deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-48966
Published: 2024-11-14
Description: The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC where the tools are installed could obtain diagnostic information through the test tool or manipulate the ventilator's settings and embedded software via the calibration tool, without having to authenticate to either tool. This could result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-306
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01
CVE: CVE-2024-48967
Published: 2024-11-14
Description: The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious activity and subsequent forensic examination. An attacker with access to the ventilator and/or the Service PC could, without detection, make unauthorized changes to ventilator settings that result in unauthorized disclosure of information and/or have unintended impacts on device performance.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-778
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01
CVE: CVE-2024-48970
Published: 2024-11-14
Description: The ventilator's microcontroller lacks memory protection. An attacker could connect to the internal JTAG interface and read or write to flash memory using an off-the-shelf debugging tool, which could disrupt the function of the device and/or cause unauthorized information disclosure.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-1191
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01
CVE: CVE-2024-48971
Published: 2024-11-14
Description: The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attacker to obtain the password off the ventilator and use it to gain unauthorized access to the device, with clinician privileges.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-798
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01
CVE: CVE-2024-48973
Published: 2024-11-14
Description: The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port (which are unencrypted; see 3.2.1) that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-1263
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01
CVE: CVE-2024-48974
Published: 2024-11-14
Description: The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized changes to the device's configuration settings and/or compromise device functionality by pushing a compromised/illegitimate firmware file. This could disrupt the function of the device and/or cause unauthorized information disclosure.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-494
References: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-319-01
CVE: CVE-2024-50968
Published: 2024-11-14
Description: A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remote attackers to manipulate the quant parameter when adding a product to the cart. By setting the quantity value to -0, an attacker can exploit a flaw in the application's total price calculation logic. This vulnerability causes the total price to be reduced to zero, allowing the attacker to add items to the cart and proceed to checkout.
CVSS Score: 7.5 (HIGH)
References: https://github.com/Akhlak2511/CVE-2024-50968
CVE: CVE-2024-51156
Published: 2024-11-14
Description: 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component 'erp.07fly.net:80/admin/SysNotifyUser/del.html?id=93'.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-352
References: https://github.com/SamParkerXd/cms/tree/main/1
CVE: CVE-2024-51658
Published: 2024-11-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in Henrik Hoff WP Course Manager wp-course-manager allows Stored XSS.This issue affects WP Course Manager: from n/a through <= 1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-course-manager/vulnerability/wordpress-wp-course-manager-plugin-1-3-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2024-51659
Published: 2024-11-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in GeekRMX Twitter @Anywhere Plus twitter-anywhere-plus allows Stored XSS.This issue affects Twitter @Anywhere Plus: from n/a through <= 2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/twitter-anywhere-plus/vulnerability/wordpress-twitter-atanywhere-plus-plugin-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2024-51679
Published: 2024-11-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in gentlesource Appointmind appointmind allows Stored XSS.This issue affects Appointmind: from n/a through <= 4.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/appointmind/vulnerability/wordpress-appointmind-plugin-4-0-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2017-13227
Published: 2024-11-14
Description: In the autofill service, the package name that is provided by the app process is trusted inappropriately.  This could lead to information disclosure with no additional execution privileges needed.  User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2024-41206
Published: 2024-11-14
Description: A stack-based buffer over-read in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Information Disclosure via a crafted TS video file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/justdan96/tsMuxer/issues/859
CVE: CVE-2024-41209
Published: 2024-11-14
Description: A heap-based buffer overflow in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Denial of Service (DoS) and Code Execution via a crafted MOV video file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/justdan96/tsMuxer/issues/841; https://ricercasecurity.blogspot.com/2024/10/rezzuf0-day-cve-2024-41209.html
CVE: CVE-2024-41217
Published: 2024-11-14
Description: A heap-based buffer overflow in tsMuxer version nightly-2024-05-10-02-00-45 allows attackers to cause Denial of Service (DoS) via a crafted MKV video file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://github.com/justdan96/tsMuxer/issues/846
CVE: CVE-2024-49776
Published: 2024-11-14
Description: A negative-size-param in tsMuxer version nightly-2024-04-05-01-53-02 allows attackers to cause Denial of Service (DoS) via a crafted TS video file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-131
References: https://github.com/justdan96/tsMuxer/issues/862
CVE: CVE-2024-49777
Published: 2024-11-14
Description: A heap-based buffer overflow in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Denial of Service (DoS), Information Disclosure and Code Execution via a crafted MKV video file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/justdan96/tsMuxer/issues/842
CVE: CVE-2024-49778
Published: 2024-11-14
Description: A heap-based buffer overflow in tsMuxer version nightly-2024-05-12-02-01-18 allows attackers to cause Denial of Service (DoS) and Code Execution via a crafted MOV video file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/justdan96/tsMuxer/issues/879
CVE: CVE-2024-52308
Published: 2024-11-14
Description: The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh codespace logs` commands. This has been patched in the cli v2.62.0.

Developers connect to remote codespaces through an SSH server running within the devcontainer, which is generally provided through the [default devcontainer image]( https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-... https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-configuration/introduction-to-dev-containers#using-the-default-dev-container-configuration) . GitHub CLI [retrieves SSH connection details]( https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/inv... https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/invoker.go#L230-L244 ), such as remote username, which is used in [executing `ssh` commands]( https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go#L2... https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go#L263 ) for `gh codespace ssh` or `gh codespace logs` commands.

This exploit occurs when a malicious third-party devcontainer contains a modified SSH server that injects `ssh` arguments within the SSH connection details. `gh codespace ssh` and `gh codespace logs` commands could execute arbitrary code on the user's workstation if the remote username contains something like `-oProxyCommand="echo hacked" #`.  The `-oProxyCommand` flag causes `ssh` to execute the provided command while `#` shell comment causes any other `ssh` arguments to be ignored.

In `2.62.0`, the remote username information is being validated before being used.
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: https://github.com/cli/cli/security/advisories/GHSA-p2h2-3vg9-4p87
CVE: CVE-2024-52613
Published: 2024-11-14
Description: A heap-based buffer under-read in tsMuxer version nightly-2024-05-12-02-01-18 allows attackers to cause Denial of Service (DoS) via a crafted MOV video file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/justdan96/tsMuxer/issues/881
CVE: CVE-2024-11120
Published: 2024-11-15
Description: Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.twcert.org.tw/en/cp-139-8237-26d7a-2.html; https://www.twcert.org.tw/tw/cp-132-8236-d4836-1.html; https://www.akamai.com/blog/security-research/active-exploitation-mirai-geovision-iot-botnet
CVE: CVE-2024-10924
Published: 2024-11-15
Description: The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-306
References: https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L277; https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L278; https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L67
CVE: CVE-2024-10897
Published: 2024-11-15
Description: The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_etlms_dependency_plugin() function in all versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install Elementor or Tutor LMS. Please note the impact of this issue is incredibly limited due to the fact that these two plugins will likely already be installed as a dependency of the plugin.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/tutor-lms-elementor-addons/trunk/classes/Installer.php#L152; https://plugins.trac.wordpress.org/changeset/3186320/tutor-lms-elementor-addons/trunk/classes/Installer.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/99edd858-5e2c-4cc5-adda-d8e70ddc86f6?source=cve
CVE: CVE-2024-9609
Published: 2024-11-15
Description: The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpress_import_form_server' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/learnpress-import-export/trunk/inc/admin/providers/learnpress/class-lp-import-learnpress.php#L90; https://plugins.trac.wordpress.org/browser/learnpress-import-export/trunk/inc/admin/views/import.php#L23; https://plugins.trac.wordpress.org/changeset/3186901/learnpress-import-export/trunk/inc/admin/providers/learnpress/class-lp-import-learnpress.php
CVE: CVE-2024-10113
Published: 2024-11-15
Description: The WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpadcenter_ad shortcode in all versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3196398%40wpadcenter%2Ftrunk&old=3146736%40wpadcenter%2Ftrunk&sfp_email=&sfph_mail=; https://wordpress.org/plugins/wpadcenter/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/0597a63d-2627-477f-874a-c35b6df7afd5?source=cve
CVE: CVE-2024-10260
Published: 2024-11-15
Description: The Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads in all versions up to, and including, 8.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/tripetto/trunk/lib/attachments.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/3718c252-2ca3-4f7d-b43a-3c1b2e6b34c0?source=cve
CVE: CVE-2024-10582
Published: 2024-11-15
Description: The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the import_mpfe_template() function in all versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import templates.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3186359%40music-player-for-elementor%2Ftrunk&old=3174807%40music-player-for-elementor%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/1f66cdcf-cbe5-43e0-ad18-c2b9c4491ed4?source=cve
CVE: CVE-2024-10793
Published: 2024-11-15
Description: The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrative user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-security-audit-log/tags/5.2.1/classes/WPSensors/class-wp-system-sensor.php#L679; https://www.wordfence.com/threat-intel/vulnerabilities/id/44f3b2e4-c537-4369-b2d6-39fbc6cb8e08?source=cve
CVE: CVE-2024-39610
Published: 2024-11-15
Description: Cross-site scripting vulnerability exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://fitnesse.org/FitNesseDownload; https://github.com/unclebob/fitnesse/releases/tag/20241026; https://jvn.jp/en/jp/JVN36791327/
CVE: CVE-2024-42499
Published: 2024-11-15
Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an attacker may be able to know whether a file exists at a specific path, and/or obtain some part of the file contents under specific conditions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://fitnesse.org/FitNesseDownload; https://github.com/unclebob/fitnesse/releases/tag/20241026; https://jvn.jp/en/jp/JVN36791327/
CVE: CVE-2024-9356
Published: 2024-11-15
Description: The Yotpo: Product & Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'yotpo_user_email' and 'yotpo_user_name' parameters in all versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/yotpo-social-reviews-for-woocommerce/trunk/lib/utils/wc-yotpo-settings-functions.php#L100; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3188756%40yotpo-social-reviews-for-woocommerce&new=3188756%40yotpo-social-reviews-for-woocommerce&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/2f7ddb34-cb5b-4089-bd3e-07056f0b6bd5?source=cve
CVE: CVE-2024-10104
Published: 2024-11-15
Description: The Jobs for WordPress plugin before 2.7.8 does not sanitise and escape some of its Job settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/f0a9c8ae-f2cf-4322-8216-4778b0e37a48/
CVE: CVE-2024-10825
Published: 2024-11-15
Description: The Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions up to, and including, 5.3.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/5.3.01/classes/Tools.php#L633; https://plugins.trac.wordpress.org/browser/hide-my-wp/tags/5.3.01/classes/Tools.php#L638; https://plugins.trac.wordpress.org/changeset/3186489/hide-my-wp/trunk/classes/Tools.php
CVE: CVE-2024-8961
Published: 2024-11-15
Description: The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nomore_items_text’ parameter in all versions up to, and including, 6.0.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Elements/Filterable_Gallery.php; https://plugins.trac.wordpress.org/changeset/3176312/; https://www.wordfence.com/threat-intel/vulnerabilities/id/45ef20aa-18e3-4ad8-a94e-76e29de5b562?source=cve
CVE: CVE-2024-9529
Published: 2024-11-15
Description: The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin to run arbitrary PHP functions.
CVSS Score: 6.6 (MEDIUM)
References: https://wpscan.com/vulnerability/dd3cc8d8-4dff-47f9-b036-5d09f2c7e5f2/
CVE: CVE-2024-45784
Published: 2024-11-15
Description: Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users could access these logs, potentially exposing critical data that could be exploited to compromise the security of the Airflow deployment. In version 2.10.3, secrets are now masked in task logs to prevent sensitive configuration variables from being exposed in the logging output. Users should upgrade to Airflow 2.10.3 or the latest version to eliminate this vulnerability. If you suspect that DAG authors could have logged the secret values to the logs and that your logs are not additionally protected, it is also recommended that you update those secrets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1295
References: https://github.com/apache/airflow/pull/43040; https://lists.apache.org/thread/k2jm55jztlbmk4zrlh10syvq3n57hl4h; http://www.openwall.com/lists/oss-security/2024/11/15/1
CVE: CVE-2024-10311
Published: 2024-11-15
Description: The External Database Based Actions plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.1. This is due to a missing capability check in the 'edba_admin_handle' function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugin settings and log in as any existing user on the site, such as an administrator.
CVSS Score: 7.5 (HIGH)
CWE: CWE-288
References: https://plugins.trac.wordpress.org/browser/external-database-based-actions/trunk/lib/edba-admin-ajax-controller.php?rev=1785239#L8; https://www.wordfence.com/threat-intel/vulnerabilities/id/d41a8c39-8b06-45b2-afe4-8c695faf8cb8?source=cve
CVE: CVE-2024-8978
Published: 2024-11-15
Description: The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.9 via the 'init_content_register_user_email_controls' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including usernames and passwords of any users who register via the Login | Register Form widget, as long as that user opens the email notification for successful registration.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Elements/Login_Register.php#L2220; https://plugins.trac.wordpress.org/changeset/3188634/; https://www.wordfence.com/threat-intel/vulnerabilities/id/baae8fb9-b87c-4f61-88da-871c4c83615b?source=cve