deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-31468
Published: 2024-05-14
Description: There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt
CVE: CVE-2024-31469
Published: 2024-05-14
Description: There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt
CVE: CVE-2024-31470
Published: 2024-05-14
Description: There is a buffer overflow vulnerability in the underlying SAE (Simultaneous Authentication of Equals) service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt
CVE: CVE-2024-31471
Published: 2024-05-14
Description: There is a command injection vulnerability in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt
CVE: CVE-2024-31472
Published: 2024-05-14
Description: There are command injection vulnerabilities in the underlying Soft AP Daemon service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt
CVE: CVE-2024-31473
Published: 2024-05-14
Description: There is a command injection vulnerability in the underlying deauthentication service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt
CVE: CVE-2024-31474
Published: 2024-05-14
Description: There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the affected Access Point
CVSS Score: 8.2 (HIGH)
CWE: CWE-463
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt
CVE: CVE-2024-31475
Published: 2024-05-14
Description: There is an arbitrary file deletion vulnerability in the Central Communications service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the affected Access Point.
CVSS Score: 8.2 (HIGH)
CWE: CWE-463
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt
CVE: CVE-2024-31476
Published: 2024-05-14
Description: Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt
CVE: CVE-2024-31477
Published: 2024-05-14
Description: Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt
CVE: CVE-2024-31478
Published: 2024-05-14
Description: Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilites result in the ability to interrupt the normal operation of the affected Access Point.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-78
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt
CVE: CVE-2024-31479
Published: 2024-05-14
Description: Unauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-78
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt
CVE: CVE-2024-31480
Published: 2024-05-14
Description: Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-78
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt
CVE: CVE-2024-31481
Published: 2024-05-14
Description: Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-78
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt
CVE: CVE-2024-31482
Published: 2024-05-14
Description: An unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected Access Point.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-78
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt
CVE: CVE-2024-31483
Published: 2024-05-14
Description: An authenticated sensitive information disclosure vulnerability exists in the CLI service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to read arbitrary files in the underlying operating system.
CVSS Score: 4.9 (MEDIUM)
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-006.txt
CVE: CVE-2024-4666
Published: 2024-05-14
Description: The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/borderless/trunk/modules/elementor/widgets/circular-progress-bar.php#L427; https://plugins.trac.wordpress.org/browser/borderless/trunk/modules/elementor/widgets/progress-bar.php#L412; https://plugins.trac.wordpress.org/browser/borderless/trunk/modules/elementor/widgets/semi-circular-progress-bar.php#L403
CVE: CVE-2024-0437
Published: 2024-05-15
Description: The Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.6 via the API. This makes it possible for authenticated attackers, with subscriber access or higher, to extract post titles and content, thus bypassing the plugin's password protection.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3034934%40password-protected%2Ftrunk&old=3005632%40password-protected%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/f3045ebf-70af-4124-9116-42c07f64a3bf?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3034934%40password-protected%2Ftrunk&old=3005632%40password-protected%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-4363
Published: 2024-05-15
Description: The Visual Portfolio, Photo Gallery & Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_tag’ parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/visual-portfolio/trunk/templates/items-list/item-parts/title.php#L22; https://wordpress.org/plugins/visual-portfolio/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/ab5e09d8-6fa3-4a5b-bee1-6648df4f4b3b?source=cve
CVE: CVE-2024-4370
Published: 2024-05-15
Description: The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget Image Box in all versions up to, and including, 1.1.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/wpzoom-elementor-addons/trunk/includes/widgets/image-box/image-box.php#L1229; https://plugins.trac.wordpress.org/changeset/3084540; https://wordpress.org/plugins/wpzoom-elementor-addons/#developers
CVE: CVE-2024-3744
Published: 2024-05-15
Description: A security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when TokenRequests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: http://www.openwall.com/lists/oss-security/2024/05/09/4; https://github.com/kubernetes/kubernetes/issues/124759; https://groups.google.com/g/kubernetes-security-announce/c/hcgZE2MQo1A/m/Y4C6q-CYAgAJ
CVE: CVE-2024-35108
Published: 2024-05-15
Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/homePro_deal.php?mudi=del&dataType=&dataTypeCN.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/FirstLIF/cms/blob/main/1.md; https://github.com/FirstLIF/cms/blob/main/1.md
CVE: CVE-2024-35109
Published: 2024-05-15
Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /homePro_deal.php?mudi=add&nohrefStr=close.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/FirstLIF/cms/blob/main/2.md; https://github.com/FirstLIF/cms/blob/main/2.md
CVE: CVE-2024-4199
Published: 2024-05-15
Description: The Bulk Posts Editing For WordPress plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 4.2.3. This makes it possible for authenticated attackers, with subscriber access and higher, to invoke their corresponding functions. This may lead to post creation and duplication, post content retrieval, post taxonomy manipulation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3085134%40ithemeland-bulk-posts-editing-lite%2Ftrunk&old=2946926%40ithemeland-bulk-posts-editing-lite%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/683131a0-eec3-4251-b322-5c[PII_REDACTED]?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3085134%40ithemeland-bulk-posts-editing-lite%2Ftrunk&old=2946926%40ithemeland-bulk-posts-editing-lite%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-4373
Published: 2024-05-15
Description: The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Particle Layer widget in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-35703 is likely a duplicate of this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3085825%40sina-extension-for-elementor&new=3085825%40sina-extension-for-elementor&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/eee04b1d-188a-4b92-a6f3-dfa843ca20d7?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3085825%40sina-extension-for-elementor&new=3085825%40sina-extension-for-elementor&sfp_email=&sfph_mail=
CVE: CVE-2024-4618
Published: 2024-05-15
Description: The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Team Member widget in all versions up to, and including, 2.6.9.6 due to insufficient input sanitization and output escaping on user supplied 'url' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/exclusive-addons-for-elementor/tags/2.6.9.6/elements/team-member/team-member.php#L1696; https://plugins.trac.wordpress.org/changeset/3083582/#file4; https://wordpress.org/plugins/exclusive-addons-for-elementor/#developers
CVE: CVE-2024-4656
Published: 2024-05-15
Description: The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user agent header in all versions up to, and including, 1.26.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3085346%40import-users-from-csv-with-meta%2Ftrunk&old=3078277%40import-users-from-csv-with-meta%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/af742451-b2d6-445a-9a10-e950490f6c7c?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3085346%40import-users-from-csv-with-meta%2Ftrunk&old=3078277%40import-users-from-csv-with-meta%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-4734
Published: 2024-05-15
Description: The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.26.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3085346%40import-users-from-csv-with-meta%2Ftrunk&old=3078277%40import-users-from-csv-with-meta%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/0dca168f-a383-42fc-91ba-d78a5d7e6724?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3085346%40import-users-from-csv-with-meta%2Ftrunk&old=3078277%40import-users-from-csv-with-meta%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-4847
Published: 2024-05-15
Description: The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to generic SQL Injection via the ‘last_post_id’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/alttext-ai/trunk/includes/class-atai-attachment.php#L677; https://plugins.trac.wordpress.org/changeset/3086107/; https://wordpress.org/plugins/alttext-ai/#developers
CVE: CVE-2024-32888
Published: 2024-05-15
Description: The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces (APIs) available in the Java Platform, Enterprise Editions. Prior to version 2.1.0.28, SQL injection is possible when using the non-default connection property `preferQueryMode=simple` in combination with application code which has a vulnerable SQL that negates a parameter value. There is no vulnerability in the driver when using the default, extended query mode. Note that `preferQueryMode` is not a supported parameter in Redshift JDBC driver, and is inherited code from Postgres JDBC driver. Users who do not override default settings to utilize this unsupported query mode are not affected. This issue is patched in driver version 2.1.0.28. As a workaround, do not use the connection property `preferQueryMode=simple`. (NOTE: Those who do not explicitly specify a query mode use the default of extended query mode and are not affected by this issue.)
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89
References: https://github.com/aws/amazon-redshift-jdbc-driver/commit/0d354a5f26ca23f7cac4e800e3b[PII_REDACTED]319; https://github.com/aws/amazon-redshift-jdbc-driver/commit/12a5e8ecfbb44c8154fc66041cca2e20ecd7b339; https://github.com/aws/amazon-redshift-jdbc-driver/commit/bc93694201a291493778ce5369a72befeca5ba7d
CVE: CVE-2024-3189
Published: 2024-05-15
Description: The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Testimonial', 'Progress Bar', 'Lottie Animations', 'Row Layout', 'Google Maps', and 'Advanced Gallery' blocks in all versions up to, and including, 3.2.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3083616/kadence-blocks/trunk/includes/blocks/class-kadence-blocks-lottie-block.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3076712%40kadence-blocks&new=3076712%40kadence-blocks&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3084683%40kadence-blocks&new=3084683%40kadence-blocks&sfp_email=&sfph_mail=#file2
CVE: CVE-2024-4208
Published: 2024-05-15
Description: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the typer effect in the advanced heading widget in all versions up to, and including, 3.2.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3084683%40kadence-blocks&new=3084683%40kadence-blocks&sfp_email=&sfph_mail=#file2; https://www.wordfence.com/threat-intel/vulnerabilities/id/7ea2bb8c-cc8b-49de-9c8e-2c8c0569f4ac?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3084683%40kadence-blocks&new=3084683%40kadence-blocks&sfp_email=&sfph_mail=#file2