deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-13550
Published: 2025-01-25
Description: The ABC Notation plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.1.3 via the 'file' attribute of the 'abcjs' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://plugins.svn.wordpress.org/abc-notation/tags/6.1.3/abc-notation.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/e53a2b7a-7005-451a-88f2-c23d420b4aad?source=cve
CVE: CVE-2024-13551
Published: 2025-01-25
Description: The ABC Notation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'abcjs' shortcode in all versions up to, and including, 6.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/abc-notation/tags/6.1.3/abc-notation.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/e10930fd-fae0-4554-acf3-da81a124f79d?source=cve
CVE: CVE-2024-13586
Published: 2025-01-25
Description: The Masy Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'justified-gallery' shortcode in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/masy-gallery/trunk/inc/masygal-justified-shortcode.php#L33; https://www.wordfence.com/threat-intel/vulnerabilities/id/b865df96-335c-4856-a5e5-e728fb0645d3?source=cve
CVE: CVE-2024-13599
Published: 2025-01-25
Description: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.2.7.5 due to insufficient input sanitization and output escaping of a lesson name. This makes it possible for authenticated attackers, with LP Instructor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3226650/; https://wordpress.org/plugins/learnpress/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/67[PII_REDACTED]-4c09-afcb-0c07345d00e0?source=cve
CVE: CVE-2024-13449
Published: 2025-01-25
Description: The Boom Fest plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'bf_admin_action' function in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin settings that change the appearance of the website.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/boom-fest/trunk/admin/class-boom-fest-admin.php#L174; https://plugins.trac.wordpress.org/changeset/3227296/; https://www.wordfence.com/threat-intel/vulnerabilities/id/246a66ea-7f2f-44e6-825b-5556eacc33ab?source=cve
CVE: CVE-2024-13450
Published: 2025-01-25
Description: The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.17.4 via the Webhooks integration. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The vulnerability can also be exploited in Multisite environments.
CVSS Score: 3.8 (LOW)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Admin/Form/AdminFormHandler.php#L1072; https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Admin/Form/AdminFormHandler.php#L1312; https://plugins.trac.wordpress.org/browser/bit-form/trunk/includes/Core/Integration/WebHooks/WebHooksHandler.php#L190
CVE: CVE-2025-0350
Published: 2025-01-25
Description: The Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Carousel and Logo Carousel in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wow-carousel-for-divi-lite/trunk/includes/divi4/modules/ImageCarouselChild/ImageCarouselChild.php#L327; https://plugins.trac.wordpress.org/browser/wow-carousel-for-divi-lite/trunk/includes/divi4/modules/LogoCarouselChild/LogoCarouselChild.php#L168; https://plugins.trac.wordpress.org/changeset/3226742/
CVE: CVE-2024-13562
Published: 2025-01-25
Description: The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.5 via the uploads directory. This makes it possible for unauthenticated attackers to extract sensitive data  stored insecurely in the /wp-content/uploads/ directory which can contain information like imported or local user data and files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3226495/; https://www.wordfence.com/threat-intel/vulnerabilities/id/d6d69ffd-bb39-4fcc-9444-27d1a901e7c9?source=cve
CVE: CVE-2023-38012
Published: 2025-01-25
Description: IBM Cloud Pak System 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://www.ibm.com/support/pages/node/7148474
CVE: CVE-2023-38013
Published: 2025-01-25
Description: IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in HTTP responses that could aid in further attacks against the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201
References: https://www.ibm.com/support/pages/node/7159533
CVE: CVE-2023-38271
Published: 2025-01-25
Description: IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could allow an authenticated user to obtain sensitive information from log files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532
References: https://www.ibm.com/support/pages/node/7159533
CVE: CVE-2023-38713
Published: 2025-01-25
Description: IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further attacks against the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7159533
CVE: CVE-2023-38714
Published: 2025-01-25
Description: IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further attacks against the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7159533
CVE: CVE-2023-38716
Published: 2025-01-25
Description: IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could disclose sensitive information about the system that could aid in further attacks against the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7148474
CVE: CVE-2024-35111
Published: 2025-01-25
Description: IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7174806
CVE: CVE-2024-35112
Published: 2025-01-25
Description: IBM Control Center 6.2.1 and 6.3.1 

could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-80, CWE-209
References: https://www.ibm.com/support/pages/node/7174794
CVE: CVE-2024-35113
Published: 2025-01-25
Description: IBM Control Center 6.2.1 and 6.3.1 



could allow an authenticated user to obtain sensitive information exposed through a directory listing.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-548
References: https://www.ibm.com/support/pages/node/7174796
CVE: CVE-2024-35114
Published: 2025-01-25
Description: IBM Control Center 6.2.1 and 6.3.1 





could allow a remote attacker to enumerate usernames due to an observable discrepancy between login attempts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-204, CWE-203
References: https://www.ibm.com/support/pages/node/7174842
CVE: CVE-2024-35134
Published: 2025-01-25
Description: IBM Analytics Content Hub 2.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7172787
CVE: CVE-2024-39750
Published: 2025-01-25
Description: IBM Analytics Content Hub 2.0 is vulnerable to a buffer overflow due to improper return length checking. A remote authenticated attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://www.ibm.com/support/pages/node/7172787
CVE: CVE-2024-35144
Published: 2025-01-25
Description: IBM Maximo Application Suite 8.10, 8.11, and 9.0 - Monitor Component stores source code on the web server that could aid in further attacks against the system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-540
References: https://www.ibm.com/support/pages/node/7174953
CVE: CVE-2024-35145
Published: 2025-01-25
Description: IBM Maximo Application Suite 9.0.0 - Monitor Component is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7174956
CVE: CVE-2024-35148
Published: 2025-01-25
Description: IBM Maximo Application Suite 8.10.10, 8.11.7, and 9.0 - Monitor Component is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://www.ibm.com/support/pages/node/7174952
CVE: CVE-2024-35150
Published: 2025-01-25
Description: IBM Maximo Application Suite 8.10.12, 8.11.0, 9.0.1, and 9.1.0 - Monitor Component does not neutralize output that is written to logs, which could allow an attacker to inject false log entries.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-117
References: https://www.ibm.com/support/pages/node/7180057
CVE: CVE-2025-0542
Published: 2025-01-25
Description: Local privilege escalation due to incorrect assignment of privileges of temporary files in the update mechanism of G DATA Management Server. This vulnerability allows a local, unprivileged attacker to escalate privileges on affected installations by placing a crafted ZIP archive in a globally writable directory, which gets unpacked in the context of SYSTEM and results in arbitrary file write.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-276
References: https://github.com/nullby73/security-advisories/tree/main/CVE-2025-0542
CVE: CVE-2025-0543
Published: 2025-01-25
Description: Local privilege escalation in G DATA Security Client due to incorrect assignment of privileges to directories. This vulnerability allows a local, unprivileged attacker to escalate privileges on affected installations by placing an arbitrary executable in a globally writable directory resulting in execution by the SetupSVC.exe service in the context of SYSTEM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://github.com/nullby73/security-advisories/tree/main/CVE-2025-0543
CVE: CVE-2022-49043
Published: 2025-01-26
Description: xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: https://github.com/php/php-src/issues/17467; https://gitlab.gnome.org/GNOME/libxml2/-/commit/5a19e21605398cef6a8b1452477a8705cb41562b; https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html
CVE: CVE-2024-10574
Published: 2025-01-26
Description: The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ays_save_google_credentials' function in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency). This makes it possible for unauthenticated attackers to modify the Google Sheets integration credentials within the plugin's settings. Because the 'client_id' parameter is not sanitized or escaped when used in output, this vulnerability could also be leveraged to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-862
References: https://ays-pro.com/changelog-for-quiz-maker-pro; https://ays-pro.com/wordpress/quiz-maker; https://www.wordfence.com/threat-intel/vulnerabilities/id/d8a4feb3-908f-4fff-84f2-099f56d46f5b?source=cve
CVE: CVE-2024-10628
Published: 2025-01-26
Description: The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: The three variations of this software (Business, Developer, and Agency) share the same plugin slug, so you may get an alert even if you are running the latest version of any of the pieces of software. In these cases it is safe to dismiss the notice once you've confirmed your site is on a patched version of the applicable software.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://abrahack.com/posts/quiz-maker-sqli/; https://ays-pro.com/changelog-for-quiz-maker-pro; https://ays-pro.com/wordpress/quiz-maker
CVE: CVE-2024-10633
Published: 2025-01-26
Description: The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency). This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 7.3 (HIGH)
CWE: CWE-95
References: https://ays-pro.com/changelog-for-quiz-maker-pro; https://ays-pro.com/wordpress/quiz-maker; https://www.wordfence.com/threat-intel/vulnerabilities/id/eb81f83f-a0e7-46d9-b106-fe31f8ad3eb9?source=cve
CVE: CVE-2024-10636
Published: 2025-01-26
Description: The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://ays-pro.com/changelog-for-quiz-maker-pro; https://ays-pro.com/wordpress/quiz-maker; https://www.wordfence.com/threat-intel/vulnerabilities/id/6e845eae-dae9-40bb-aca9-21afaa40576d?source=cve
CVE: CVE-2025-24858
Published: 2025-01-26
Description: Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used by Develocity was chosen according to best practices for password storage and provides some protection against brute-force attempts. The applicable severity of this vulnerability depends on whether a Develocity server is accessible by external or unauthorized users, and the complexity of the System User password.
CWE: CWE-201
References: https://security.gradle.com/advisory/2025-01
CVE: CVE-2024-10705
Published: 2025-01-26
Description: The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.5 via the 'mpg_download_file_by_link' function. This makes it possible for authenticated attackers, with editor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/changeset/3205550/multiple-pages-generator-by-porthas; https://www.wordfence.com/threat-intel/vulnerabilities/id/7b3446e5-ca01-4468-927a-86e951e662ab?source=cve
CVE: CVE-2024-11090
Published: 2025-01-26
Description: The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.13 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3227065/restrict-content; https://www.wordfence.com/threat-intel/vulnerabilities/id/7615c391-ccb1-4990-bbfd-949782cc609a?source=cve
CVE: CVE-2024-46881
Published: 2025-01-26
Description: Develocity (formerly Gradle Enterprise) before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduced in Enterprise Config schema version 8. Migration functionality from schema version 8 to versions 9 and 10 (in affected vulnerable versions) does not include the projects section of the configuration. This leads to all of the project settings being reset to their defaults when the old schema is loaded. In the case of projects.enabled, the default is false. Thus, using an enterprise config v8 results in Project level access control being disabled, even if it was previously enabled, and previously restricted project information disclosed. Most commonly, this occurs when a Develocity instance is upgraded from an earlier version. Specifically, this occurs if: Develocity 2023.3.X is upgraded to 2023.4.X; Develocity 2023.3.X is upgraded to 2024.1.X up to and including 2024.1.7; or Develocity 2023.4.X is upgraded to 2024.1.X up to and including 2024.1.7. The flaw does not occur when upgrading to a fixed version. An upgrade can only be triggered via administrator access, and cannot be forced by an external attacker.
CVSS Score: 7.1 (HIGH)
CWE: CWE-732
References: https://security.gradle.com/advisory/2024-03
CVE: CVE-2024-11641
Published: 2025-01-26
Description: The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to change plugin access privileges via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation allows attackers with subscriber-level privileges and above to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset/3225861/vikbooking; https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb6611d-7a4b-4ca8-b9cc-c156437e89b5?source=cve
CVE: CVE-2024-11936
Published: 2025-01-26
Description: The Zox News theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'backup_options' and 'restore_options' function in all versions up to, and including, 3.16.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://themeforest.net/item/zox-news-professional-wordpress-news-magazine-theme/20381541; https://www.wordfence.com/threat-intel/vulnerabilities/id/3f061e7f-6a87-4d4a-9b4e-8234883f2ebc?source=cve
CVE: CVE-2024-12334
Published: 2025-01-26
Description: The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any parameter in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3224312/wc-affiliate; https://www.wordfence.com/threat-intel/vulnerabilities/id/efca1ee2-2038-440e-941c-22533b4d833b?source=cve
CVE: CVE-2024-13505
Published: 2025-01-26
Description: The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ays_sections[5][questions][8][title]’ parameter in all versions up to, and including, 5.1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/survey-maker/tags/5.1.3.2/admin/partials/surveys/actions/partials/survey-maker-surveys-actions-tab1.php#L1160; https://www.wordfence.com/threat-intel/vulnerabilities/id/fc3c22a2-b766-419c-a481-48e6a73b084c?source=cve