forged request granted they can trick a user into performing an action such as clicking on a link.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/strangerstudios/paid-memberships-pro/pull/2839; https://github.com/strangerstudios/paid-memberships-pro/pull/2893; https://plugins.trac.wordpress.org/browser/paid-memberships-pro/tags/2.12.10/includes/functions.php
CVE: CVE-2024-36252
Published: 2024-06-19
Description: Improper restriction of communication channel to intended endpoints issue exists in Ricoh Streamline NX PC Client ver.3.6.x and earlier. If this vulnerability is exploited, arbitrary code may be executed on the PC where the product is installed.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-923
References: https://jvn.jp/en/jp/JVN00442488/; https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000004; https://jvn.jp/en/jp/JVN00442488/
CVE: CVE-2024-36480
Published: 2024-06-19
Description: Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier. If this vulnerability is exploited, an attacker may obtain LocalSystem Account of the PC where the product is installed. As a result, unintended operations may be performed on the PC.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://jvn.jp/en/jp/JVN00442488/; https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000005; https://jvn.jp/en/jp/JVN00442488/
CVE: CVE-2024-36978
Published: 2024-06-19
Description: In the Linux kernel, the following vulnerability has been resolved:

net: sched: sch_multiq: fix possible OOB write in multiq_tune()

q->bands will be assigned to qopt->bands to execute subsequent code logic
after kmalloc. So the old q->bands should not be used in kmalloc.
Otherwise, an out-of-bounds write will occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/0f208fad86631e005754606c3ec80c0d44a11882; https://git.kernel.org/stable/c/52b1aa07cda6a199cd6754d3798c7759023bc70f; https://git.kernel.org/stable/c/54c2c171c11a798fe887b3ff72922aa9d1411c1e
CVE: CVE-2024-37124
Published: 2024-06-19
Description: Use of potentially dangerous function issue exists in Ricoh Streamline NX PC Client. If this vulnerability is exploited, an attacker may create an arbitrary file in the PC where the product is installed.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://jvn.jp/en/jp/JVN00442488/; https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000006; https://jvn.jp/en/jp/JVN00442488/
CVE: CVE-2024-37387
Published: 2024-06-19
Description: Use of potentially dangerous function issue exists in Ricoh Streamline NX PC Client. If this vulnerability is exploited, files in the PC where the product is installed may be altered.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-676
References: https://jvn.jp/en/jp/JVN00442488/; https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2024-000007; https://jvn.jp/en/jp/JVN00442488/
CVE: CVE-2024-37881
Published: 2024-06-19
Description: SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirection from other URLs. However, SiteGuard WP Plugin versions prior to 1.7.7 missed to implement a measure to avoid redirection from wp-register.php. As a result, the customized path to the login page may be exposed.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201, CWE-601
References: https://jvn.jp/en/jp/JVN60331535/; https://plugins.trac.wordpress.org/changeset/3094238/siteguard/trunk/classes/siteguard-rename-login.php?old=2888160&old_path=siteguard%2Ftrunk%2Fclasses%2Fsiteguard-rename-login.php; https://www.jp-secure.com/siteguard_wp_plugin_en/vuls/WPV2024001_en.html
CVE: CVE-2024-3894
Published: 2024-06-19
Description: The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an Image Title in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3100759%40robo-gallery%2Ftrunk&old=3066013%40robo-gallery%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/8e75d72d-d999-4755-8c90-7fb7d630ab00?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3100759%40robo-gallery%2Ftrunk&old=3066013%40robo-gallery%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-0789
Published: 2024-06-19
Description: The WP Maintenance plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 6.1.9.2 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers to bypass maintenance mode.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-348
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3078682%40wp-maintenance%2Ftrunk&old=3069916%40wp-maintenance%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/8f6bbaa1-c50f-4dad-9e5b-04bdffd4a0ae?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3078682%40wp-maintenance%2Ftrunk&old=3069916%40wp-maintenance%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2023-6495
Published: 2024-06-19
Description: The YARPP – Yet Another Related Posts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 5.30.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037032%40yet-another-related-posts-plugin%2Ftrunk&old=2999784%40yet-another-related-posts-plugin%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d586e455-c73f-4916-a926-4d53699bb434?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037032%40yet-another-related-posts-plugin%2Ftrunk&old=2999784%40yet-another-related-posts-plugin%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-0383
Published: 2024-06-19
Description: The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [wprm-recipe-instructions] and [wprm-recipe-ingredients] shortcodes in all versions up to, and including, 9.1.0 due to insufficient restrictions on the 'group_tag' attribute . This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3019769/wp-recipe-maker/trunk/includes/public/shortcodes/recipe/class-wprm-sc-ingredients.php; https://plugins.trac.wordpress.org/changeset/3019769/wp-recipe-maker/trunk/includes/public/shortcodes/recipe/class-wprm-sc-instructions.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/104b3c01-4623-43cb-aed4-16e3be62e1f9?source=cve
CVE: CVE-2024-4632
Published: 2024-06-19
Description: The WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_upload_mimes’ function in versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/cartflows/tags/2.0.7/classes/importer/batch-process/class-cartflows-batch-process.php#L247; https://plugins.trac.wordpress.org/changeset/3087760/; https://www.wordfence.com/threat-intel/vulnerabilities/id/e9a89613-cfd9-4a96-b8eb-4b17376be433?source=cve
CVE: CVE-2023-50900
Published: 2024-06-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in Averta Master Slider.This issue affects Master Slider: from n/a through 3.9.10.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/master-slider/wordpress-master-slider-plugin-3-9-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/master-slider/wordpress-master-slider-plugin-3-9-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-5676
Published: 2024-06-19
Description: The Paradox IP150 Internet Module in version 1.40.00 is vulnerable to Cross-Site Request Forgery (CSRF) attacks due to a lack of countermeasures and the use of the HTTP method `GET` to introduce changes in the system.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2024/Jun/8; https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240321-01_Paradox_Cross_Site_Request_Forgery; https://www.paradox.com/Products/default.asp?CATID=3&SUBCATID=38&PRD=563
CVE: CVE-2023-47771
Published: 2024-06-19
Description: Missing Authorization vulnerability in ThemePunch OHG Essential Grid.This issue affects Essential Grid: from n/a through 3.0.18.
CVSS Score: 8.3 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/essential-grid/wordpress-essential-grid-plugin-3-0-18-multiple-authenticated-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/essential-grid/wordpress-essential-grid-plugin-3-0-18-multiple-authenticated-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-47783
Published: 2024-06-19
Description: Missing Authorization vulnerability in Thrive Themes Thrive Theme Builder.This issue affects Thrive Theme Builder: from n/a before 3.24.0.
CVSS Score: 8.3 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/thrive-theme/wordpress-thrive-theme-builder-theme-3-20-1-multiple-authenticated-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/thrive-theme/wordpress-thrive-theme-builder-theme-3-20-1-multiple-authenticated-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-47788
Published: 2024-06-19
Description: Missing Authorization vulnerability in Automattic Jetpack.This issue affects Jetpack: from n/a before 12.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/jetpack/wordpress-jetpack-plugin-12-7-contributor-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/jetpack/wordpress-jetpack-plugin-12-7-contributor-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-48759
Published: 2024-06-19
Description: Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/jet-elements/wordpress-jetelements-for-elementor-plugin-2-6-13-unauthenticated-arbitrary-attachment-download-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/jet-elements/wordpress-jetelements-for-elementor-plugin-2-6-13-unauthenticated-arbitrary-attachment-download-vulnerability?_s_id=cve
CVE: CVE-2023-48760
Published: 2024-06-19
Description: Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.
CVSS Score: 8.2 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/jet-elements/wordpress-jetelements-for-elementor-plugin-2-6-13-unauthenticated-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/jet-elements/wordpress-jetelements-for-elementor-plugin-2-6-13-unauthenticated-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-48761
Published: 2024-06-19
Description: Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/jet-elements/wordpress-jetelements-for-elementor-plugin-2-6-13-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/jet-elements/wordpress-jetelements-for-elementor-plugin-2-6-13-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-35765
Published: 2024-06-19
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wpsoul Greenshift – animation and page builder blocks allows Stored XSS.This issue affects Greenshift – animation and page builder blocks: from n/a through 8.8.9.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/greenshift-animation-and-page-builder-blocks/wordpress-greenshift-animation-and-page-builder-blocks-plugin-8-8-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/greenshift-animation-and-page-builder-blocks/wordpress-greenshift-animation-and-page-builder-blocks-plugin-8-8-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-35780
Published: 2024-06-19
Description: Deserialization of Untrusted Data vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a through 1.5.42.
CVSS Score: 8.5 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/vulnerability/live-composer-page-builder/wordpress-page-builder-live-composer-plugin-1-5-42-contributor-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/live-composer-page-builder/wordpress-page-builder-live-composer-plugin-1-5-42-contributor-php-object-injection-vulnerability?_s_id=cve