deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-6257
Published: 2024-04-11
Description: The Inline Related Posts WordPress plugin before 3.6.0 is missing authorization in an AJAX action to ensure that users are allowed to see the content of the posts displayed, allowing any authenticated user, such as subscriber to retrieve the content of password protected posts
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/19a86448-8d7c-4f02-9290-d9f93810e6e1/; https://wpscan.com/vulnerability/19a86448-8d7c-4f02-9290-d9f93810e6e1/
CVE: CVE-2024-21508
Published: 2024-04-11
Description: Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://blog.slonser.info/posts/mysql2-attacker-configuration/; https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae[PII_REDACTED]7fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21; https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805
CVE: CVE-2024-29455
Published: 2024-04-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE: CVE-2024-30878
Published: 2024-04-11
Description: A cross-site scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML and obtain sensitive information via a crafted payload injected into the upload_drive parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-94
References: https://github.com/jianyan74/rageframe2/issues/111; https://github.com/jianyan74/rageframe2/issues/111
CVE: CVE-2024-30879
Published: 2024-04-11
Description: Reflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML and obtain sensitive information via a crafted payload injected into the boxId parameter in the image cropping function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/jianyan74/rageframe2/issues/114; https://github.com/jianyan74/rageframe2/issues/114
CVE: CVE-2024-30880
Published: 2024-04-11
Description: Reflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML and obtain sensitive information via a crafted payload injected into the multiple parameter in the image cropping function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/jianyan74/rageframe2/issues/114; https://github.com/jianyan74/rageframe2/issues/114
CVE: CVE-2024-30883
Published: 2024-04-11
Description: Reflected Cross Site Scripting (XSS) vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML and obtain sensitive information via a crafted payload injected into the aspectRatio parameter in the image cropping function.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://github.com/jianyan74/rageframe2/issues/114; https://github.com/jianyan74/rageframe2/issues/114
CVE: CVE-2024-30884
Published: 2024-04-11
Description: Reflected Cross-Site Scripting (XSS) vulnerability in Discuz! version X3.4 20220811, allows remote attackers to execute arbitrary code and obtain sensitive information via crafted payload to the primarybegin parameter in the misc.php component.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://github.com/Hebing123/cve/issues/28; https://github.com/Hebing123/cve/issues/28
CVE: CVE-2024-30885
Published: 2024-04-11
Description: Reflected Cross-Site Scripting (XSS) vulnerability in HadSky v7.6.3, allows remote attackers to execute arbitrary code and obtain sensitive information via the chklogin.php component .
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Hebing123/cve/issues/29; https://github.com/Hebing123/cve/issues/29
CVE: CVE-2024-29399
Published: 2024-04-11
Description: An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the upload.php component.
CVSS Score: 7.6 (HIGH)
CWE: CWE-94
References: https://github.com/ally-petitt/CVE-2024-29399; https://github.com/ally-petitt/CVE-2024-29399
CVE: CVE-2024-30915
Published: 2024-04-11
Description: An issue was discovered in OpenDDS commit b1c534032bb62ad4ae32609778de6b8d6c823a66, allows a local attacker to cause a denial of service and obtain sensitive information via the max_samples parameter within the DataReaderQoS component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/OpenDDS/OpenDDS/issues/4527; https://github.com/OpenDDS/OpenDDS/issues/4527
CVE: CVE-2024-30916
Published: 2024-04-11
Description: An issue was discovered in eProsima FastDDS v.2.14.0 and before, allows a local attacker to cause a denial of service (DoS) and obtain sensitive information via a crafted max_samples parameter in DurabilityService QoS component.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: https://github.com/eProsima/Fast-DDS/issues/4609; https://github.com/eProsima/Fast-DDS/issues/4609
CVE: CVE-2024-30917
Published: 2024-04-11
Description: An issue was discovered in eProsima FastDDS v.2.14.0 and before, allows a local attacker to cause a denial of service (DoS) and obtain sensitive information via a crafted history_depth parameter in DurabilityService QoS component.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-229, CWE-922
References: https://github.com/eProsima/Fast-DDS/issues/4609; https://github.com/eProsima/Fast-DDS/issues/4609
CVE: CVE-2024-2966
Published: 2024-04-11
Description: The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.5.6 via the  element_pack_ajax_search function. This makes it possible for unauthenticated attackers to extract sensitive data including password protected post details.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3066178/bdthemes-element-pack-lite; https://www.wordfence.com/threat-intel/vulnerabilities/id/39e0fd33-4071-4510-a7d5-b499a8a3543c?source=cve; https://plugins.trac.wordpress.org/changeset/3066178/bdthemes-element-pack-lite
CVE: CVE-2024-3285
Published: 2024-04-11
Description: The Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'metaslider' shortcode in all versions up to, and including, 3.70.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3067751/ml-slider; https://www.wordfence.com/threat-intel/vulnerabilities/id/1cbd95bb-6f13-48c9-a51e-5f7bf7a296df?source=cve; https://plugins.trac.wordpress.org/changeset/3067751/ml-slider
CVE: CVE-2023-32228
Published: 2024-04-11
Description: A firmware bug which may lead to misinterpretation of data in the AMC2-4WCF and AMC2-2WCF allowing an adversary to grant access to the last authorized user.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-115
References: https://psirt.bosch.com/security-advisories/BOSCH-SA-391095-BT.html; https://psirt.bosch.com/security-advisories/BOSCH-SA-391095-BT.html
CVE: CVE-2024-20771
Published: 2024-04-11
Description: Bridge versions 13.0.6, 14.0.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/bridge/apsb24-24.html; https://helpx.adobe.com/security/products/bridge/apsb24-24.html
CVE: CVE-2024-20798
Published: 2024-04-11
Description: Illustrator versions 28.3, 27.9.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/illustrator/apsb24-25.html; https://helpx.adobe.com/security/products/illustrator/apsb24-25.html
CVE: CVE-2024-31861
Published: 2024-04-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-32080
Published: 2024-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick Pelton Search Keyword Redirect allows Stored XSS.This issue affects Search Keyword Redirect: from n/a through 1.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-search-keyword-redirect/wordpress-search-keyword-redirect-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-search-keyword-redirect/wordpress-search-keyword-redirect-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-20794
Published: 2024-04-11
Description: Animate versions 23.0.4, 24.0.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service. An attacker could leverage this vulnerability to cause a system crash, resulting in a denial of service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://helpx.adobe.com/security/products/animate/apsb24-26.html; https://helpx.adobe.com/security/products/animate/apsb24-26.html
CVE: CVE-2024-20795
Published: 2024-04-11
Description: Animate versions 23.0.4, 24.0.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://helpx.adobe.com/security/products/animate/apsb24-26.html; https://helpx.adobe.com/security/products/animate/apsb24-26.html
CVE: CVE-2024-20796
Published: 2024-04-11
Description: Animate versions 23.0.4, 24.0.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/animate/apsb24-26.html; https://helpx.adobe.com/security/products/animate/apsb24-26.html
CVE: CVE-2024-20797
Published: 2024-04-11
Description: Animate versions 23.0.4, 24.0.1 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/animate/apsb24-26.html; https://helpx.adobe.com/security/products/animate/apsb24-26.html
CVE: CVE-2024-3343
Published: 2024-04-11
Description: The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block attributes in all versions up to, and including, 2.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3068495/otter-blocks; https://www.wordfence.com/threat-intel/vulnerabilities/id/67981160-6c91-48a4-ba1c-68204d538ed6?source=cve; https://plugins.trac.wordpress.org/changeset/3068495/otter-blocks
CVE: CVE-2024-3344
Published: 2024-04-11
Description: The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file upload in all versions up to, and including, 2.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-434, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3068495/otter-blocks; https://www.wordfence.com/threat-intel/vulnerabilities/id/db836f4b-d31f-4442-89a5-1a400525c598?source=cve; https://plugins.trac.wordpress.org/changeset/3068495/otter-blocks
CVE: CVE-2023-32295
Published: 2024-04-11
Description: Missing Authorization vulnerability in Alex Tselegidis Easy!Appointments.This issue affects Easy!Appointments: from n/a through 1.3.3.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://patchstack.com/database/vulnerability/easyappointments/wordpress-easy-appointments-plugin-1-3-1-arbitrary-file-deletion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/easyappointments/wordpress-easy-appointments-plugin-1-3-1-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-32112
Published: 2024-04-11
Description: Cross-Site Request Forgery (CSRF) vulnerability in Leadinfo leadinfo. The patch was released under the same version which was reported as vulnerable. We consider the current version as vulnerable.This issue affects Leadinfo: from n/a through 1.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/leadinfo/wordpress-leadinfo-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/leadinfo/wordpress-leadinfo-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31285
Published: 2024-04-11
Description: Cross-Site Request Forgery (CSRF) vulnerability in Tooltip WordPress Tooltips allows Stored XSS.This issue affects WordPress Tooltips: from n/a through 9.5.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wordpress-tooltips/wordpress-wordpress-tooltips-plugin-9-5-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wordpress-tooltips/wordpress-wordpress-tooltips-plugin-9-5-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31361
Published: 2024-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bunny.Net allows Stored XSS.This issue affects bunny.Net: from n/a through 2.0.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/bunnycdn/wordpress-bunny-net-plugin-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bunnycdn/wordpress-bunny-net-plugin-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31387
Published: 2024-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Popup LikeBox Team Popup Like box allows Stored XSS.This issue affects Popup Like box: from n/a through 3.7.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ays-facebook-popup-likebox/wordpress-popup-likebox-plugin-3-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ays-facebook-popup-likebox/wordpress-popup-likebox-plugin-3-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31925
Published: 2024-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FAKTOR VIER F4 Improvements allows Stored XSS.This issue affects F4 Improvements: from n/a through 1.8.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/f4-improvements/wordpress-f4-improvements-plugin-1-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/f4-improvements/wordpress-f4-improvements-plugin-1-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31926
Published: 2024-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BracketSpace Advanced Cron Manager – debug & control allows Stored XSS.This issue affects Advanced Cron Manager – debug & control: from n/a through 2.5.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/advanced-cron-manager/wordpress-advanced-cron-manager-debug-control-plugin-2-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-cron-manager/wordpress-advanced-cron-manager-debug-control-plugin-2-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31927
Published: 2024-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aminur Islam WP Login and Logout Redirect allows Stored XSS.This issue affects WP Login and Logout Redirect: from n/a through 1.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-login-and-logout-redirect/wordpress-wp-login-and-logout-redirect-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-login-and-logout-redirect/wordpress-wp-login-and-logout-redirect-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31928
Published: 2024-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Darko Top Bar allows Stored XSS.This issue affects Top Bar: from n/a through 3.0.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/top-bar/wordpress-top-bar-plugin-3-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/top-bar/wordpress-top-bar-plugin-3-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31929
Published: 2024-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iain Poulson Intagrate Lite instagrate-to-wordpress.This issue affects Intagrate Lite: from n/a through <= 1.3.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/instagrate-to-wordpress/vulnerability/wordpress-intagrate-lite-plugin-1-3-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/instagrate-to-wordpress/wordpress-intagrate-lite-plugin-1-3-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31930
Published: 2024-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Stored XSS.This issue affects Save as PDF plugin by Pdfcrowd: from n/a through 3.2.1 .
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/save-as-pdf-by-pdfcrowd/wordpress-save-as-pdf-by-pdfcrowd-plugin-3-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/save-as-pdf-by-pdfcrowd/wordpress-save-as-pdf-by-pdfcrowd-plugin-3-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31931
Published: 2024-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Save as Image plugin by Pdfcrowd allows Stored XSS.This issue affects Save as Image plugin by Pdfcrowd: from n/a through 3.2.1 .
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/save-as-image-by-pdfcrowd/wordpress-save-as-image-plugin-by-pdfcrowd-plugin-3-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/save-as-image-by-pdfcrowd/wordpress-save-as-image-plugin-by-pdfcrowd-plugin-3-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31932
Published: 2024-04-11
Description: Cross-Site Request Forgery (CSRF) vulnerability in CreativeThemes Blocksy Companion.This issue affects Blocksy Companion: from n/a through 2.0.28.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/blocksy-companion/wordpress-blocksy-companion-plugin-2-0-28-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/blocksy-companion/wordpress-blocksy-companion-plugin-2-0-28-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31934
Published: 2024-04-11
Description: Cross-Site Request Forgery (CSRF) vulnerability in Link Whisper Link Whisper Free.This issue affects Link Whisper Free: from n/a through 0.6.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/link-whisper/wordpress-link-whisper-free-plugin-0-6-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/link-whisper/wordpress-link-whisper-free-plugin-0-6-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31935
Published: 2024-04-11
Description: Cross-Site Request Forgery (CSRF) vulnerability in BracketSpace Simple Post Notes.This issue affects Simple Post Notes: from n/a through 1.7.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/simple-post-notes/wordpress-simple-post-notes-plugin-1-7-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-post-notes/wordpress-simple-post-notes-plugin-1-7-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31936
Published: 2024-04-11
Description: Cross-Site Request Forgery (CSRF) vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a before 1.2.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/userswp/wordpress-userswp-front-end-login-form-user-registration-user-profile-members-directory-plugin-for-wordpress-plugin-1-2-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/userswp/wordpress-userswp-front-end-login-form-user-registration-user-profile-members-directory-plugin-for-wordpress-plugin-1-2-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31937
Published: 2024-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visitor Analytics TWIPLA (Visitor Analytics IO) allows Stored XSS.This issue affects TWIPLA (Visitor Analytics IO): from n/a through 1.2.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/visitor-analytics-io/wordpress-twipla-visitor-analytics-io-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/visitor-analytics-io/wordpress-twipla-visitor-analytics-io-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve