deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-27059
Published: 2023-03-16
Description: A cross-site scripting (XSS) vulnerability in the Edit Group function of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Group Name text field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ChurchCRM/CRM/issues/6450; https://github.com/ChurchCRM/CRM/issues/6450
CVE: CVE-2023-28531
Published: 2023-03-17
Description: ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.
CVSS Score: 9.8 (CRITICAL)
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AN2UDTXEUSKFIOIYMV6JNI5VSBMYZOFT/; https://security.gentoo.org/glsa/202307-01; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-21548
Published: 2023-03-17
Description: 
Dell EMC Unisphere for PowerMax versions before 9.1.0.27, Dell EMC Unisphere for PowerMax Virtual Appliance versions before 9.1.0.27, and PowerMax OS Release 5978 contain an improper certificate validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to carry out a man-in-the-middle attack by supplying a crafted certificate and intercepting the victim's traffic to view or modify a victim’s data in transit.


CVSS Score: 7.4 (HIGH)
CWE: CWE-295, CWE-295
References: https://www.dell.com/support/kbdoc/en-uk/000189606/dsa-2021-134-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-security-update-for-multiple-third-party-component-vulnerabilities; https://www.dell.com/support/kbdoc/en-uk/000189606/dsa-2021-134-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-security-update-for-multiple-third-party-component-vulnerabilities
CVE: CVE-2023-1439
Published: 2023-03-17
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Medicine Tracker System 1.0. This issue affects some unknown processing of the file medicines/view_details.php of the component GET Parameter Handler. The manipulation of the argument GET leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223283.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/GodGua/bug_report/blob/main/SQLi-1.md; https://vuldb.com/?ctiid.223283; https://vuldb.com/?id.223283
CVE: CVE-2023-1440
Published: 2023-03-17
Description: A vulnerability, which was classified as critical, was found in SourceCodester Automatic Question Paper Generator System 1.0. Affected is an unknown function of the file users/user/manage_user.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223284.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/gxu-yuan/bug_report/blob/main/SQLi-1.md; https://vuldb.com/?ctiid.223284; https://vuldb.com/?id.223284
CVE: CVE-2023-1441
Published: 2023-03-17
Description: A vulnerability has been found in SourceCodester Automatic Question Paper Generator System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file admin/courses/view_course.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223285 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/SecurityYH/bug_report/blob/main/SQLi-1.md; https://vuldb.com/?ctiid.223285; https://vuldb.com/?id.223285
CVE: CVE-2023-1442
Published: 2023-03-17
Description: A vulnerability was found in Meizhou Qingyunke QYKCMS 4.3.0. It has been classified as problematic. This affects an unknown part of the file /admin_system/api.php of the component Update Handler. The manipulation of the argument downurl leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223287.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-434
References: https://github.com/VG00000/-/blob/main/README.md; https://vuldb.com/?ctiid.223287; https://vuldb.com/?id.223287
CVE: CVE-2023-1443
Published: 2023-03-17
Description: A vulnerability was found in Filseclab Twister Antivirus 8. It has been declared as problematic. This vulnerability affects the function 0x80112053 in the library fildds.sys of the component IoControlCode Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223288.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404
References: https://drive.google.com/file/d/1xwIyZ8RRdwsHshxhtFMELPv2DdbQ8hBD/view; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1443; https://vuldb.com/?ctiid.223288
CVE: CVE-2023-1444
Published: 2023-03-17
Description: A vulnerability was found in Filseclab Twister Antivirus 8. It has been rated as critical. This issue affects the function 0x8011206B in the library fildds.sys of the component IoControlCode Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223289 was assigned to this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404, CWE-476
References: https://drive.google.com/file/d/1KrkezTwgmt5CnhzlyyWVNLIAeiMvuDEr/view; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1444; https://vuldb.com/?ctiid.223289
CVE: CVE-2023-1445
Published: 2023-03-17
Description: A vulnerability classified as problematic has been found in Filseclab Twister Antivirus 8. Affected is the function 0x80112053 in the library fildds.sys of the component IoControlCode Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. VDB-223290 is the identifier assigned to this vulnerability.
CVSS Score: 3.3 (LOW)
CWE: CWE-404
References: https://drive.google.com/file/d/1VYsdzogyxAsGH-rhUU1Bo_EbgpSEEN_Q/view; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1445; https://vuldb.com/?ctiid.223290
CVE: CVE-2023-1446
Published: 2023-03-17
Description: A vulnerability classified as problematic was found in Watchdog Anti-Virus 1.4.214.0. Affected by this vulnerability is the function 0x80002004/0x80002008 in the library wsdk-driver.sys of the component IoControlCode Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223291.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404, CWE-476
References: https://drive.google.com/file/d/1zjK_DMjHz41RMpfa0iLQ4GXKQwEr4z2T/view; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1446; https://vuldb.com/?ctiid.223291
CVE: CVE-2023-1447
Published: 2023-03-17
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Medicine Tracker System 1.0. Affected by this issue is some unknown functionality of the file app/?page=medicines/manage_medicine. The manipulation of the argument name/description with the input <script>alert('2')</script> leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-223292.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://vuldb.com/?ctiid.223292; https://vuldb.com/?id.223292; https://vuldb.com/?ctiid.223292
CVE: CVE-2023-1448
Published: 2023-03-17
Description: A vulnerability, which was classified as problematic, was found in GPAC 2.3-DEV-rev35-gbbca86917-master. This affects the function gf_m2ts_process_sdt of the file media_tools/mpegts.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier VDB-223293 was assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-122
References: https://github.com/gpac/gpac/issues/2388; https://github.com/xxy1126/Vuln/blob/main/gpac/3; https://vuldb.com/?ctiid.223293
CVE: CVE-2023-1449
Published: 2023-03-17
Description: A vulnerability has been found in GPAC 2.3-DEV-rev35-gbbca86917-master and classified as problematic. This vulnerability affects the function gf_av1_reset_state of the file media_tools/av_parsers.c. The manipulation leads to double free. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-223294 is the identifier assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-415
References: https://github.com/gpac/gpac/issues/2387; https://github.com/xxy1126/Vuln/blob/main/gpac/2; https://vuldb.com/?ctiid.223294
CVE: CVE-2023-1450
Published: 2023-03-17
Description: A vulnerability was found in MP4v2 2.1.2 and classified as problematic. This issue affects the function DumpTrack of the file mp4trackdump.cpp. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223295.
CVSS Score: 3.3 (LOW)
CWE: CWE-404
References: https://github.com/10cksYiqiyinHangzhouTechnology/mp4v2_trackdump_poc; https://github.com/10cksYiqiyinHangzhouTechnology/mp4v2_trackdump_poc/blob/main/id_000005%2Csig_08%2Csrc_000166%2B000357%2Ctime_3137250%2Cexecs_3545598%2Cop_splice%2Crep_16; https://vuldb.com/?ctiid.223295
CVE: CVE-2023-1451
Published: 2023-03-17
Description: A vulnerability was found in MP4v2 2.1.2. It has been classified as problematic. Affected is the function mp4v2::impl::MP4Track::GetSampleFileOffset of the file mp4track.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223296.
CVSS Score: 3.3 (LOW)
CWE: CWE-404
References: https://github.com/RichTrouble/mp4v2_mp4track_poc; https://github.com/RichTrouble/mp4v2_mp4track_poc/blob/main/id_000000%2Csig_08%2Csrc_001076%2Ctime_147809374%2Cexecs_155756872%2Cop_havoc%2Crep_8; https://vuldb.com/?ctiid.223296
CVE: CVE-2023-1452
Published: 2023-03-17
Description: A vulnerability was found in GPAC 2.3-DEV-rev35-gbbca86917-master. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file filters/load_text.c. The manipulation leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier VDB-223297 was assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-120
References: https://github.com/gpac/gpac/issues/2386; https://github.com/xxy1126/Vuln/blob/main/gpac/1.mp4; https://vuldb.com/?ctiid.223297
CVE: CVE-2023-1453
Published: 2023-03-17
Description: A vulnerability was found in Watchdog Anti-Virus 1.4.214.0. It has been rated as critical. Affected by this issue is the function 0x80002008 in the library wsdk-driver.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. VDB-223298 is the identifier assigned to this vulnerability.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-284
References: https://drive.google.com/file/d/1ivMk1uVAvPCCAxqiD2BW9gD1TsktQkpi/view; https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1453; https://vuldb.com/?ctiid.223298
CVE: CVE-2023-1454
Published: 2023-03-17
Description: A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223299.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/J0hnWalker/jeecg-boot-sqli; https://vuldb.com/?ctiid.223299; https://vuldb.com/?id.223299
CVE: CVE-2023-1455
Published: 2023-03-17
Description: A vulnerability classified as critical was found in SourceCodester Online Pizza Ordering System 1.0. This vulnerability affects unknown code of the file admin/ajax.php?action=login2 of the component Login Page. The manipulation of the argument email with the input abc%40qq.com' AND (SELECT 9110 FROM (SELECT(SLEEP(5)))XSlc) AND 'jFNl'='jFNl leads to sql injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223300.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.223300; https://vuldb.com/?id.223300; https://vuldb.com/?ctiid.223300
CVE: CVE-2023-1459
Published: 2023-03-17
Description: A vulnerability was found in SourceCodester Canteen Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file changeUsername.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223304.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://blog.csdn.net/weixin_43864034/article/details/129621725; https://vuldb.com/?ctiid.223304; https://vuldb.com/?id.223304
CVE: CVE-2023-1460
Published: 2023-03-17
Description: A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file admin/ajax.php?action=save_user of the component Password Change Handler. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The identifier VDB-223305 was assigned to this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://vuldb.com/?ctiid.223305; https://vuldb.com/?id.223305; https://vuldb.com/?ctiid.223305
CVE: CVE-2023-1152
Published: 2023-03-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Utarit Information Technologies Persolus allows SQL Injection. This issue affects Persolus: before 2.03.93.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89, CWE-89
References: https://www.usom.gov.tr/bildirim/tr-23-0154-2; https://www.usom.gov.tr/bildirim/tr-23-0154-2
CVE: CVE-2023-1461
Published: 2023-03-17
Description: A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been declared as critical. This vulnerability affects the function query of the file createCategories.php. The manipulation of the argument categoriesStatus leads to sql injection. The attack can be initiated remotely. VDB-223306 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://blog.csdn.net/weixin_43864034/article/details/129622219; https://vuldb.com/?ctiid.223306; https://vuldb.com/?id.223306
CVE: CVE-2023-1463
Published: 2023-03-17
Description: Authorization Bypass Through User-Controlled Key in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/nilsteampassnet/teampass/commit/4e06fbaf2b78c3615d0599855a72ba7e31157516; https://huntr.dev/bounties/f6683c3b-a0f2-4615-b639-1920c8ae12e6; https://github.com/nilsteampassnet/teampass/commit/4e06fbaf2b78c3615d0599855a72ba7e31157516
CVE: CVE-2023-1464
Published: 2023-03-17
Description: A vulnerability, which was classified as critical, was found in SourceCodester Medicine Tracker System 1.0. This affects an unknown part of the file Users.php?f=save_user. The manipulation of the argument firstname/middlename/lastname/username/password leads to improper authentication. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-223311.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://vuldb.com/?ctiid.223311; https://vuldb.com/?id.223311; https://vuldb.com/?ctiid.223311
CVE: CVE-2023-1466
Published: 2023-03-17
Description: A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0. It has been rated as critical. This issue affects the function view_student of the file admin/?page=students/view_student. The manipulation of the argument id with the input 3' AND (SELECT 2100 FROM (SELECT(SLEEP(5)))FWlC) AND 'butz'='butz leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223325 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://vuldb.com/?ctiid.223325; https://vuldb.com/?id.223325; https://vuldb.com/?ctiid.223325
CVE: CVE-2023-1467
Published: 2023-03-17
Description: A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file Master.php?f=delete_img of the component POST Parameter Handler. The manipulation of the argument path with the input C%3A%2Ffoo.txt leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-223326 is the identifier assigned to this vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://vuldb.com/?ctiid.223326; https://vuldb.com/?id.223326; https://vuldb.com/?ctiid.223326
CVE: CVE-2023-1468
Published: 2023-03-17
Description: A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/?page=reports&date_from=2023-02-17&date_to=2023-03-17 of the component Report Handler. The manipulation of the argument date_from/date_to leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-223327.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.223327; https://vuldb.com/?id.223327; https://vuldb.com/?ctiid.223327
CVE: CVE-2023-1172
Published: 2023-03-17
Description: The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2876981%40bookly-responsive-appointment-booking-tool&new=2876981%40bookly-responsive-appointment-booking-tool&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c3efbd9d-e2b5-4915-a964-29a49c7fba86?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2876981%40bookly-responsive-appointment-booking-tool&new=2876981%40bookly-responsive-appointment-booking-tool&sfp_email=&sfph_mail=
CVE: CVE-2023-1469
Published: 2023-03-17
Description: The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This can potentially be exploited by lower-privileged users if the `Admin Dashboard Access Permission` setting it set for those users to access the dashboard.
CVSS Score: 4.4 (MEDIUM)
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2879453%40wp-express-checkout&new=2879453%40wp-express-checkout&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/b35ee801-f04d-4b22-8238-053b02a6ee0c?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2879453%40wp-express-checkout&new=2879453%40wp-express-checkout&sfp_email=&sfph_mail=
CVE: CVE-2022-43461
Published: 2023-03-17
Description: Stored Cross-Site Scripting (XSS) vulnerability in John West Slideshow SE plugin <= 2.5.5 versions.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/slideshow-se/wordpress-slideshow-se-plugin-2-5-5-auth-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/slideshow-se/wordpress-slideshow-se-plugin-2-5-5-auth-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-45814
Published: 2023-03-17
Description: Stored Cross-Site Scripting (XSS) vulnerability in Fabian von Allmen WP Calendar plugin <= 1.5.3 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-calendar/wordpress-wp-calendar-plugin-1-5-3-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-calendar/wordpress-wp-calendar-plugin-1-5-3-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-45817
Published: 2023-03-17
Description: Cross-Site Scripting (XSS) vulnerability in Erin Garscadden GC Testimonials plugin <= 1.3.2 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/gc-testimonials/wordpress-gc-testimonials-plugin-1-3-2-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gc-testimonials/wordpress-gc-testimonials-plugin-1-3-2-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-1470
Published: 2023-03-17
Description: The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2881773/ecommerce-product-catalog/trunk/modules/price/price-settings.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/26b7438e-438b-41eb-9458-2fba8ab1964d?source=cve; https://plugins.trac.wordpress.org/changeset/2881773/ecommerce-product-catalog/trunk/modules/price/price-settings.php