deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-25429
Published: 2025-02-28
Description: Trendnet TEW-929DRU 1.0.0.10 contains a Stored Cross-site Scripting (XSS) vulnerability via the r_name variable inside the have_same_name function on the /addschedule.htm page.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://instinctive-acapella-fc7.notion.site/Trendnet-TEW-929DRU-XSS-10315d9d4d26801f8985c11a22389e6b; https://instinctive-acapella-fc7.notion.site/Trendnet-TEW-929DRU-XSS-10315d9d4d26801f8985c11a22389e6b
CVE: CVE-2025-25609
Published: 2025-02-28
Description: TOTOlink A3002R V1.1.1-B20[PII_REDACTED] contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the static_ipv6 parameter in the formIpv6Setup interface of /bin/boa
CVSS Score: 8.0 (HIGH)
CWE: CWE-120
References: https://github.com/SunnyYANGyaya/firmcrosser/blob/main/ToTolink/TOTOLINK-A3002R-formIpv6Setup-static_ipv6.md
CVE: CVE-2025-25610
Published: 2025-02-28
Description: TOTOlink A3002R V1.1.1-B20[PII_REDACTED] contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the static_gw parameter in the formIpv6Setup interface of /bin/boa.
CVSS Score: 8.0 (HIGH)
CWE: CWE-120
References: https://github.com/SunnyYANGyaya/firmcrosser/blob/main/ToTolink/TOTOLINK-A3002R-formIpv6Setup-static_gw.md
CVE: CVE-2025-25635
Published: 2025-02-28
Description: TOTOlink A3002R V1.1.1-B20[PII_REDACTED] contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the pppoe_dns1 parameter in the formIpv6Setup interface of /bin/boa.
CVSS Score: 8.0 (HIGH)
CWE: CWE-120
References: https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/TOTOLINK-A3002R-formIpv6Setup-pppoe_dns1.md
CVE: CVE-2025-0769
Published: 2025-02-28
Description: PixelYourSite - Your smart PIXEL (TAG) and API Manager 10.1.1.1 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/modules/facebook/facebook-server-a sync-task.php.
CWE: CWE-502
References: https://co.wordpress.org/plugins/pixelyoursite/#developers; https://fluidattacks.com/advisories/skims-23/
CVE: CVE-2025-27410
Published: 2025-02-28
Description: PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included `.js` file and restarting the container, this allows for Remote Code Execution as an administrator. The remote code execution occurs because any user with the `backups:create` and `backups:update` (only administrators by default) is able to overwrite any file on the system. Version 1.2.0 fixes the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-23, CWE-22
References: https://github.com/pwndoc/pwndoc/blob/14acb704891245bf1703ce6296d62112e85aa995/backend/src/routes/backup.js#L527; https://github.com/pwndoc/pwndoc/commit/98f284291d73d3a0b11d3181d845845c192d1080; https://github.com/pwndoc/pwndoc/releases/tag/v1.2.0
CVE: CVE-2025-27413
Published: 2025-02-28
Description: PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an administrator to import raw data into the database, including Path Traversal (`../`) sequences. This is problematic for the template update functionality as it uses the path from the database to write arbitrary content to, potentially overwriting source code to achieve Remote Code Execution. Any user with the `backups:create`, `backups:update` and `templates:update` permissions (only administrators by default) can write arbitrary content to anywhere on the filesystem. By overwriting source code, it is possible to achieve Remote Code Execution. Version 1.2.0 fixes the issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/pwndoc/pwndoc/blob/14acb704891245bf1703ce6296d62112e85aa995/backend/src/models/template.js#L170-L175; https://github.com/pwndoc/pwndoc/blob/14acb704891245bf1703ce6296d62112e85aa995/backend/src/routes/backup.js#L826-L827; https://github.com/pwndoc/pwndoc/blob/14acb704891245bf1703ce6296d62112e85aa995/backend/src/routes/template.js#L63-L66
CVE: CVE-2025-27414
Published: 2025-02-28
Description: MinIO is a high performance object storage. Starting in RELEASE.2024-06-06T09-36-42Z and prior to 
RELEASE.2025-02-28T09-55-16Z, a bug in evaluating the trust of the SSH key used in an SFTP connection to MinIO allows authentication bypass and unauthorized data access. On a MinIO server with SFTP access configured and using LDAP as an external identity provider, MinIO supports SSH key based authentication for SFTP connections when the user has the `sshPublicKey` attribute set in their LDAP server. The server trusts the client's key only when the public key is the same as the `sshPublicKey` attribute. Due to the bug, when the user has no `sshPublicKey` property in LDAP, the server ends up trusting the key allowing the client to perform any FTP operations allowed by the MinIO access policies associated with the LDAP user (or any of their groups). Three requirements must be met in order to exploit the vulnerability. First, the MinIO server must be configured to allow SFTP access and use LDAP as an external identity provider. Second, the attacker must have knowledge of an LDAP username that does not have the `sshPublicKey` property set. Third, such an LDAP username or one of their groups must also have some MinIO access policy configured. When this bug is successfully exploited, the attacker can perform any FTP operations (i.e. reading, writing, deleting and listing objects) allowed by the access policy associated with the LDAP user account (and their groups). Version 1.2.0 fixes the issue.
CWE: CWE-287
References: https://github.com/minio/minio/commit/4c71f1b4ec0fb2a473ddaac18c20ec9e63f267ec; https://github.com/minio/minio/commit/91e1487de45720753c9e9e4c02b1bd16b7e452fa; https://github.com/minio/minio/security/advisories/GHSA-wc79-7x8x-2p58
CVE: CVE-2024-1509
Published: 2025-02-28
Description: Brocade ASCG before 3.2.0 Web Interface  is not 
enforcing HSTS, as defined by RFC 6797. HSTS is an optional response 
header that can be configured on the server to instruct the browser to 
only communicate via HTTPS. The lack of HSTS allows downgrade attacks, 
SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking 
protections.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-523
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25428
CVE: CVE-2025-26466
Published: 2025-02-28
Description: A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://access.redhat.com/security/cve/CVE-2025-26466; https://bugzilla.redhat.com/show_bug.cgi?id=2345043; https://seclists.org/oss-sec/2025/q1/144
CVE: CVE-2025-25379
Published: 2025-02-28
Description: Cross Site Request Forgery vulnerability in 07FLYCMS v.1.3.9 allows a remote attacker to execute arbitrary code via the id parameter of the del.html component.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352
References: https://github.com/R2og/Sun-jialiang/tree/main/9/readme.md; https://github.com/R2og/Sun-jialiang/tree/main/9/readme.md
CVE: CVE-2025-25476
Published: 2025-02-28
Description: A stored cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows a malicious user with elevated privileges to execute arbitrary Javascript code by specifying a malicious XSS payload as a notification type or notification component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25476; https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25476
CVE: CVE-2025-25478
Published: 2025-02-28
Description: The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. This mismanagement leads to the disclosure of the web application s source code, exposing sensitive information such as the database password.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-73
References: https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25478; https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25478
CVE: CVE-2025-25723
Published: 2025-02-28
Description: Buffer Overflow vulnerability in GPAC version 2.5 allows a local attacker to execute arbitrary code.
CVSS Score: 8.4 (HIGH)
CWE: CWE-120
References: https://github.com/gpac/gpac/commit/74e26b8dfeb0ab8c7317603b80a18306d0698473; https://github.com/gpac/gpac/issues/3089; https://github.com/gpac/gpac/issues/3089
CVE: CVE-2025-1803
Published: 2025-03-01
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-27416
Published: 2025-03-01
Description: Scratch-Coding-Hut.github.io is the website for Coding Hut. The website as of 28 February 2025 contained a sign in with scratch username and password form. Any user who used the sign in page would be susceptible to any other user signing into their account. As of time of publication, a fix is not available but work on a fix is underway. As a workaround, users should avoid signing in.
CWE: CWE-287
References: https://github.com/Scratch-Coding-Hut/Scratch-Coding-Hut.github.io/issues/3; https://github.com/Scratch-Coding-Hut/Scratch-Coding-Hut.github.io/security/advisories/GHSA-xx32-r9wr-whff
CVE: CVE-2025-23115
Published: 2025-03-01
Description: A Use After Free vulnerability on UniFi Protect Cameras could allow a Remote Code Execution (RCE) by a malicious actor with access to UniFi Protect Cameras management network.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-416
References: https://community.ui.com/releases/Security-Advisory-Bulletin-046-046/9649ea8f-93db-4713-a875-c3fd7614943f
CVE: CVE-2025-23116
Published: 2025-03-01
Description: An Authentication Bypass vulnerability on UniFi Protect Application with Auto-Adopt Bridge Devices enabled could allow a malicious actor with access to UniFi Protect Cameras adjacent network to take control of UniFi Protect Cameras.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-287
References: https://community.ui.com/releases/Security-Advisory-Bulletin-046-046/9649ea8f-93db-4713-a875-c3fd7614943f
CVE: CVE-2025-23117
Published: 2025-03-01
Description: An Insufficient Firmware Update Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras adjacent network to make unsupported changes to the camera system.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-346
References: https://community.ui.com/releases/Security-Advisory-Bulletin-046-046/9649ea8f-93db-4713-a875-c3fd7614943f
CVE: CVE-2025-23118
Published: 2025-03-01
Description: An Improper Certificate Validation vulnerability could allow an authenticated malicious actor with access to UniFi Protect Cameras adjacent network to make unsupported changes to the camera system.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-295
References: https://community.ui.com/releases/Security-Advisory-Bulletin-046-046/9649ea8f-93db-4713-a875-c3fd7614943f
CVE: CVE-2025-23119
Published: 2025-03-01
Description: An Improper Neutralization of Escape Sequences vulnerability could allow an Authentication Bypass with a Remote Code Execution (RCE) by a malicious actor with access to UniFi Protect Cameras adjacent network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: https://community.ui.com/releases/Security-Advisory-Bulletin-046-046/9649ea8f-93db-4713-a875-c3fd7614943f
CVE: CVE-2024-13358
Published: 2025-03-01
Description: The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wc4bp_delete_page() function in all versions up to, and including, 3.4.24. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins page setting.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3244145%40wc4bp&new=3244145%40wc4bp&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/2f526f3c-4e9b-4440-b3c3-8541c1be0ba0?source=cve
CVE: CVE-2025-1780
Published: 2025-03-01
Description: The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wc4bp_delete_page() function in all versions up to, and including, 3.4.25. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins page setting.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3248127%40wc4bp&new=3248127%40wc4bp&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/dc138cbb-2713-4b0a-8e3a-8e1a9266637f?source=cve
CVE: CVE-2024-13518
Published: 2025-03-01
Description: The Simple:Press Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.10.12. This is due to missing or incorrect nonce validation on the 'sp_save_edited_post' function. This makes it possible for unauthenticated attackers to modify a forum post via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/simplepress/trunk/forum/database/sp-db-management.php#L173; https://plugins.trac.wordpress.org/changeset/3251363; https://www.wordfence.com/threat-intel/vulnerabilities/id/4484fa86-5878-426d-92b9-8eb0751075e5?source=cve
CVE: CVE-2024-13559
Published: 2025-03-01
Description: The TemplatesNext ToolKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tx_woo_wishlist_table' shortcode in all versions up to, and including, 3.2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/templatesnext-toolkit/trunk/inc/woo-compare-wishlist/includes/wishlist/shortcode.php#L13; https://www.wordfence.com/threat-intel/vulnerabilities/id/775b6034-617a-4d84-a8fe-773ffbd9742a?source=cve
CVE: CVE-2024-13568
Published: 2025-03-01
Description: The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the 'fluent-support' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/fluent-support directory which can contain file attachments included in support tickets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3248479/fluent-support/tags/1.8.6/app/Services/Includes/FileSystem.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/17f40832-8ae5-443a-aa98-f0e61d1152cc?source=cve
CVE: CVE-2024-13746
Published: 2025-03-01
Description: The Booking Calendar and Notification plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on the wpcb_all_bookings(), wpcb_update_booking_post(), and wpcb_delete_posts() functions in all versions up to, and including, 4.0.3. This makes it possible for unauthenticated attackers to extract data, create or update bookings, or  delete arbitrary posts.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/booking-calendar-and-notification/tags/4.0.3/lib/includes/function.php; https://plugins.trac.wordpress.org/browser/booking-calendar-and-notification/trunk/lib/classes/api.php#L134; https://plugins.trac.wordpress.org/browser/booking-calendar-and-notification/trunk/lib/classes/api.php#L188
CVE: CVE-2024-13750
Published: 2025-03-01
Description: The Multilevel Referral Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/multilevel-referral-plugin-for-woocommerce/tags/2.27/classes/referral-program.php#L310; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3430870%40multilevel-referral-plugin-for-woocommerce&new=3430870%40multilevel-referral-plugin-for-woocommerce&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/4389ddc9-de69-4316-9bfa-ff3bd3346c69?source=cve
CVE: CVE-2024-9212
Published: 2025-03-01
Description: The SKU Generator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.6.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/sku-for-woocommerce/tags/1.6.2/includes/settings/class-wc-sku-tools-regenerator.php#L43; https://plugins.trac.wordpress.org/browser/sku-for-woocommerce/tags/1.6.3/includes/settings/class-wc-sku-tools-regenerator.php#L43; https://www.wordfence.com/threat-intel/vulnerabilities/id/f59ccb78-722b-490b-874e-7026afc3511b?source=cve
CVE: CVE-2024-9217
Published: 2025-03-01
Description: The Currency Switcher for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.16.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/currency-switcher-woocommerce/trunk/includes/functions/alg-switcher-selector-functions.php#L139; https://plugins.trac.wordpress.org/changeset/3252003/; https://www.wordfence.com/threat-intel/vulnerabilities/id/3357892e-c047-406b-8914-018ea966e799?source=cve
CVE: CVE-2025-0820
Published: 2025-03-01
Description: The Clicface Trombi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nom’ parameter in all versions up to, and including, 2.08 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/clicface-trombi/trunk/clicface-trombi.php#L80; https://wordpress.org/plugins/clicface-trombi/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/1d9ff834-8a11-4ec7-9371-15d56bc84106?source=cve
CVE: CVE-2024-13901
Published: 2025-03-01
Description: The Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/counter-box/trunk/admin/assets/js/5.builder.js#L10; https://plugins.trac.wordpress.org/changeset/3247696/; https://www.wordfence.com/threat-intel/vulnerabilities/id/251b17a7-781f-4f17-af90-9a6fbae69243?source=cve
CVE: CVE-2025-27554
Published: 2025-03-01
Description: ToDesktop before 2024-10-03, as used by Cursor before 2024-10-03 and other applications, allows remote attackers to execute arbitrary commands on the build server (e.g., read secrets from the desktopify config.prod.json file), and consequently deploy updates to any app, via a postinstall script in package.json. No exploitation occurred.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://kibty.town/blog/todesktop; https://news.ycombinator.com/item?id=43210858; https://www.todesktop.com/blog/posts/security-incident-at-todesktop
CVE: CVE-2024-12824
Published: 2025-03-01
Description: The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's password, including administrators, and leverage that to gain access to their account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-620
References: https://themeforest.net/item/nokri-job-board-wordpress-theme/22677241; https://www.wordfence.com/threat-intel/vulnerabilities/id/60a7cce0-637f-49bd-aa4a-fd7023d99a64?source=cve
CVE: CVE-2024-13373
Published: 2025-03-01
Description: The Exertio Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.1. This is due to the plugin not properly validating a user's identity prior to updating their password through the fl_forgot_pass_new() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
CVSS Score: 8.1 (HIGH)
CWE: CWE-620
References: https://themeforest.net/item/exertio-freelance-marketplace-wordpress-theme/30602587; https://www.wordfence.com/threat-intel/vulnerabilities/id/897ce9a9-8b3e-40bc-9815-c55cc7a838f9?source=cve
CVE: CVE-2025-1459
Published: 2025-03-01
Description: The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Embedded Video(PB) widget in all versions up to, and including, 2.31.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3247428%40siteorigin-panels&new=3247428%40siteorigin-panels&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/e14c12ef-0774-4459-9a2c-9a4b633a0efe?source=cve