deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-0707
Published: 2025-01-24
Description: A vulnerability was found in Rise Group Rise Mode Temp CPU 2.1. It has been classified as critical. This affects an unknown part in the library CRYPTBASE.dll of the component Startup. The manipulation leads to untrusted search path. The attack needs to be approached locally.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://vuldb.com/?ctiid.293235; https://vuldb.com/?id.293235; https://vuldb.com/?submit.481088
CVE: CVE-2025-0708
Published: 2025-01-24
Description: A vulnerability was found in fumiao opencms 2.2. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/model/addOrUpdate of the component Add Model Management Page. The manipulation of the argument 模板前缀 leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://gitee.com/fumiao/opencms/issues/IBI2XM; https://vuldb.com/?ctiid.293236; https://vuldb.com/?id.293236
CVE: CVE-2025-0709
Published: 2025-01-24
Description: A vulnerability was found in Dcat-Admin 2.2.1-beta. It has been rated as problematic. This issue affects some unknown processing of the file /admin/auth/roles of the component Roles Page. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/taynes-llllzt/taynes/issues/7; https://github.com/taynes-llllzt/taynes/issues/7#issue[PII_REDACTED]; https://vuldb.com/?ctiid.293237
CVE: CVE-2025-0710
Published: 2025-01-24
Description: A vulnerability classified as problematic has been found in CampCodes School Management Software 1.0. Affected is an unknown function of the file /notice-list of the component Notice Board Page. The manipulation of the argument Notice leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/anamika126/Stackofvulnerabilities/blob/main/Stored%20Cross%20Site%20Scripting%20-%20Notice%20Board.pdf; https://vuldb.com/?ctiid.293238; https://vuldb.com/?id.293238
CVE: CVE-2025-21262
Published: 2025-01-24
Description: User Interface (UI) Misrepresentation of Critical Information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-451
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21262
CVE: CVE-2024-50690
Published: 2025-01-24
Description: SunGrow WiNet-SV200.001.00.P027 and earlier versions contains a hardcoded password that can be used to decrypt all firmware updates.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-798
References: https://en.sungrowpower.com/security-notice-detail-2/5961
CVE: CVE-2024-50692
Published: 2025-01-24
Description: SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbitrary inverter. It is also possible to impersonate the broker, because TLS is not used to identify the real MQTT broker. This means that MQTT communications are vulnerable to MitM attacks at the TCP/IP level.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-798
References: https://en.sungrowpower.com/security-notice-detail-2/5961; https://mqtt-pwn.readthedocs.io/en/latest/intro.html
CVE: CVE-2024-50694
Published: 2025-01-24
Description: In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when copying the timestamp read from an MQTT message, the underlying code does not check the bounds of the buffer that is used to store the message. This may lead to a stack-based buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://en.sungrowpower.com/security-notice-detail-2/5961
CVE: CVE-2024-50695
Published: 2025-01-24
Description: SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to stack-based buffer overflow when parsing MQTT messages, due to missing MQTT topic bounds checks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://en.sungrowpower.com/security-notice-detail-2/5961
CVE: CVE-2024-50697
Published: 2025-01-24
Description: In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when decrypting MQTT messages, the code that parses specific TLV fields does not have sufficient bounds checks. This may result in a stack-based buffer overflow.
CVSS Score: 8.1 (HIGH)
CWE: CWE-120
References: https://en.sungrowpower.com/security-notice-detail-2/5961
CVE: CVE-2024-50698
Published: 2025-01-24
Description: SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to heap-based buffer overflow due to bounds checks of the MQTT message content.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122
References: https://en.sungrowpower.com/security-notice-detail-2/5961
CVE: CVE-2025-24360
Published: 2025-01-25
Description: Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263; https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/vite-node.ts#L39; https://github.com/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f
CVE: CVE-2025-24361
Published: 2025-01-25
Description: Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack builder or version 3.12.2 through 3.152 of the rspack builder and a victim opens a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject a malicious script in their site and run the script. By using `Function::toString` against the values in `window.webpackChunknuxt_app`, the attacker can get the source code. Version 3.15.13 of Nuxt patches this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-749
References: https://github.com/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f; https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99
CVE: CVE-2025-0357
Published: 2025-01-25
Description: The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'WPB_Profile_controller::handle_image_upload' function in versions up to, and including, 1.6.9. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://documentation.iqonic.design/wpbookit/versions/change-log; https://www.wordfence.com/threat-intel/vulnerabilities/id/19bf7a68-e76d-4740-9f35-b6084094f59b?source=cve
CVE: CVE-2024-13709
Published: 2025-01-25
Description: The Linear plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.1. This is due to missing or incorrect nonce validation on the 'linear-debug'. This makes it possible for unauthenticated attackers to reset the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/linear/trunk/includes/class-linear-settings.php#L1874; https://plugins.trac.wordpress.org/changeset/3231249; https://www.wordfence.com/threat-intel/vulnerabilities/id/83af4ee4-2763-4706-8cb2-fa102a72be68?source=cve
CVE: CVE-2025-0411
Published: 2025-01-25
Description: 7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.
CVSS Score: 7.0 (HIGH)
CWE: CWE-693
References: https://www.zerodayinitiative.com/advisories/ZDI-25-045/; http://www.openwall.com/lists/oss-security/2025/01/24/6; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-13721
Published: 2025-01-25
Description: The Plethora Plugins Tabs + Accordions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the anchor parameter in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-85
References: https://plugins.trac.wordpress.org/browser/plethora-tabs-accordions/trunk/plethoraplugins-tabs.php#L423; https://www.wordfence.com/threat-intel/vulnerabilities/id/9755e5d4-dbf6-4778-84d6-cc967e8afb48?source=cve
CVE: CVE-2025-0682
Published: 2025-01-25
Description: The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.0 via the 'trx_sc_reviews' shortcode 'type' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
CVSS Score: 8.8 (HIGH)
CWE: CWE-98
References: https://themeforest.net/item/qwery-multipurpose-business-wordpress-theme/29678687; https://www.wordfence.com/threat-intel/vulnerabilities/id/15a9718f-f877-4e33-8f7a-950791c4ca85?source=cve
CVE: CVE-2024-10552
Published: 2025-01-25
Description: The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘api_key’ and 'api_secret' parameters in all versions up to, and including, 3.14.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 3.14.25.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/flexmls-idx/trunk/views/admin-intro-api.php#L22; https://plugins.trac.wordpress.org/browser/flexmls-idx/trunk/views/admin-intro-api.php#L30; https://plugins.trac.wordpress.org/changeset/3226484/
CVE: CVE-2024-12600
Published: 2025-01-25
Description: The Custom Product Tabs Lite for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.0 via deserialization of untrusted input from the 'frs_woo_product_tabs' parameter. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/woocommerce-custom-product-tabs-lite/trunk/woocommerce-custom-product-tabs-lite.php#L372; https://plugins.trac.wordpress.org/changeset/3226839/; https://www.wordfence.com/threat-intel/vulnerabilities/id/33c16b47-3202-4f26-bf45-98172b8cac45?source=cve
CVE: CVE-2024-11825
Published: 2025-01-25
Description: The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘zone’ parameter in all versions up to, and including, 1.51.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/broadstreet/tags/1.50.1/Broadstreet/Utility.php#L199; https://plugins.trac.wordpress.org/changeset/3230089/; https://wordpress.org/plugins/broadstreet/#developers
CVE: CVE-2024-12076
Published: 2025-01-25
Description: The Target Video Easy Publish plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.3. This is due to missing or incorrect nonce validation on the resync_carousel(), seek_snapshot(), uploaded_cc(), and remove_cc() functions. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/brid-video-easy-publish/trunk/lib/BridHtml.php#L1169; https://plugins.trac.wordpress.org/browser/brid-video-easy-publish/trunk/lib/BridHtml.php#L1185; https://plugins.trac.wordpress.org/browser/brid-video-easy-publish/trunk/lib/BridHtml.php#L465
CVE: CVE-2024-12113
Published: 2025-01-25
Description: The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_user_review() and delete_review() functions in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete other user's reviews.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3227855%40youzify&new=3227855%40youzify&sfp_email=&sfph_mail=; https://wordpress.org/plugins/youzify/; https://www.wordfence.com/threat-intel/vulnerabilities/id/977e407c-0650-454f-98bd-b39bb8c8c61f?source=cve
CVE: CVE-2024-12512
Published: 2025-01-25
Description: The Ask Me Anything (Anonymously) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'askmeanythingpeople' shortcode in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/ask-me-anything-anonymously/; https://www.wordfence.com/threat-intel/vulnerabilities/id/0f204d39-8a4a-4008-adc6-3ba72531f5a2?source=cve
CVE: CVE-2024-12529
Published: 2025-01-25
Description: The brodos.net Onlineshop Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'BrodosCategory' shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/brodos-net-onlineshop/tags/2.0.1/class.onlineshop-init.php#L113; https://www.wordfence.com/threat-intel/vulnerabilities/id/19a672c6-e911-46bb-a55b-c5788eedca3e?source=cve
CVE: CVE-2024-12816
Published: 2025-01-25
Description: The NOTICE BOARD BY TOWKIR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'notice-board' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/notice-board-by-towkir/trunk/towkir-notice-board.php; https://wordpress.org/plugins/notice-board-by-towkir/; https://www.wordfence.com/threat-intel/vulnerabilities/id/069b2f3e-da9d-476c-a9fa-1b7d445a704b?source=cve
CVE: CVE-2024-12817
Published: 2025-01-25
Description: The Etsy Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'product_link' shortcode in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/etsy-importer/trunk/includes/shortcodes.php; https://wordpress.org/plugins/etsy-importer/; https://www.wordfence.com/threat-intel/vulnerabilities/id/b9d77b08-3a4a-441b-8725-fd93744de73c?source=cve
CVE: CVE-2024-12826
Published: 2025-01-25
Description: The GoHero Store Customizer for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wooh_action_settings_save_frontend() function in all versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to update limited plugin settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3228648%40personalize-woocommerce-cart-page&new=3228648%40personalize-woocommerce-cart-page&sfp_email=&sfph_mail=; https://wordpress.org/plugins/personalize-woocommerce-cart-page/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f65ee908-004f-4526-aeca-41b36522bb30?source=cve
CVE: CVE-2024-12885
Published: 2025-01-25
Description: The Connections Business Directory plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation when deleting a connections image directory in all versions up to, and including, 10.4.66. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server and all their content.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://wordpress.org/plugins/connections/; https://www.wordfence.com/threat-intel/vulnerabilities/id/25e0c269-55c2-49f0-96bb-ae2696e2cea8?source=cve
CVE: CVE-2024-13368
Published: 2025-01-25
Description: The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the youzify_offer_banner() function in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary site options to a value of one.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/youzify/tags/1.3.2/includes/admin/core/functions/youzify-general-functions.php#L961; https://plugins.trac.wordpress.org/browser/youzify/tags/1.3.3/includes/admin/core/functions/youzify-general-functions.php#L951; https://plugins.trac.wordpress.org/changeset/3257383/youzify/trunk?contextall=1&old=3236422&old_path=%2Fyouzify%2Ftrunk
CVE: CVE-2024-13370
Published: 2025-01-25
Description: The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the save_addon_key_license() function in all versions up to, and including, 1.3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options to a value of a valid license key.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/youzify/tags/1.3.2/includes/admin/class-youzify-admin.php?desc=1#L1348; https://plugins.trac.wordpress.org/browser/youzify/tags/1.3.3/includes/admin/class-youzify-admin.php?desc=1#L1348; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3236422%40youzify&new=3236422%40youzify&sfp_email=&sfph_mail=
CVE: CVE-2024-13441
Published: 2025-01-25
Description: The Bilingual Linker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bl_otherlang_link_1 parameter in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/bilingual-linker/tags/2.4/bilingual-linker.php#L291; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3228519%40bilingual-linker&new=3228519%40bilingual-linker&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/daeda8d7-1bff-4258-9953-b4303f1778d0?source=cve
CVE: CVE-2024-13458
Published: 2025-01-25
Description: The WordPress SEO Friendly Accordion FAQ with AI assisted content generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'noticefaq' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/notice-faq/trunk/noticefaq.php#L49; https://www.wordfence.com/threat-intel/vulnerabilities/id/713f5bf5-f282-436e-8e8c-18543458bea1?source=cve
CVE: CVE-2024-13467
Published: 2025-01-25
Description: The WP Contact Form7 Email Spam Blocker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-contact-form7-email-spam-blocker/; https://www.wordfence.com/threat-intel/vulnerabilities/id/b70a1344-2b55-40c9-a314-80d581e0b019?source=cve
CVE: CVE-2024-13548
Published: 2025-01-25
Description: The Power Ups for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'magic-button' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/power-ups-for-elementor/trunk/modules/magic-buttons-for-elementor/magic_buttons_shortcodes.php; https://wordpress.org/plugins/power-ups-for-elementor/; https://www.wordfence.com/threat-intel/vulnerabilities/id/3b7ab552-1ec5-4479-84b9-3e44f6c0354d?source=cve