deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-55075
Published: 2025-01-06
Description: Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-425
References: https://m10x.de/posts/2024/11/all-your-recipe-are-belong-to-us-part-1/3-stored-xss-csrf-and-broken-access-control-vulnerabilities-in-grocy/
CVE: CVE-2024-55076
Published: 2025-01-06
Description: Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://m10x.de/posts/2024/11/all-your-recipe-are-belong-to-us-part-1/3-stored-xss-csrf-and-broken-access-control-vulnerabilities-in-grocy/; https://m10x.de/posts/2024/11/all-your-recipe-are-belong-to-us-part-1/3-stored-xss-csrf-and-broken-access-control-vulnerabilities-in-grocy/
CVE: CVE-2021-27285
Published: 2025-01-06
Description: An issue was discovered in Inspur ClusterEngine v4.0 that allows attackers to gain escalated Local privileges and execute arbitrary commands via /opt/tsce4/torque6/bin/getJobsByShell.
CVSS Score: 8.4 (HIGH)
CWE: CWE-276
References: https://github.com/fjh1997/CVE-2021-27285
CVE: CVE-2024-46981
Published: 2025-01-06
Description: Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://github.com/redis/redis/releases/tag/6.2.17; https://github.com/redis/redis/releases/tag/7.2.7; https://github.com/redis/redis/releases/tag/7.4.2
CVE: CVE-2024-48455
Published: 2025-01-06
Description: An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.0.3500 and 3.0.0.3329 and Netis Wifi Router MW5360 1.0.1.3442 and 1.0.1.3031 allows a remote attacker to obtain sensitive information via the mode_name, wl_link parameters of the skk_get.cgi component.
CVSS Score: 2.7 (LOW)
References: https://github.com/users/h00die-gr3y/projects/1/views/1; https://github.com/users/h00die-gr3y/projects/1/views/1?pane=issue&itemId=92065458&issue=h00die-gr3y%7Ch00die-gr3y%7C2
CVE: CVE-2024-48456
Published: 2025-01-06
Description: An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.0.3500 and 3.0.0.3329 and Netis Wifi Router MW5360 1.0.1.3442 and 1.0.1.3031 allows a remote attacker to obtain sensitive information via the parameter password at the change admin password page at the router web interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/users/h00die-gr3y/projects/1/views/1
CVE: CVE-2024-48457
Published: 2025-01-06
Description: An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.0.3500 and 3.0.0.3329 and Netis Wifi Router MW5360 1.0.1.3442 and 1.0.1.3031 allows a remote attacker to obtain sensitive information via the endpoint /cgi-bin/skk_set.cgi and binary /bin/scripts/start_wifi.sh
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/users/h00die-gr3y/projects/1/views/1
CVE: CVE-2024-51741
Published: 2025-01-06
Description: Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9
CVE: CVE-2024-53931
Published: 2025-01-06
Description: The com.glitter.caller.screen (aka iCaller, Caller Theme & Dialer) application through 1.1 for Android enables any application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.glitter.caller.screen.DialerActivity component.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-732, CWE-922
References: https://github.com/actuator/com.glitter.caller.screen/blob/main/CVE-2024-53931
CVE: CVE-2024-53932
Published: 2025-01-06
Description: The com.remi.colorphone.callscreen.calltheme.callerscreen (aka Color Phone: Call Screen Theme) application through 21.1.9 for Android enables any application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.remi.colorphone.callscreen.calltheme.callerscreen.dialer.DialerActivity component.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-732, CWE-922
References: https://github.com/actuator/com.remi.colorphone.callscreen.calltheme.callerscreen/blob/main/CVE-2024-53932
CVE: CVE-2024-53933
Published: 2025-01-06
Description: The com.callerscreen.colorphone.themes.callflash (aka Color Call Theme & Call Screen) application through 1.0.7 for Android enables any application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.android.call.color.app.activities.DialerActivity component.
CVSS Score: 6.3 (MEDIUM)
References: https://github.com/actuator/com.callerscreen.colorphone.themes.callflash; https://github.com/actuator/com.callerscreen.colorphone.themes.callflash/blob/main/CVE-2024-53933
CVE: CVE-2024-53934
Published: 2025-01-06
Description: The com.windymob.callscreen.ringtone.callcolor.colorphone (aka Color Phone Call Screen Themes) application through 1.1.2 for Android enables any application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.frovis.androidbase.call.DialerActivity component.
CVSS Score: 7.7 (HIGH)
CWE: CWE-281
References: https://github.com/actuator/com.windymob.callscreen.ringtone.callcolor.colorphone; https://github.com/actuator/com.windymob.callscreen.ringtone.callcolor.colorphone/blob/main/CVE-2024-53934
CVE: CVE-2024-53935
Published: 2025-01-06
Description: The com.callos14.callscreen.colorphone (aka iCall OS17 - Color Phone Flash) application through 4.3 for Android enables any application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.callos14.callscreen.colorphone.DialerActivity component.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/actuator/com.callos14.callscreen.colorphone; https://github.com/actuator/com.callos14.callscreen.colorphone/blob/main/CVE-2024-53935
CVE: CVE-2024-53936
Published: 2025-01-06
Description: The com.asianmobile.callcolor (aka Color Phone Call Screen App) application through 24 for Android enables any application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.asianmobile.callcolor.ui.component.call.CallActivity component.
CVSS Score: 6.3 (MEDIUM)
References: https://github.com/actuator/com.asianmobile.callcolor; https://github.com/actuator/com.asianmobile.callcolor/blob/main/CVE-2024-53936
CVE: CVE-2024-54763
Published: 2025-01-06
Description: An access control issue in the component /login/hostinfo.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/Shuanunio/CVE_Requests/blob/main/ipTIME/A2004/ipTIME_A2004_unauthorized_access_vulnerability_first.md; https://github.com/Shuanunio/CVE_Requests/blob/main/ipTIME/A2004/ipTIME_A2004_unauthorized_access_vulnerability_first.md
CVE: CVE-2025-21616
Published: 2025-01-06
Description: Plane is an open-source project management tool. A cross-site scripting (XSS) vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/makeplane/plane/security/advisories/GHSA-rcg8-g69v-x23j; https://github.com/makeplane/plane/security/advisories/GHSA-rcg8-g69v-x23j
CVE: CVE-2024-54764
Published: 2025-01-06
Description: An access control issue in the component /login/hostinfo2.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/Shuanunio/CVE_Requests/blob/main/ipTIME/A2004/ipTIME_A2004_unauthorized_access_vulnerability_second.md; https://github.com/Shuanunio/CVE_Requests/blob/main/ipTIME/A2004/ipTIME_A2004_unauthorized_access_vulnerability_second.md
CVE: CVE-2024-54767
Published: 2025-01-06
Description: An access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information without authentication. NOTE: this is disputed by the Supplier because it cannot be reproduced, and the issue report focuses on an unintended configuration with direct Internet exposure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://github.com/Shuanunio/CVE_Requests/blob/main/AVM/fritz/AVM_FRITZ%21Box_7530%20AX_unauthorized_access_vulnerability_first.md; https://github.com/Shuanunio/CVE_Requests/issues/1
CVE: CVE-2024-55553
Published: 2025-01-06
Description: In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the internal socket's buffer size, default 4K on most OSes. An attacker can use this to trigger re-parsing of the RIB for FRR routers using RTR by causing more than this number of updates during an update interval (usually 30 minutes). Additionally, this effect regularly occurs organically. Furthermore, an attacker can use this to trigger route validation continuously. Given that routers with large full tables may need more than 30 minutes to fully re-validate the table, continuous issuance/withdrawal of large numbers of ROA may be used to impact the route handling performance of all FRR instances using RPKI globally. Additionally, the re-validation will cause heightened BMP traffic to ingestors. Fixed Versions: 10.0.3, 10.1.2, 10.2.1, >= 10.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://frrouting.org/security/cve-2024-55553/; https://github.com/FRRouting/frr/pull/17586/commits/b0800bfdf04b4fcf48504737ebfe4ba7f05268d3; https://lists.debian.org/debian-lts-announce/2025/01/msg00023.html
CVE: CVE-2025-21620
Published: 2025-01-06
Description: Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch() redirect handling creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain. This vulnerability is fixed in 2.1.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/denoland/deno/security/advisories/GHSA-f27p-cmv8-xhm6
CVE: CVE-2025-22395
Published: 2025-01-07
Description: Dell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary remote scripts on the server. Exploitation may lead to a denial of service by an attacker.
CVSS Score: 8.2 (HIGH)
CWE: CWE-280
References: https://www.dell.com/support/kbdoc/en-us/000269079/dsa-2025-034-security-update-for-dell-update-package-dup-framework-vulnerability
CVE: CVE-2024-11437
Published: 2025-01-07
Description: The Timeline Designer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/timeline-designer/trunk/admin/assets/admin-shortcode-list.php#L41; https://plugins.trac.wordpress.org/changeset/3343759/; https://www.wordfence.com/threat-intel/vulnerabilities/id/12349179-e61c-42b8-b0ff-5b49fc4906c1?source=cve
CVE: CVE-2024-11777
Published: 2025-01-07
Description: The Sell Media plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sell_media_search_form_gutenberg' shortcode in all versions up to, and including, 2.5.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/sell-media/trunk//gutenberg/blocks/sell-media-search-form/sell-media-search-form.php#L219; https://wordpress.org/plugins/sell-media/; https://www.wordfence.com/threat-intel/vulnerabilities/id/8a35f0bb-691f-4acf-a30d-4ddabe3b919c?source=cve
CVE: CVE-2024-11899
Published: 2025-01-07
Description: The Slider Pro Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sliderpro' shortcode in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/slider-pro-lite/tags/1.4.1/public/class-slider-renderer.php#L181; https://plugins.trac.wordpress.org/browser/slider-pro-lite/tags/1.4.1/public/class-sliderpro.php#L310; https://plugins.trac.wordpress.org/browser/slider-pro-lite/tags/1.4.1/public/class-sliderpro.php#L447
CVE: CVE-2024-11934
Published: 2025-01-07
Description: The Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formaloo' shortcode in all versions up to, and including, 2.1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/formaloo-form-builder/trunk/formaloo.php#L431; https://wordpress.org/plugins/formaloo-form-builder/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/4b7ddf44-a1d2-4042-9219-591ebc8e4250?source=cve
CVE: CVE-2024-12022
Published: 2025-01-07
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-52485. Reason: This candidate is a reservation duplicate of CVE-2024-52485. Notes: All CVE users should reference CVE-2024-52485 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-12098
Published: 2025-01-07
Description: The ARS Affiliate Page Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'utm_keyword' parameter in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3217945%40ars-affiliate-page&new=3217945%40ars-affiliate-page&sfp_email=&sfph_mail=; https://wordpress.org/plugins/ars-affiliate-page/; https://www.wordfence.com/threat-intel/vulnerabilities/id/a25b2187-2ba8-4332-9f96-a003edd97ff6?source=cve
CVE: CVE-2024-12402
Published: 2025-01-07
Description: The Themes Coder – Create Android & iOS Apps For Your Woocommerce Site plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.4. This is due to the plugin not properly validating a user's identity prior to updating their password through the update_user_profile() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://plugins.trac.wordpress.org/browser/tc-ecommerce/trunk/controller/app_user.php#L338; https://plugins.trac.wordpress.org/changeset/3303561/tc-ecommerce/trunk/controller/app_user.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/1ec14b1e-6d1a-4451-9fce-ac064623d92f?source=cve
CVE: CVE-2024-12416
Published: 2025-01-07
Description: The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to SQL Injection via the 'woomotiv_seen_products_.*' cookie in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset/3237395/; https://www.wordfence.com/threat-intel/vulnerabilities/id/82016921-4efb-47b4-9a75-45cae4ad80f9?source=cve
CVE: CVE-2024-12419
Published: 2025-01-07
Description: The The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This functionality is also vulnerable to Reflected Cross-Site Scripting. Version 1.7.0 patched the Reflected XSS issue, however, the arbitrary shortcode execution issue remains.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/cf7-styler/tags/1.6.9/admin/class-cf7-customizer-admin.php#L295; https://plugins.trac.wordpress.org/browser/cf7-styler/tags/1.6.9/admin/class-cf7-customizer-admin.php#L300; https://plugins.trac.wordpress.org/browser/cf7-styler/tags/1.6.9/admin/class-cf7-customizer-admin.php#L405
CVE: CVE-2024-12528
Published: 2025-01-07
Description: The WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsurveypoll_results' shortcode in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-survey-and-poll/trunk/wordpress-survey-and-poll.php#L146; https://plugins.trac.wordpress.org/browser/wp-survey-and-poll/trunk/wordpress-survey-and-poll.php#L49; https://www.wordfence.com/threat-intel/vulnerabilities/id/51cc6247-1948-4de1-b347-c7d818400777?source=cve
CVE: CVE-2024-12538
Published: 2025-01-07
Description: The Duplicate Post, Page and Any Custom Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.5 via the 'dpp_duplicate_as_draft' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract potentially sensitive data from draft, scheduled (future), private, and password protected posts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3220879/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f38543ff-1074-4273-be33-8142d59e904f?source=cve
CVE: CVE-2024-12540
Published: 2025-01-07
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-54288. Reason: This candidate is a reservation duplicate of CVE-2024-54288. Notes: All CVE users should reference CVE-2024-54288 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-12541
Published: 2025-01-07
Description: The Chative Live chat and Chatbot plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the add_chative_widget_action() function. This makes it possible for unauthenticated attackers to change the channel ID or organization ID via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This could lead to redirecting the live chat widget to an attacker-controlled channel.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3218201%40chative-live-chat-and-chatbot&new=3218201%40chative-live-chat-and-chatbot&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/61d3cb97-f12b-4480-88fc-2bdcbf4cdae3?source=cve
CVE: CVE-2024-12557
Published: 2025-01-07
Description: The Transporters.io plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3218776%40transportersio&new=3218776%40transportersio&sfp_email=&sfph_mail=; https://wordpress.org/plugins/transportersio/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/2f79778c-c11a-4d98-bc26-8113c3fef630?source=cve
CVE: CVE-2024-12559
Published: 2025-01-07
Description: The ClickDesigns plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'clickdesigns_add_api' and the 'clickdesigns_remove_api' functions in all versions up to, and including, 1.8.0. This makes it possible for unauthenticated attackers to modify or remove the plugin's API key.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/clickdesigns/tags/1.8.0/includes/clickdesigns-ajax.php#L64; https://plugins.trac.wordpress.org/browser/clickdesigns/tags/1.8.0/includes/clickdesigns-ajax.php#L79; https://plugins.trac.wordpress.org/changeset/3232040/clickdesigns/trunk/includes/clickdesigns-ajax.php