deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-34251
Published: 2022-07-15
Description: Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by an Out-Of-Bounds Write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/incopy/apsb22-29.html; https://helpx.adobe.com/security/products/incopy/apsb22-29.html
CVE: CVE-2022-34252
Published: 2022-07-15
Description: Adobe InCopy versions 17.2 (and earlier) and 16.4.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/incopy/apsb22-29.html; https://helpx.adobe.com/security/products/incopy/apsb22-29.html
CVE: CVE-2022-31153
Published: 2022-07-15
Description: OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to an error that renders account contracts unusable on live networks. This issue affects all accounts (vanilla and ethereum flavors) in the v0.2.0 release of OpenZeppelin Contracts for Cairo, which are not whitelisted on StarkNet mainnet. Only goerli deployments of v0.2.0 accounts are affected. This faulty behavior is not observed in StarkNet's testing framework. This bug has been patched in v0.2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-664, CWE-863
References: https://github.com/OpenZeppelin/cairo-contracts/blob/release-0.2.0/src/openzeppelin/account/library.cairo#L203; https://github.com/OpenZeppelin/cairo-contracts/commit/2cd60279c3332285d47edf9ee3888b71257acdc9; https://github.com/OpenZeppelin/cairo-contracts/issues/386
CVE: CVE-2022-31157
Published: 2022-07-15
Description: LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the function used to generate random nonces was not sufficiently cryptographically complex. Users should upgrade to version 5.0 to receive a patch. There are currently no known workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327, CWE-330
References: https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-768m-5w34-2xf5; https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-768m-5w34-2xf5
CVE: CVE-2022-31158
Published: 2022-07-15
Description: LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the Nonce Claim Value was not being validated against the nonce value sent in the Authentication Request. Users should upgrade to version 5.0 to receive a patch. There are currently no known workarounds.
CVSS Score: 7.5 (HIGH)
CWE: CWE-294, CWE-294
References: https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-5p73-qg2v-383h; https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-5p73-qg2v-383h
CVE: CVE-2022-31159
Published: 2022-07-15
Description: The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the `downloadDirectory` method in the AWS S3 TransferManager component of the AWS SDK for Java v1 prior to version 1.12.261. Applications using the SDK control the `destinationDirectory` argument, but S3 object keys are determined by the application that uploaded the objects. The `downloadDirectory` method allows the caller to pass a filesystem object in the object key but contained an issue in the validation logic for the key name. A knowledgeable actor could bypass the validation logic by including a UNIX double-dot in the bucket key. Under certain conditions, this could permit them to retrieve a directory from their S3 bucket that is one level up in the filesystem from their working directory. This issue’s scope is limited to directories whose name prefix matches the destinationDirectory. E.g. for destination directory`/tmp/foo`, the actor can cause a download to `/tmp/foo-bar`, but not `/tmp/bar`. If `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory` is used to download an untrusted buckets contents, the contents of that bucket can be written outside of the intended destination directory. Version 1.12.261 contains a patch for this issue. As a workaround, when calling `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory`, pass a `KeyFilter` that forbids `S3ObjectSummary` objects that `getKey` method return a string containing the substring `..` .
CVSS Score: 7.9 (HIGH)
CWE: CWE-22
References: https://github.com/aws/aws-sdk-java/security/advisories/GHSA-c28r-hw5m-5gv3; https://github.com/aws/aws-sdk-java/security/advisories/GHSA-c28r-hw5m-5gv3
CVE: CVE-2021-34986
Published: 2022-07-15
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.5.0 (49183). An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Parallels Service. By creating a symbolic link, an attacker can abuse the service to execute a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-13932.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-22-385/; https://kb.parallels.com/en/125013
CVE: CVE-2021-34987
Published: 2022-07-15
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.5.1 (49187). An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the HDAudio virtual device. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-14969.
CVSS Score: 8.2 (HIGH)
CWE: CWE-120
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-22-386/; https://kb.parallels.com/en/125013
CVE: CVE-2022-25858
Published: 2022-07-15
Description: The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333
References: https://github.com/terser/terser/blob/master/lib/compress/evaluate.js%23L135; https://github.com/terser/terser/commit/a4da7349fdc92c05094f41d33d06d8cd4e90e76b; https://github.com/terser/terser/commit/d8cc5691be980d663c29cc4d5ce67e852d597012
CVE: CVE-2022-25869
Published: 2022-07-15
Description: All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://neverendingsupport.github.io/angularjs-poc-cve-2022-25869; https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJS-10771617; https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJSCORE-6084031
CVE: CVE-2022-25891
Published: 2022-07-15
Description: The package github.com/containrrr/shoutrrr/pkg/util before 0.6.0 are vulnerable to Denial of Service (DoS) via the util.PartitionMessage function. Exploiting this vulnerability is possible by sending exactly 2000, 4000, or 6000 characters messages.
CVSS Score: 7.5 (HIGH)
References: https://github.com/containrrr/shoutrrr/commit/6a27056f9d7522a8b493216195cb7634bf4b5c42; https://github.com/containrrr/shoutrrr/issues/240; https://github.com/containrrr/shoutrrr/pull/242
CVE: CVE-2022-30634
Published: 2022-07-15
Description: Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://go.dev/cl/402257; https://go.dev/issue/52561; https://go.googlesource.com/go/+/bb1f[PII_REDACTED]231de6d17a1f2f55c82aafc863
CVE: CVE-2022-31161
Published: 2022-07-15
Description: Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Version 6.1.1.0 contains a patch for this issue.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-77, CWE-94, CWE-434
References: http://packetstormsecurity.com/files/171652/Roxy-WI-6.1.1.0-Remote-Code-Execution.html; https://github.com/hap-wi/roxy-wi/releases/tag/v6.1.1.0; https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-pg3w-8p63-x483
CVE: CVE-2022-32434
Published: 2022-07-15
Description: EIPStackGroup OpENer v2.3.0 was discovered to contain a stack overflow via /bin/posix/src/ports/POSIX/OpENer+0x56073d.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/EIPStackGroup/OpENer/issues/374; https://github.com/WaterDemo/ProtocolBugs/tree/main/bug; https://github.com/EIPStackGroup/OpENer/issues/374
CVE: CVE-2022-35890
Published: 2022-07-15
Description: An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. Designer and Vision Client Session IDs are mishandled. An attacker can determine which session IDs were generated in the past and then hijack sessions assigned to these IDs via Randy.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-863
References: https://github.com/sourceincite/randy; https://support.inductiveautomation.com/hc/en-us/articles/[PII_REDACTED]653; https://github.com/sourceincite/randy
CVE: CVE-2022-35900
Published: 2022-07-15
Description: An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open a JP2 file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of JP2 files could enable an attacker to read information in the context of the current process.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0015; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0015
CVE: CVE-2022-35901
Published: 2022-07-15
Description: An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open a J2K file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of J2K files could enable an attacker to read information in the context of the current process.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0014; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0014
CVE: CVE-2022-35902
Published: 2022-07-15
Description: An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open an OBJ file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of OBJ files could enable an attacker to read information in the context of the current process.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0016; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0016
CVE: CVE-2022-35903
Published: 2022-07-15
Description: An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open a 3DS file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of 3DS files could enable an attacker to read information in the context of the current process.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0010; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0010
CVE: CVE-2022-35904
Published: 2022-07-15
Description: An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open an IFC file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of IFC files could enable an attacker to read information in the context of the current process.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0013; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0013
CVE: CVE-2022-35905
Published: 2022-07-15
Description: An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open an FBX file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of FBX files could enable an attacker to read information in the context of the current process.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0012; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0012
CVE: CVE-2022-35906
Published: 2022-07-15
Description: An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open a DGN file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within the parsing of DGN files could enable an attacker to read information in the context of the current process.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0011; https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0011
CVE: CVE-2017-20130
Published: 2022-07-16
Description: A vulnerability was found in Itech Real Estate Script 3.12. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /real-estate-script/search_property.php. The manipulation of the argument property_for leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://vuldb.com/?id.96289; https://www.exploit-db.com/exploits/41195/; https://vuldb.com/?id.96289
CVE: CVE-2017-20131
Published: 2022-07-16
Description: A vulnerability was found in Itech News Portal 6.28. It has been classified as critical. Affected is an unknown function of the file /news-portal-script/information.php. The manipulation of the argument inf leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://vuldb.com/?id.96288; https://www.exploit-db.com/exploits/41194/; https://vuldb.com/?id.96288
CVE: CVE-2017-20132
Published: 2022-07-16
Description: A vulnerability was found in Itech Multi Vendor Script 6.49 and classified as critical. This issue affects some unknown processing of the file /multi-vendor-shopping-script/product-list.php. The manipulation of the argument pl leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://vuldb.com/?id.96287; https://www.exploit-db.com/exploits/41193/; https://vuldb.com/?id.96287
CVE: CVE-2017-20133
Published: 2022-07-16
Description: A vulnerability, which was classified as critical, was found in Itech Job Portal Script 9.13. This affects an unknown part of the file /admin. The manipulation leads to improper authentication. It is possible to initiate the attack remotely.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287, CWE-287
References: https://vuldb.com/?id.96285; https://vuldb.com/?id.96285
CVE: CVE-2017-20134
Published: 2022-07-16
Description: A vulnerability, which was classified as critical, has been found in Itech Freelancer Script 5.13. Affected by this issue is some unknown functionality of the file /category.php. The manipulation of the argument sk leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://vuldb.com/?id.96284; https://www.exploit-db.com/exploits/41191/; https://vuldb.com/?id.96284
CVE: CVE-2017-20135
Published: 2022-07-16
Description: A vulnerability classified as critical was found in Itech Dating Script 3.26. Affected by this vulnerability is an unknown functionality of the file /see_more_details.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://vuldb.com/?id.96283; https://www.exploit-db.com/exploits/41190/; https://vuldb.com/?id.96283
CVE: CVE-2017-20136
Published: 2022-07-16
Description: A vulnerability classified as critical has been found in Itech Classifieds Script 7.27. Affected is an unknown function of the file /subpage.php. The manipulation of the argument scat with the input =51' AND 4941=4941 AND 'hoCP'='hoCP leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://vuldb.com/?id.96282; https://www.exploit-db.com/exploits/41189/; https://vuldb.com/?id.96282
CVE: CVE-2017-20137
Published: 2022-07-16
Description: A vulnerability was found in Itech B2B Script 4.28. It has been rated as critical. This issue affects some unknown processing of the file /catcompany.php. The manipulation of the argument token with the input 704667c6a1e7ce56d3d6fa748ab6d9af3fd7' AND 6539=6539 AND 'Fakj'='Fakj leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://vuldb.com/?id.96281; https://www.exploit-db.com/exploits/41188/; https://vuldb.com/?id.96281
CVE: CVE-2017-20138
Published: 2022-07-16
Description: A vulnerability was found in Itech Auction Script 6.49. It has been classified as critical. This affects an unknown part of the file /mcategory.php. The manipulation of the argument mcid with the input 4' AND 1734=1734 AND 'Ggks'='Ggks leads to sql injection (Blind). It is possible to initiate the attack remotely.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://vuldb.com/?id.96261; https://vuldb.com/?id.96261
CVE: CVE-2021-34538
Published: 2022-07-16
Description: Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354; https://lists.apache.org/thread/oqqgnhz4c6nxsfd0xstosnk0g15f7354
CVE: CVE-2021-36711
Published: 2022-07-16
Description: WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://packetstormsecurity.com/files/167780/OctoBot-WebInterface-0.4.3-Remote-Code-Execution.html; https://github.com/Drakkar-Software/OctoBot/blob/master/CHANGELOG.md; https://github.com/Drakkar-Software/OctoBot/issues/1966
CVE: CVE-2022-36126
Published: 2022-07-16
Description: An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. The ScriptInvoke function allows remote attackers to execute arbitrary code by supplying a Python script.
CVSS Score: 7.2 (HIGH)
CWE: CWE-863
References: https://github.com/sourceincite/randy; https://srcincite.io/advisories/src-2022-0014/; https://support.inductiveautomation.com/hc/en-us/articles/[PII_REDACTED]653
CVE: CVE-2015-10003
Published: 2022-07-17
Description: A vulnerability, which was classified as problematic, was found in FileZilla Server up to 0.9.50. This affects an unknown part of the component PORT Handler. The manipulation leads to unintended intermediary. It is possible to initiate the attack remotely. Upgrading to version 0.9.51 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-441, CWE-610
References: http://www.securitygalore.com/site3/filezilla_ftp_server_advisory; https://vuldb.com/?id.97203; http://www.securitygalore.com/site3/filezilla_ftp_server_advisory
CVE: CVE-2020-7641
Published: 2022-07-17
Description: This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-1321
References: https://github.com/mikaelkaron/grunt-util-property/blob/master/main.js%23L41; https://security.snyk.io/vuln/SNYK-JS-GRUNTUTILPROPERTY-565088; https://github.com/mikaelkaron/grunt-util-property/blob/master/main.js%23L41
CVE: CVE-2021-24655
Published: 2022-07-17
Description: The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password (to an arbitrary value) of any user knowing only their ID, and gain access to their account.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://wpscan.com/vulnerability/cce03550-7f65-4172-819e-025755fb541f; https://wpscan.com/vulnerability/cce03550-7f65-4172-819e-025755fb541f
CVE: CVE-2022-1672
Published: 2022-07-17
Description: The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Custom URLs, which could allow attackers to make a logged in admin perform such actions via CSRF attacks
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/5c5955d7-24f0-45e6-9c27-78ef50446dad; https://wpscan.com/vulnerability/5c5955d7-24f0-45e6-9c27-78ef50446dad
CVE: CVE-2022-1933
Published: 2022-07-17
Description: The CDI WordPress plugin before 5.1.9 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/6cedb27f-6140-4cba-836f-63de98e521bf; https://wpscan.com/vulnerability/6cedb27f-6140-4cba-836f-63de98e521bf
CVE: CVE-2022-2090
Published: 2022-07-17
Description: The Discount Rules for WooCommerce WordPress plugin before 2.4.2 does not escape a parameter before outputting it back in an attribute of the plugin's discount rule page, leading to Reflected Cross-Site Scripting
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/0201f365-7acb-4640-bd3f-7119432f4917; https://wpscan.com/vulnerability/0201f365-7acb-4640-bd3f-7119432f4917