deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-2764
Published: 2024-03-21
Description: A vulnerability, which was classified as critical, was found in Tenda AC10U 15.03.06.48. This affects the function formSetPPTPServer of the file /goform/SetPptpServerCfg. The manipulation of the argument endIP leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257601 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10U/v1.V15.03.06.48/more/formSetPPTPServer.md; https://vuldb.com/?ctiid.257601; https://vuldb.com/?id.257601
CVE: CVE-2024-2766
Published: 2024-03-21
Description: A vulnerability has been found in Campcodes Complete Online Beauty Parlor Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257602 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Online%20Beauty%20Parlor%20Management%20System/Complete%20Online%20Beauty%20Parlor%20Management%20System%20-%20vuln%201.pdf; https://vuldb.com/?ctiid.257602; https://vuldb.com/?id.257602
CVE: CVE-2024-2767
Published: 2024-03-21
Description: A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/forgot-password.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257603.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Online%20Beauty%20Parlor%20Management%20System/Complete%20Online%20Beauty%20Parlor%20Management%20System%20-%20vuln%202.pdf; https://vuldb.com/?ctiid.257603; https://vuldb.com/?id.257603
CVE: CVE-2024-24272
Published: 2024-03-21
Description: An issue in iTop DualSafe Password Manager & Digital Vault before 1.4.24 allows a local attacker to obtain sensitive information via leaked credentials as plaintext in a log file that can be accessed by the local user without knowledge of the master secret.
CVSS Score: 7.1 (HIGH)
CWE: CWE-532
References: https://research.hisolutions.com/2024/03/cve-2024-24272-dualsafe-password-manager-leaks-credentials/; https://research.hisolutions.com/2024/03/cve-2024-24272-dualsafe-password-manager-leaks-credentials/
CVE: CVE-2024-25937
Published: 2024-03-21
Description: 
SQL injection vulnerability exists in the script DIAE_tagHandler.ashx.


CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12; https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12
CVE: CVE-2024-27921
Published: 2024-03-21
Description: Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version 1.7.45, enabling attackers to replace or create files with extensions like .json, .zip, .css, .gif, etc. This critical security flaw poses severe risks, that can allow attackers to inject arbitrary code on the server, undermine integrity of backup files by overwriting existing files or creating new ones, and exfiltrate sensitive data using CSS exfiltration techniques. Upgrading to patched version 1.7.45 can mitigate the issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/getgrav/grav/commit/5928411b86bab05afca2b33db4e7386a44858e99; https://github.com/getgrav/grav/security/advisories/GHSA-m7hx-hw6h-mqmc; https://github.com/getgrav/grav/commit/5928411b86bab05afca2b33db4e7386a44858e99
CVE: CVE-2024-28029
Published: 2024-03-21
Description: Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality.
CVSS Score: 8.8 (HIGH)
CWE: CWE-602
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12; https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12
CVE: CVE-2024-28116
Published: 2024-03-21
Description: Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the remote server bypassing the existing security sandbox. Version 1.7.45 contains a patch for this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-1336, CWE-94
References: https://github.com/getgrav/grav/commit/4149c[PII_REDACTED][PII_REDACTED]de2685f298f3a6e; https://github.com/getgrav/grav/security/advisories/GHSA-c9gp-64c4-2rrh; https://github.com/getgrav/grav/commit/4149c[PII_REDACTED][PII_REDACTED]de2685f298f3a6e
CVE: CVE-2024-28117
Published: 2024-03-21
Description: Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunction function, but does not impose restrictions on twig functions like twig_array_map, allowing attackers to bypass the validation and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. Upgrading to patched version 1.7.45 can mitigate this issue.

CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://github.com/getgrav/grav/commit/de1ccfa12dbcbf526104d68c1a6bc202a98698fe; https://github.com/getgrav/grav/security/advisories/GHSA-qfv4-q44r-g7rv; https://github.com/getgrav/grav/commit/de1ccfa12dbcbf526104d68c1a6bc202a98698fe
CVE: CVE-2024-28118
Published: 2024-03-21
Description: Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from Grav context, an attacker can redefine config variable. As a result, attacker can bypass a previous SSTI mitigation. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. Version 1.7.45 contains a fix for this issue.

CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://github.com/getgrav/grav/commit/de1ccfa12dbcbf526104d68c1a6bc202a98698fe; https://github.com/getgrav/grav/security/advisories/GHSA-r6vw-8v8r-pmp4; https://github.com/getgrav/grav/commit/de1ccfa12dbcbf526104d68c1a6bc202a98698fe
CVE: CVE-2024-28119
Published: 2024-03-21
Description: Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from grav context, an attacker can redefine the escape function and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. Version 1.7.45 contains a patch for this issue.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://github.com/getgrav/grav/commit/de1ccfa12dbcbf526104d68c1a6bc202a98698fe; https://github.com/getgrav/grav/security/advisories/GHSA-2m7x-c7px-hp58; https://github.com/twigphp/Twig/blob/3.x/src/Extension/EscaperExtension.php#L99
CVE: CVE-2024-28521
Published: 2024-03-21
Description: SQL Injection vulnerability in Netcome NS-ASG Application Security Gateway v.6.3.1 allows a local attacker to execute arbitrary code and obtain sensitive information via a crafted script to the loginid parameter of the /singlelogin.php component.
CVSS Score: 7.8 (HIGH)
CWE: CWE-89
References: https://github.com/aknbg1thub/cve/blob/main/sql.md; https://github.com/aknbg1thub/cve/blob/main/sql.md
CVE: CVE-2024-28891
Published: 2024-03-21
Description: 
SQL injection vulnerability exists in the script Handler_CFG.ashx.


CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12; https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12
CVE: CVE-2024-2768
Published: 2024-03-21
Description: A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/edit-services.php. The manipulation of the argument editid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257604.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Online%20Beauty%20Parlor%20Management%20System/Complete%20Online%20Beauty%20Parlor%20Management%20System%20-%20vuln%203.pdf; https://vuldb.com/?ctiid.257604; https://vuldb.com/?id.257604
CVE: CVE-2024-2769
Published: 2024-03-21
Description: A vulnerability was detected in Campcodes Complete Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/admin-profile.php. The manipulation of the argument adminname/email results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Online%20Beauty%20Parlor%20Management%20System/Complete%20Online%20Beauty%20Parlor%20Management%20System%20-%20vuln%205.pdf; https://vuldb.com/?ctiid.257605; https://vuldb.com/?id.257605
CVE: CVE-2023-42954
Published: 2024-03-21
Description: A privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websites when signed in to the Admin Console with an administrator role. This issue has been fixed in FileMaker Server 20.3.1 by reducing the information sent in requests.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-250
References: https://support.claris.com/s/answerview?anum=000041424&language=en_US; https://support.claris.com/s/answerview?anum=000041424&language=en_US
CVE: CVE-2024-23494
Published: 2024-03-21
Description: 
SQL injection vulnerability exists in GetDIAE_unListParameters.


CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12; https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12
CVE: CVE-2024-23975
Published: 2024-03-21
Description: 
SQL injection vulnerability exists in GetDIAE_slogListParameters.


CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12; https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12
CVE: CVE-2024-25567
Published: 2024-03-21
Description: 
Path traversal attack is possible and write outside of the intended directory and may access sensitive information. If a file name is specified that already exists on the file system, then the original file will be overwritten.


CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12; https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12
CVE: CVE-2024-28040
Published: 2024-03-21
Description: 
SQL injection vulnerability exists in GetDIAE_astListParameters.


CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12; https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12
CVE: CVE-2024-28045
Published: 2024-03-21
Description: 
Improper neutralization of input within the affected product could lead to cross-site scripting.


CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12; https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12
CVE: CVE-2024-28171
Published: 2024-03-21
Description: 
It is possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file will be overwritten.


CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12; https://www.cisa.gov/news-events/ics-advisories/icsa-24-074-12
CVE: CVE-2024-28863
Published: 2024-03-21
Description: node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://github.com/isaacs/node-tar/commit/fe8cd57da5686f[PII_REDACTED]bda49206a545f7f7; https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-29031
Published: 2024-03-21
Description: Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.17 allows a remote attacker to obtain sensitive information via the `order` parameter of `GetMeshSyncResources`. Version 0.7.17 contains a patch for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/meshery/meshery/commit/8e995ce21af02d32ef61689c1e1748a745917f13; https://github.com/meshery/meshery/pull/10207; https://securitylab.github.com/advisories/GHSL-2023-249_Meshery/
CVE: CVE-2024-2453
Published: 2024-03-21
Description: 
There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database. Successful exploitation of this vulnerability could allow an attacker to read or modify data on the remote database.


CVSS Score: 6.4 (MEDIUM)
CWE: CWE-89
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-081-01; https://www.cisa.gov/news-events/ics-advisories/icsa-24-081-01
CVE: CVE-2024-2770
Published: 2024-03-21
Description: A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/contact-us.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257606 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Online%20Beauty%20Parlor%20Management%20System/Complete%20Online%20Beauty%20Parlor%20Management%20System%20-%20vuln%204.pdf; https://vuldb.com/?ctiid.257606; https://vuldb.com/?id.257606
CVE: CVE-2024-2773
Published: 2024-03-21
Description: A vulnerability classified as problematic has been found in Campcodes Online Marriage Registration System 1.0. This affects an unknown part of the file /user/search.php. The manipulation of the argument searchdata leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257607.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/Kurunie/vuln_report/blob/main/Complete%20Online%20Marriage%20Registration%20System's%20vuln.pdf; https://vuldb.com/?ctiid.257607; https://vuldb.com/?id.257607
CVE: CVE-2024-2774
Published: 2024-03-21
Description: A vulnerability classified as critical was found in Campcodes Online Marriage Registration System 1.0. This vulnerability affects unknown code of the file /user/search.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257608.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Online%20Marriage%20Registration%20System%20-%20vuln%201.pdf; https://vuldb.com/?ctiid.257608; https://vuldb.com/?id.257608
CVE: CVE-2024-2775
Published: 2024-03-21
Description: A vulnerability, which was classified as problematic, has been found in Campcodes Online Marriage Registration System 1.0. This issue affects some unknown processing of the file /user/user-profile.php. The manipulation of the argument lname leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257609 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Online%20Marriage%20Registration%20System%20-%20vuln%202.pdf; https://vuldb.com/?ctiid.257609; https://vuldb.com/?id.257609
CVE: CVE-2024-2776
Published: 2024-03-22
Description: A vulnerability, which was classified as critical, was found in Campcodes Online Marriage Registration System 1.0. Affected is an unknown function of the file /admin/search.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257610 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Online%20Marriage%20Registration%20System/Complete%20Online%20Marriage%20Registration%20System%20-%20vuln%201.pdf; https://vuldb.com/?ctiid.257610; https://vuldb.com/?id.257610
CVE: CVE-2024-2777
Published: 2024-03-22
Description: A vulnerability has been found in Campcodes/PHPGurukul Online Marriage Registration System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/application-bwdates-reports-details.php. The manipulation of the argument fromdate leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Online%20Marriage%20Registration%20System/Complete%20Online%20Marriage%20Registration%20System%20-%20vuln%202.pdf; https://vuldb.com/?ctiid.257611; https://vuldb.com/?id.257611
CVE: CVE-2024-2778
Published: 2024-03-22
Description: A vulnerability was found in Campcodes Online Marriage Registration System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/search.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257612.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Online%20Marriage%20Registration%20System/Complete%20Online%20Marriage%20Registration%20System%20-%20vuln%203.pdf; https://vuldb.com/?ctiid.257612; https://vuldb.com/?id.257612
CVE: CVE-2024-2779
Published: 2024-03-22
Description: A vulnerability was found in Campcodes Online Marriage Registration System 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/application-bwdates-reports-details.php. The manipulation of the argument fromdate leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257613 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/E1CHO/cve_hub/blob/main/Complete%20Online%20Marriage%20Registration%20System/Complete%20Online%20Marriage%20Registration%20System%20-%20vuln%204.pdf; https://vuldb.com/?ctiid.257613; https://vuldb.com/?id.257613
CVE: CVE-2024-0957
Published: 2024-03-22
Description: The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Customer Notes field in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected invoice for printing.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050923%40print-invoices-packing-slip-labels-for-woocommerce&new=3050923%40print-invoices-packing-slip-labels-for-woocommerce&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c7ba4218-5b60-4e72-b98d-7c95c9fc3d59?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050923%40print-invoices-packing-slip-labels-for-woocommerce&new=3050923%40print-invoices-packing-slip-labels-for-woocommerce&sfp_email=&sfph_mail=
CVE: CVE-2024-28441
Published: 2024-03-22
Description: File Upload vulnerability in magicflue v.7.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the messageid parameter of the mail/mailupdate.jsp endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/iamHuFei/HVVault/blob/main/webapp/%E9%AD%94%E6%96%B9%E7%BD%91%E8%A1%A8/magicflu-mailupdate-jsp-fileupload.md; https://github.com/iamHuFei/HVVault/blob/main/webapp/%E9%AD%94%E6%96%B9%E7%BD%91%E8%A1%A8/magicflu-mailupdate-jsp-fileupload.md
CVE: CVE-2024-2080
Published: 2024-03-22
Description: The LiquidPoll – Polls, Surveys, NPS and Feedback Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.76 via the poller_list shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to extract information from polls that may be private.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3054831%40wp-poll&new=3054831%40wp-poll&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/84f57623-b6a6-4717-857d-93fa9d279882?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3054831%40wp-poll&new=3054831%40wp-poll&sfp_email=&sfph_mail=
CVE: CVE-2024-2392
Published: 2024-03-22
Description: The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widget in all versions up to, and including, 2.0.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3051797%40blocksy-companion&new=3051797%40blocksy-companion&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/b937cbfb-d43c-4cda-b247-921661cbc0ad?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3051797%40blocksy-companion&new=3051797%40blocksy-companion&sfp_email=&sfph_mail=