deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-12439
Published: 2025-01-07
Description: The Marketplace Items plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'marketplace' shortcode in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/marketplace-items/trunk/marketplace-items.php; https://wordpress.org/plugins/marketplace-items/; https://www.wordfence.com/threat-intel/vulnerabilities/id/602ae805-a6a6-48bd-bd2a-00fafadfdce4?source=cve
CVE: CVE-2024-12440
Published: 2025-01-07
Description: The Candifly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'candifly' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/candifly/trunk/candifly.php; https://wordpress.org/plugins/candifly/; https://www.wordfence.com/threat-intel/vulnerabilities/id/bf173ccd-23bc-49ec-92e0-032feae0fa4a?source=cve
CVE: CVE-2024-12464
Published: 2025-01-07
Description: The Chatroll Live Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'chatroll' shortcode in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/chatroll-live-chat/tags/2.5.0/chatroll.php#L62; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3218569%40chatroll-live-chat&new=3218569%40chatroll-live-chat&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/87fdadcd-b776-471a-9756-708e384de4f0?source=cve
CVE: CVE-2024-12471
Published: 2025-01-07
Description: The Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator plugin for WordPress is vulnerable to arbitrary files uploads due to a missing capability check and file type validation on the add_image_to_library AJAX action function in all versions up to, and including, 1.3.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files that make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://wordpress.org/plugins/post-saint/; https://www.wordfence.com/threat-intel/vulnerabilities/id/bc17284e-65ea-4e67-aba9-3475f0174657?source=cve
CVE: CVE-2024-12535
Published: 2025-01-07
Description: The Host PHP Info plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to read configuration settings and predefined variables on the site's server. The plugin does not need to be activated for the vulnerability to be exploited.
CVSS Score: 8.6 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/host-php-info/trunk/info.php#L2; https://www.wordfence.com/threat-intel/vulnerabilities/id/88d27385-9b92-419c-9e03-687d7192bbb5?source=cve
CVE: CVE-2024-12633
Published: 2025-01-07
Description: The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page parameter in all versions up to, and including, 5.6.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3209054/joomsport-sports-league-results-management; https://www.wordfence.com/threat-intel/vulnerabilities/id/b4503e2c-0d0d-45de-a597-baace44a98a7?source=cve
CVE: CVE-2024-12849
Published: 2025-01-07
Description: The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_elvwp_log_download AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/error-log-viewer-wp/tags/1.0.1.3/error-log-viewer-wp.php#L295; https://plugins.trac.wordpress.org/browser/error-log-viewer-wp/tags/1.0.1.3/error-log-viewer-wp.php#L479; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3215563%40error-log-viewer-wp&new=3215563%40error-log-viewer-wp&sfp_email=&sfph_mail=#file10
CVE: CVE-2024-7696
Published: 2025-01-07
Description: Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for an authenticated malicious client to tamper with audit log creation in AXIS Camera Station, or perform a Denial-of-Service attack on the AXIS Camera Station server using maliciously crafted audit log entries. 
Axis has released a patched version for the highlighted flaw. Please 
refer to the Axis security advisory for more information and solution.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-117
References: https://www.axis.com/dam/public/b3/53/03/cve-2024-7696-en-US-459552.pdf
CVE: CVE-2024-8855
Published: 2025-01-07
Description: The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing editors and above to perform SQL injection attacks
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/04084f2a-45b8-4249-a472-f156fad0c90a/
CVE: CVE-2024-8857
Published: 2025-01-07
Description: The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Stored Cross-Site Scripting attacks.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/08ca6daa-09f4-4604-ac9e-15a1b33d599d/
CVE: CVE-2024-9638
Published: 2025-01-07
Description: The Category Posts Widget WordPress plugin before 4.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/119d5249-48e4-429e-8a1d-ad112e0c966d/
CVE: CVE-2024-9697
Published: 2025-01-07
Description: The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tweet_settings_save() and tweet_settings_update() functions in all versions up to, and including, 1.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/social-rocket/trunk/admin/includes/class-social-rocket-admin.php#L39; https://plugins.trac.wordpress.org/browser/social-rocket/trunk/admin/includes/class-social-rocket-admin.php#L5501; https://plugins.trac.wordpress.org/browser/social-rocket/trunk/admin/includes/class-social-rocket-admin.php#L5531
CVE: CVE-2024-9702
Published: 2025-01-07
Description: The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialrocket-floating' shortcode in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3347243/; https://www.wordfence.com/threat-intel/vulnerabilities/id/8d4d948e-359e-4514-9c8f-dbd8198ef4fe?source=cve
CVE: CVE-2024-11282
Published: 2025-01-07
Description: The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.10 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3211004/content-protector; https://www.wordfence.com/threat-intel/vulnerabilities/id/11782a65-30b9-400e-8fe0-ab9f05ba5e42?source=cve
CVE: CVE-2024-11725
Published: 2025-01-07
Description: The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the updateWcWarrantySettings() function in all versions up to, and including, 3.7.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Please note this requires the woocommerce-warranty plugin to be installed in order to be exploited.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/sms-alert/trunk/helper/return-warranty.php#L74; https://plugins.trac.wordpress.org/changeset/3198056/sms-alert/trunk/helper/return-warranty.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3197777%40sms-alert&new=3197777%40sms-alert&sfp_email=&sfph_mail=
CVE: CVE-2024-11764
Published: 2025-01-07
Description: The Solar Wizard Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'solar_wizard' shortcode in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3215301%40solar-wizard-lite&new=3215301%40solar-wizard-lite&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/adcab262-08ca-448d-b1fd-295d421b82a3?source=cve
CVE: CVE-2024-12437
Published: 2025-01-07
Description: The Marketplace Items plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'envato' shortcode in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/marketplace-items/trunk/marketplace-items.php#L94; https://wordpress.org/plugins/marketplace-items; https://www.wordfence.com/threat-intel/vulnerabilities/id/e055c319-1aeb-4a97-98d1-3b38e61f30f0?source=cve
CVE: CVE-2024-12495
Published: 2025-01-07
Description: The Bootstrap Blocks for WP Editor v2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gtb-bootstrap/column' block in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3213432%40wp-editor-bootstrap-blocks&new=3213432%40wp-editor-bootstrap-blocks&sfp_email=&sfph_mail=#file33; https://www.wordfence.com/threat-intel/vulnerabilities/id/4e9e9afc-89a0-444d-ad5b-975e0f3c19d5?source=cve
CVE: CVE-2024-12499
Published: 2025-01-07
Description: The WP jQuery DataTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_jdt' shortcode in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3213340%40wp-jquery-datatable&new=3213340%40wp-jquery-datatable&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/5c6a6422-8255-4a3c-9ddf-b5986e1d393f?source=cve
CVE: CVE-2024-12624
Published: 2025-01-07
Description: The Sina Extension for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Image Differ widget in all versions up to, and including, 3.5.91 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3211218/sina-extension-for-elementor; https://www.wordfence.com/threat-intel/vulnerabilities/id/39f6fb61-25a9-4386-9b61-7343760fd28c?source=cve
CVE: CVE-2024-12781
Published: 2025-01-07
Description: The Aurum - WordPress & WooCommerce Shopping Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'lab_1cl_demo_install_package_content' function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite content with imported demo content.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://documentation.laborator.co/kb/aurum/aurum-release-notes/; https://www.wordfence.com/threat-intel/vulnerabilities/id/cd132aa5-d30a-41de-aa8d-aefae6c95c47?source=cve
CVE: CVE-2024-9354
Published: 2025-01-07
Description: The Estatik Mortgage Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'color' parameter in all versions up to, and including, 2.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/estatik-mortgage-calculator/trunk/public/images/info.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3199224%40estatik-mortgage-calculator&new=3199224%40estatik-mortgage-calculator&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/4b955a0f-d064-436f-8648-0e84fac752d2?source=cve
CVE: CVE-2024-9502
Published: 2025-01-07
Description: The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Tooltip module in all versions up to, and including, 2.0.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://master-addons.com/changelogs/; https://plugins.trac.wordpress.org/browser/master-addons/trunk/addons/ma-tooltip/ma-tooltip.php#L250; https://plugins.trac.wordpress.org/changeset/3211489/
CVE: CVE-2024-10866
Published: 2025-01-07
Description: The Export Import Menus plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dsp_export_import_menus() function in all versions up to, and including, 1.9.1. This makes it possible for unauthenticated attackers to export menu data and settings.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3213801%40export-import-menus&new=3213801%40export-import-menus&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/08beb583-096d-453c-9690-b46e410afb1b?source=cve
CVE: CVE-2024-11625
Published: 2025-01-07
Description: Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421.
CVSS Score: 7.7 (HIGH)
CWE: CWE-209
References: https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-11625-and-CVE-2024-11626-January-2025; https://www.progress.com/sitefinity-cms
CVE: CVE-2024-11626
Published: 2025-01-07
Description: Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421.
CVSS Score: 8.4 (HIGH)
CWE: CWE-79
References: https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-11625-and-CVE-2024-11626-January-2025; https://www.progress.com/sitefinity-cms
CVE: CVE-2024-11627
Published: 2025-01-07
Description: : Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-613
References: https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-11625-and-CVE-2024-11626-January-2025; https://www.progress.com/sitefinity-cms
CVE: CVE-2024-12077
Published: 2025-01-07
Description: The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘calendar_id’ parameter in all versions up to, and including, 3.2.19 and 11.2.19 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/booking-calendar/tags/3.2.16/admin/views/Reservations.php#L528; https://plugins.trac.wordpress.org/browser/booking-calendar/tags/3.2.16/admin/views/Reservations.php#L532; https://plugins.trac.wordpress.org/changeset/3209851/
CVE: CVE-2024-12202
Published: 2025-01-07
Description: The Croma Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'ironMusic_ajax' function in all versions up to, and including, 3.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://croma.irontemplates.com/lowtempo/wp-content/themes/croma/changelog.txt; https://www.wordfence.com/threat-intel/vulnerabilities/id/4ce8e0f1-5a7b-41a3-81d0-7fd12c9da6d9?source=cve
CVE: CVE-2024-12516
Published: 2025-01-07
Description: The Coupon Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Coupon Code' parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3215992%40coupon-lite&new=3215992%40coupon-lite&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/827c0459-1328-4fb1-b044-ae80298fa5ea?source=cve
CVE: CVE-2024-45070
Published: 2025-01-07
Description: in OpenHarmony v4.1.2 and prior versions allow a local attacker cause information leak through out-of-bounds Read.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-01.md
CVE: CVE-2024-47398
Published: 2025-01-07
Description: in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the device is unable to boot up through out-of-bounds write.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-01.md
CVE: CVE-2024-54030
Published: 2025-01-07
Description: in OpenHarmony v4.1.2 and prior versions allow a local attacker cause DOS through use after free.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-416
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-01.md
CVE: CVE-2024-12152
Published: 2025-01-07
Description: The MIPL WC Multisite Sync plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.5 via the 'mipl_wc_sync_download_log' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3215735%40mipl-wc-multisite-sync&new=3215735%40mipl-wc-multisite-sync&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3216574%40mipl-wc-multisite-sync&new=3216574%40mipl-wc-multisite-sync&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/575d1e24-d23d-4589-bb71-f52efec1ac58?source=cve