deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-2084
Published: 2024-05-02
Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's lightbox widget in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3048999/; https://www.wordfence.com/threat-intel/vulnerabilities/id/8e5417d3-c466-4caf-9fb6-26d6e2c06fe1?source=cve; https://plugins.trac.wordpress.org/changeset/3048999/
CVE: CVE-2024-2085
Published: 2024-05-02
Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' value in several widgets all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3048999/ht-mega-for-elementor/trunk/includes/widgets/htmega_accordion.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/0f9c5bed-a399-43e2-be40-d669e90d3736?source=cve; https://plugins.trac.wordpress.org/changeset/3048999/ht-mega-for-elementor/trunk/includes/widgets/htmega_accordion.php
CVE: CVE-2024-2109
Published: 2024-05-02
Description: The Booster Extension plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'booster_extension_authorbox_shortcode_display' function. This makes it possible for unauthenticated attackers to extract sensitive data including user emails
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/booster-extension/tags/1.2.0/inc/frontend/author-box-shortcode.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3053100%40booster-extension&new=3053100%40booster-extension&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/89458095-2efe-4162-961a-7dc80852d312?source=cve
CVE: CVE-2024-2273
Published: 2024-05-02
Description: The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 3.2.34 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3075158%40kadence-blocks%2Ftrunk&old=3068562%40kadence-blocks%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/e7fe482e-a4e8-411c-97a4-a32ccf5b3682?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3075158%40kadence-blocks%2Ftrunk&old=3068562%40kadence-blocks%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-2324
Published: 2024-05-02
Description: The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. For the free version, this is limited to administrators. The pro version is also vulnerable and exploitable by administrators, but also offers the functionality to lower level users (as low as subscribers) if enabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3069064%40fileorganizer%2Ftrunk&old=3010587%40fileorganizer%2Ftrunk; https://www.wordfence.com/threat-intel/vulnerabilities/id/ffaefd79-57a7-43b8-af1c-e108567eba67?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3069064%40fileorganizer%2Ftrunk&old=3010587%40fileorganizer%2Ftrunk
CVE: CVE-2024-2328
Published: 2024-05-02
Description: The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image title and alt text in all versions up to, and including, 4.22.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/real-media-library-lite/trunk/inc/view/Gutenberg.php#L70; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3067589%40real-media-library-lite%2Ftrunk&old=3056657%40real-media-library-lite%2Ftrunk&sfp_email=&sfph_mail=#file4; https://www.wordfence.com/threat-intel/vulnerabilities/id/d359dc78-fc90-4570-a768-5f1a05f865e1?source=cve
CVE: CVE-2024-2345
Published: 2024-05-02
Description: The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the folder name parameter in all versions up to, and including, 5.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3060898%40filebird%2Ftrunk&old=3049188%40filebird%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/129cc3b0-4f48-4846-902e-be5cd339f537?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3060898%40filebird%2Ftrunk&old=3049188%40filebird%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-2346
Published: 2024-05-02
Description: The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via folder deletion due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author access or higher, to delete folders created by other users and make their file uploads visible. CVE-2024-35166 may be a duplicate of this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3060898%40filebird%2Ftrunk&old=3049188%40filebird%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/82cde234-ae87-438f-911e-bdd0e3ac1132?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3060898%40filebird%2Ftrunk&old=3049188%40filebird%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-2349
Published: 2024-05-02
Description: The Fancy Elementor Flipbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Fancy Elementor Flipbox widget in all versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-34572 may be a duplicate of this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/fancy-elementor-flipbox/trunk/widgets/fancy-elementor-flipbox.php#L744; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3081678%40fancy-elementor-flipbox%2Ftrunk&old=3081656%40fancy-elementor-flipbox%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c877ac24-a6da-4e61-a669-a0224c9e3bb5?source=cve
CVE: CVE-2024-2401
Published: 2024-05-02
Description: The Admin Page Spider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3087069%40admin-page-spider&new=3087069%40admin-page-spider&sfp_email=&sfph_mail=; https://wordpress.org/plugins/admin-page-spider/; https://www.wordfence.com/threat-intel/vulnerabilities/id/c33d9295-0c7f-45a0-9d62-4293c8bbef0b?source=cve
CVE: CVE-2024-2417
Published: 2024-05-02
Description: The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the form_save_action() function in all versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the registration form and make the default registration role administrator. This subsequently allows the attacker to register an account as an administrator on the site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://github.com/wpeverest/user-registration/commit/d265273aa4dddb24ade929be78c6bf1766f1cf00; https://plugins.trac.wordpress.org/changeset/3070439/user-registration/trunk/includes/class-ur-ajax.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/d03459d8-b1f2-4270-a294-403754db1f2f?source=cve
CVE: CVE-2024-2503
Published: 2024-05-02
Description: The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Grid Widget in all versions up to, and including, 2.6.9.2 due to insufficient input sanitization and output escaping on user supplied tags. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-32557 is likely a duplicate of this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/exclusive-addons-for-elementor/tags/2.6.9.1/includes/template-parts/tmpl-post-grid.php#L103; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3065677%40exclusive-addons-for-elementor%2Ftrunk&old=3051927%40exclusive-addons-for-elementor%2Ftrunk&sfp_email=&sfph_mail=#file51; https://www.wordfence.com/threat-intel/vulnerabilities/id/2bd53172-ddfa-481a-818d-626b9db6fe41?source=cve
CVE: CVE-2024-2542
Published: 2024-05-02
Description: The Jotform Online Forms – Drag & Drop Form Builder, Securely Embed Contact Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-32527 is likely a duplicate of this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3073311%40embed-form%2Ftrunk&old=2981633%40embed-form%2Ftrunk&sfp_email=&sfph_mail=#file1; https://www.wordfence.com/threat-intel/vulnerabilities/id/90c34a01-a0d1-4305-b74b-b5a568a42b13?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3073311%40embed-form%2Ftrunk&old=2981633%40embed-form%2Ftrunk&sfp_email=&sfph_mail=#file1
CVE: CVE-2024-2661
Published: 2024-05-02
Description: The Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader. plugin for WordPress is vulnerable to blind SQL Injection via the ‘currentIds’ parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with subscriber access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/trunk/src/Core.php#L621; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3074826%40barcode-scanner-lite-pos-to-manage-products-inventory-and-orders%2Ftrunk&old=3048878%40barcode-scanner-lite-pos-to-manage-products-inventory-and-orders%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/3c8ba503-db7e-4ac1-898f-a301854db60f?source=cve
CVE: CVE-2024-2667
Published: 2024-05-02
Description: The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to  insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for unauthenticated attackers to upload arbitrary files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3061039%40instawp-connect&new=3061039%40instawp-connect&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/f6aead8d-c136-4952-ad03-86fe0f144dea?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3061039%40instawp-connect&new=3061039%40instawp-connect&sfp_email=&sfph_mail=
CVE: CVE-2024-2750
Published: 2024-05-02
Description: The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of the Button widget in all versions up to, and including, 2.6.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-87, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3072751/exclusive-addons-for-elementor/trunk/elements/button/button.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/3011b783-e4b4-45d2-81af-2f8d166a30ac?source=cve; https://plugins.trac.wordpress.org/changeset/3072751/exclusive-addons-for-elementor/trunk/elements/button/button.php
CVE: CVE-2024-2751
Published: 2024-05-02
Description: The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘exad_infobox_animating_mask_style’ parameter in all versions up to, and including, 2.6.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3065677%40exclusive-addons-for-elementor%2Ftrunk&old=3051927%40exclusive-addons-for-elementor%2Ftrunk&sfp_email=&sfph_mail=#file51; https://www.wordfence.com/threat-intel/vulnerabilities/id/e9ad2dff-0c6d-4d91-a35d-803b97def01f?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3065677%40exclusive-addons-for-elementor%2Ftrunk&old=3051927%40exclusive-addons-for-elementor%2Ftrunk&sfp_email=&sfph_mail=#file51
CVE: CVE-2024-2752
Published: 2024-05-02
Description: The Where Did You Hear About Us Checkout Field for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via order meta in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3080647; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3075865%40wc-customer-source%2Ftrunk&old=3054024%40wc-customer-source%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/fbee3720-6ab9-4470-b2d2-09824db8de4d?source=cve
CVE: CVE-2024-2765
Published: 2024-05-02
Description: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Skype and Spotify URL parameters in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ultimatemember/ultimatemember/blob/de04d89a49dfb9baf4019ea77b1edfbcd17fd849/includes/core/um-filters-fields.php#L117; https://github.com/ultimatemember/ultimatemember/blob/de04d89a49dfb9baf4019ea77b1edfbcd17fd849/includes/core/um-filters-fields.php#L472; https://github.com/ultimatemember/ultimatemember/pull/1491/files
CVE: CVE-2024-2790
Published: 2024-05-02
Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Accordion widget in all versions up to, and including, 2.4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3063395%40ht-mega-for-elementor&new=3063395%40ht-mega-for-elementor&sfp_email=&sfph_mail=#file4; https://www.wordfence.com/threat-intel/vulnerabilities/id/52ba91f1-21a2-4d7c-8801-b5e72a00c37d?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3063395%40ht-mega-for-elementor&new=3063395%40ht-mega-for-elementor&sfp_email=&sfph_mail=#file4
CVE: CVE-2024-2797
Published: 2024-05-02
Description: The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized plugin setting changes due to a missing capability check on the toggleRolesAndPermissions and editAllowedRolesAndPermissions functions in all versions up to, and including, 1.7.6. This makes it possible for unauthenticated attackers to allow lower level users to modify forms.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/official-mailerlite-sign-up-forms/trunk/src/Admin/Actions.php#L41; https://plugins.trac.wordpress.org/changeset/3070584/official-mailerlite-sign-up-forms/trunk?contextall=1&old=3045803&old_path=%2Fofficial-mailerlite-sign-up-forms%2Ftrunk; https://www.wordfence.com/threat-intel/vulnerabilities/id/a03b4c19-85fa-47ad-b9ae-b466f8e5ca96?source=cve
CVE: CVE-2024-2831
Published: 2024-05-02
Description: The Calendar plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcodes in all versions up to, and including, 1.3.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3095719%40calendar&new=3095719%40calendar&sfp_email=&sfph_mail=; https://wordpress.org/plugins/calendar/; https://www.wordfence.com/threat-intel/vulnerabilities/id/0886fa16-4292-4223-af01-9aa1f36490f7?source=cve
CVE: CVE-2024-2840
Published: 2024-05-02
Description: The Enhanced Media Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via media upload functionality in all versions up to, and including, 2.8.9 due to the plugin allowing 'dfxp' files to be uploaded. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?old_path=/enhanced-media-library/tags/2.8.9&new_path=/enhanced-media-library/tags/2.8.10&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/15b30ecb-e3ce-4092-841b-3a1b2553596a?source=cve; https://plugins.trac.wordpress.org/changeset?old_path=/enhanced-media-library/tags/2.8.9&new_path=/enhanced-media-library/tags/2.8.10&sfp_email=&sfph_mail=
CVE: CVE-2024-2867
Published: 2024-05-02
Description: The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 4.15.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3061186%40wp-user-avatar%2Ftrunk&old=3053353%40wp-user-avatar%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/4eb296af-547a-44aa-b804-833204b75256?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3061186%40wp-user-avatar%2Ftrunk&old=3053353%40wp-user-avatar%2Ftrunk&sfp_email=&sfph_mail=