deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-54236
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Bulk Product Editor ni-woocommerce-product-editor allows Reflected XSS.This issue affects Ni WooCommerce Bulk Product Editor: from n/a through <= 1.4.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ni-woocommerce-product-editor/vulnerability/wordpress-ni-woocommerce-bulk-product-editor-plugin-1-4-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54237
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni CRM Lead ni-crm-lead allows Reflected XSS.This issue affects Ni CRM Lead: from n/a through <= 1.3.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ni-crm-lead/vulnerability/wordpress-ni-crm-lead-plugin-1-3-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54238
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cleveland Heights-University Heights Public Library Webdeveloper Board Document Manager from CHUHPL board-document-manager-from-chuhpl allows Reflected XSS.This issue affects Board Document Manager from CHUHPL: from n/a through <= 1.9.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/board-document-manager-from-chuhpl/vulnerability/wordpress-board-document-manager-from-chuhpl-plugin-1-9-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54239
Published: 2024-12-13
Description: Missing Authorization vulnerability in dugudlabs Eyewear prescription form eyewear-prescription-form allows Privilege Escalation.This issue affects Eyewear prescription form: from n/a through <= 4.0.18.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/eyewear-prescription-form/vulnerability/wordpress-eyewear-prescription-form-plugin-4-0-18-arbitrary-option-update-to-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-54240
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazeonline Blaze Online eParcel for WooCommerce blaze-online-eparcel-for-woocommerce allows Reflected XSS.This issue affects Blaze Online eParcel for WooCommerce: from n/a through <= 1.3.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/blaze-online-eparcel-for-woocommerce/vulnerability/wordpress-blaze-online-eparcel-for-woocommerce-plugin-1-3-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54241
Published: 2024-12-13
Description: Missing Authorization vulnerability in Appsbd Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification: from 1.5 through n/a.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/elite-notification/vulnerability/wordpress-elite-notification-plugin-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54242
Published: 2024-12-13
Description: Missing Authorization vulnerability in appsbd Simple Notification simple-notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Notification: from n/a through <= 1.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/simple-notification/vulnerability/wordpress-simple-notification-plugin-1-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-54243
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Echoza echoza allows Stored XSS.This issue affects Echoza: from n/a through <= 0.1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/echoza/vulnerability/wordpress-echoza-plugin-0-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54244
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Easy Replace easy-replace allows Stored XSS.This issue affects Easy Replace: from n/a through <= 1.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/easy-replace/vulnerability/wordpress-easy-replace-plugin-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54245
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Clients clients allows Stored XSS.This issue affects Clients: from n/a through <= 1.1.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/clients/vulnerability/wordpress-clients-plugin-1-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54246
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 FAQs faqs allows Stored XSS.This issue affects FAQs: from n/a through <= 1.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/faqs/vulnerability/wordpress-faqs-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54248
Published: 2024-12-13
Description: Cross-Site Request Forgery (CSRF) vulnerability in eewee eewee admin custom eewee-admincustom allows Privilege Escalation.This issue affects eewee admin custom: from n/a through <= 1.8.2.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/eewee-admincustom/vulnerability/wordpress-eewee-admin-custom-plugin-1-8-2-4-csrf-to-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-54250
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prodigycommerce Prodigy Commerce prodigy-commerce allows DOM-Based XSS.This issue affects Prodigy Commerce: from n/a through <= 3.0.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/prodigy-commerce/vulnerability/wordpress-prodigy-commerce-plugin-3-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54252
Published: 2024-12-13
Description: Missing Authorization vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through <= 2.9.9.5.7.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/booking-system/vulnerability/wordpress-pinpoint-booking-system-plugin-2-9-9-5-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-54256
Published: 2024-12-13
Description: Missing Authorization vulnerability in Seerox Easy Blocks pro easy-blocks-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Easy Blocks pro: from n/a through <= 1.0.21.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/easy-blocks-pro/vulnerability/wordpress-easy-blocks-pro-plugin-1-0-21-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-54258
Published: 2024-12-13
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anzar Ahmed Ni CRM Lead ni-crm-lead allows SQL Injection.This issue affects Ni CRM Lead: from n/a through <= 1.3.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/ni-crm-lead/vulnerability/wordpress-ni-crm-lead-plugin-1-3-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-54259
Published: 2024-12-13
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Path Traversal.This issue affects DELUCKS SEO: from n/a through <= 2.7.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/delucks-seo/vulnerability/wordpress-delucks-seo-plugin-2-5-5-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2024-54261
Published: 2024-12-13
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HK Digital Agency LLC TAX SERVICE Electronic HDM virtual-hdm-for-taxservice-am allows SQL Injection.This issue affects TAX SERVICE Electronic HDM: from n/a through <= 1.2.2.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/virtual-hdm-for-taxservice-am/vulnerability/wordpress-tax-service-electronic-hdm-plugin-1-1-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-54262
Published: 2024-12-13
Description: Unrestricted Upload of File with Dangerous Type vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Import Export For WooCommerce: from n/a through <= 1.6.2.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/import-export-for-woocommerce/vulnerability/wordpress-import-export-for-woocommerce-plugin-1-5-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-54264
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmorillas1 Shortcodes Blocks Creator Ultimate ultimate-shortcodes-creator allows Reflected XSS.This issue affects Shortcodes Blocks Creator Ultimate: from n/a through <= 2.2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-shortcodes-creator/vulnerability/wordpress-shortcodes-blocks-creator-ultimate-plugin-2-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54265
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Reflected XSS.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.6.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/vulnerability/wordpress-barcode-scanner-and-inventory-manager-plugin-1-6-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54266
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ImageRecycle ImageRecycle pdf & image compression imagerecycle-pdf-image-compression allows Reflected XSS.This issue affects ImageRecycle pdf & image compression: from n/a through <= 3.1.16.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/imagerecycle-pdf-image-compression/vulnerability/wordpress-imagerecycle-pdf-image-compression-plugin-3-1-16-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54267
Published: 2024-12-13
Description: Missing Authorization vulnerability in CreativeMindsSolutions CM Answers cm-answers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Answers: from n/a through <= 3.2.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/cm-answers/vulnerability/wordpress-cm-answers-plugin-3-2-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-54268
Published: 2024-12-13
Description: Missing Authorization vulnerability in Greg - SiteOrigin SiteOrigin Widgets Bundle so-widgets-bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteOrigin Widgets Bundle: from n/a through <= 1.64.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/so-widgets-bundle/vulnerability/wordpress-siteorigin-widgets-bundle-plugin-1-64-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-54271
Published: 2024-12-13
Description: Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wpcargo/vulnerability/wordpress-wpcargo-track-trace-plugin-7-0-6-settings-change-vulnerability?_s_id=cve
CVE: CVE-2024-54272
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Radius Blocks radius-blocks allows Stored XSS.This issue affects Radius Blocks: from n/a through <= 2.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/radius-blocks/vulnerability/wordpress-radius-blocks-plugin-2-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54273
Published: 2024-12-13
Description: Deserialization of Untrusted Data vulnerability in PickPlugins Mail Picker mail-picker allows Object Injection.This issue affects Mail Picker: from n/a through <= 1.0.14.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/mail-picker/vulnerability/wordpress-mail-picker-plugin-1-0-14-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-54274
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Octrace WordPress HelpDesk & Support Ticket System Plugin – Octrace Support octrace-support allows Reflected XSS.This issue affects WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: from n/a through <= 1.2.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/octrace-support/vulnerability/wordpress-octrace-support-plugin-1-2-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54275
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wibergsweb CSV to html csv-to-html allows Reflected XSS.This issue affects CSV to html: from n/a through <= 3.08.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/csv-to-html/vulnerability/wordpress-csv-to-html-plugin-3-04-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54276
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devfelixmoira Poll Builder poll-builder allows Stored XSS.This issue affects Poll Builder: from n/a through <= 1.3.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/poll-builder/vulnerability/wordpress-poll-builder-plugin-1-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54277
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alireza Aliniya Nias course nias-course allows DOM-Based XSS.This issue affects Nias course: from n/a through <= 1.2.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/nias-course/vulnerability/wordpress-nias-course-plugin-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54278
Published: 2024-12-13
Description: Missing Authorization vulnerability in Plugin Devs News Ticker for Elementor news-ticker-for-elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects News Ticker for Elementor: from n/a through <= 2.1.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/news-ticker-for-elementor/vulnerability/wordpress-news-ticker-for-elementor-plugin-2-1-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-54282
Published: 2024-12-13
Description: Deserialization of Untrusted Data vulnerability in Themeum WP Mega Menu wp-megamenu allows Object Injection.This issue affects WP Mega Menu: from n/a through <= 1.4.2.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/wp-megamenu/vulnerability/wordpress-wp-mega-menu-plugin-1-4-2-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-54286
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Smaily Smaily for WP smaily-for-wp allows Stored XSS.This issue affects Smaily for WP: from n/a through <= 3.1.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/smaily-for-wp/vulnerability/wordpress-smaily-for-wp-plugin-3-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54287
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Best WP Developer Advanced Blog Post Block advanced-blog-post-block allows Stored XSS.This issue affects Advanced Blog Post Block: from n/a through <= 1.0.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/advanced-blog-post-block/vulnerability/wordpress-advanced-blog-post-block-plugin-1-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54288
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LDD Web Design LDD Directory Lite ldd-directory-lite allows Reflected XSS.This issue affects LDD Directory Lite: from n/a through <= 3.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ldd-directory-lite/vulnerability/wordpress-ldd-directory-lite-plugin-3-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54289
Published: 2024-12-13
Description: Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through <= 6.3.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/awesome-support/vulnerability/wordpress-awesome-support-plugin-6-3-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-54290
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Fletcher Role Includer role-includer allows Reflected XSS.This issue affects Role Includer: from n/a through <= 1.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/role-includer/vulnerability/wordpress-role-includer-plugin-1-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54292
Published: 2024-12-13
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsplate Appsplate appsplate allows SQL Injection.This issue affects Appsplate: from n/a through <= 2.1.3.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/appsplate/vulnerability/wordpress-appsplate-plugin-2-1-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-54293
Published: 2024-12-13
Description: Incorrect Privilege Assignment vulnerability in CE21 CE21 Suite ce21-suite allows Privilege Escalation.This issue affects CE21 Suite: from n/a through <= 2.2.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/ce21-suite/vulnerability/wordpress-ce21-suite-plugin-2-2-0-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-54294
Published: 2024-12-13
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Appgenix Infotech Firebase OTP Authentication authentication-via-otp-using-firebase allows Authentication Bypass.This issue affects Firebase OTP Authentication: from n/a through <= 1.0.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://patchstack.com/database/Wordpress/Plugin/authentication-via-otp-using-firebase/vulnerability/wordpress-firebase-otp-authentication-plugin-1-0-1-account-takeover-vulnerability?_s_id=cve
CVE: CVE-2024-54295
Published: 2024-12-13
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder ListApp Mobile Manager listapp-mobile-manager allows Authentication Bypass.This issue affects ListApp Mobile Manager: from n/a through <= 1.7.7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://patchstack.com/database/Wordpress/Plugin/listapp-mobile-manager/vulnerability/wordpress-listapp-mobile-manager-plugin-1-7-7-account-takeover-vulnerability?_s_id=cve
CVE: CVE-2024-54296
Published: 2024-12-13
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Codexpert, Inc CoSchool LMS coschool allows Authentication Bypass.This issue affects CoSchool LMS: from n/a through <= 1.4.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://patchstack.com/database/Wordpress/Plugin/coschool/vulnerability/wordpress-coschool-lms-plugin-1-2-account-takeover-vulnerability?_s_id=cve
CVE: CVE-2024-54297
Published: 2024-12-13
Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in extremeidea vBSSO-lite vbsso-lite allows Authentication Bypass.This issue affects vBSSO-lite: from n/a through <= 1.4.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://patchstack.com/database/Wordpress/Plugin/vbsso-lite/vulnerability/wordpress-vbsso-lite-plugin-1-4-3-account-takeover-vulnerability?_s_id=cve
CVE: CVE-2024-54298
Published: 2024-12-13
Description: Missing Authorization vulnerability in sminozzi Car Dealer cardealer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Dealer: from n/a through <= 4.46.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/cardealer/vulnerability/wordpress-car-dealer-plugin-4-46-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-54299
Published: 2024-12-13
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revidev Revi.io revi-io-customer-and-product-reviews allows Reflected XSS.This issue affects Revi.io: from n/a through <= 5.7.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/revi-io-customer-and-product-reviews/vulnerability/wordpress-revi-io-plugin-5-7-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-54300
Published: 2024-12-13
Description: Cross-Site Request Forgery (CSRF) vulnerability in Basar Ventures AutoWP autowp-ai-content-writer-rewriter allows Cross Site Request Forgery.This issue affects AutoWP: from n/a through <= 2.0.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/autowp-ai-content-writer-rewriter/vulnerability/wordpress-autowp-plugin-2-0-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve