deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-7994
Published: 2024-10-16
Description: A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Stack-Based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://autodesk.com/trust/security-advisories/adsk-sa-2024-0017
CVE: CVE-2024-45766
Published: 2024-10-17
Description: Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Control of Generation of Code ('Code Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.
CVSS Score: 8.0 (HIGH)
CWE: CWE-94
References: https://www.dell.com/support/kbdoc/en-us/000237300/dsa-2024-426-security-update-for-dell-openmanage-enterprise-vulnerabilities
CVE: CVE-2024-45767
Published: 2024-10-17
Description: Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89
References: https://www.dell.com/support/kbdoc/en-us/000237300/dsa-2024-426-security-update-for-dell-openmanage-enterprise-vulnerabilities
CVE: CVE-2024-9215
Published: 2024-10-17
Description: The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Insecure Direct Object Reference to Privilege Escalation/Account Takeover in all versions up to, and including, 4.7.1 via the action_edited_author() due to missing validation on the 'authors-user_id' user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to update arbitrary user accounts email addresses, including administrators, which can then be leveraged to reset that user's account password and gain access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/publishpress-authors/tags/4.7.1/src/core/Classes/Author_Editor.php#L594; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3169244%40publishpress-authors&new=3169244%40publishpress-authors&sfp_email=&sfph_mail=#file7; https://www.wordfence.com/threat-intel/vulnerabilities/id/d0506137-82e3-4988-9b23-370465a866c0?source=cve
CVE: CVE-2024-9240
Published: 2024-10-17
Description: The ReDi Restaurant Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 24.0902. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/redi-restaurant-reservation/trunk/templates/admin_welcome_no_page.php?rev=2988247#L41; https://plugins.trac.wordpress.org/changeset/3167881/redi-restaurant-reservation/trunk/templates/admin_welcome_no_page.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/bb9fc87e-b376-49ce-ba69-5acef9deda4d?source=cve
CVE: CVE-2024-9861
Published: 2024-10-17
Description: The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due to missing validation on the token being supplied during the otp login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the phone number associated with that user.
CVSS Score: 8.1 (HIGH)
CWE: CWE-288, CWE-306
References: https://plugins.trac.wordpress.org/browser/miniorange-firebase-sms-otp-verification/tags/3.6.0/handler/forms/class-loginform.php#L144; https://plugins.trac.wordpress.org/browser/miniorange-firebase-sms-otp-verification/tags/3.6.0/handler/forms/class-loginform.php#L190; https://plugins.trac.wordpress.org/changeset/3169869/miniorange-firebase-sms-otp-verification#file3
CVE: CVE-2024-9862
Published: 2024-10-17
Description: The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources, and the user current password check is missing. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639, CWE-639
References: https://plugins.trac.wordpress.org/browser/miniorange-firebase-sms-otp-verification/tags/3.6.0/handler/forms/class-loginform.php#L236; https://plugins.trac.wordpress.org/changeset/3169869/miniorange-firebase-sms-otp-verification#file3; https://www.wordfence.com/threat-intel/vulnerabilities/id/9c3df12d-e526-4a23-89d3-bfdcea9f7b2d?source=cve
CVE: CVE-2024-9863
Published: 2024-10-17
Description: The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.6.0 due to the insecure 'administrator' default value for the 'default_user_role' option. This makes it possible for unauthenticated attackers to register an administrator user even if the registration form is disabled.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-266
References: https://plugins.trac.wordpress.org/browser/miniorange-firebase-sms-otp-verification/tags/3.6.0/handler/forms/class-registrationform.php#L194; https://plugins.trac.wordpress.org/changeset/3169869/miniorange-firebase-sms-otp-verification#file4; https://www.wordfence.com/threat-intel/vulnerabilities/id/f04eab14-dd86-4145-b5eb-20d064bc8417?source=cve
CVE: CVE-2024-9940
Published: 2024-10-17
Description: The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. This is due to the plugin not properly neutralizing HTML elements from submitted forms. This makes it possible for unauthenticated attackers to inject arbitrary HTML that will render when the administrator views form submissions in their email.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-75, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3168950%40calculated-fields-form&new=3168950%40calculated-fields-form&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/e2c9f6a5-8698-4452-bf0a-c1d796b2fdad?source=cve
CVE: CVE-2024-49593
Published: 2024-10-17
Description: In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor to edit one of the plugin's fields can result in execution of a stored XSS payload. NOTE: if you wish to use the WP Engine alternative update mechanism for the free version of ACF, then you can follow the process shown at the advancedcustomfields.com blog URL within the References section below.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/advanced-custom-fields/#developers; https://www.advancedcustomfields.com/blog/installing-and-upgrading-to-the-latest-version-of-acf/; https://www.advancedcustomfields.com/changelog/
CVE: CVE-2024-7417
Published: 2024-10-17
Description: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.986 via the data_fetch. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract data from password protected posts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.3.985/classes/modules/wpr-ajax-search.php#L21; https://plugins.trac.wordpress.org/changeset/3162784/royal-elementor-addons/tags/1.3.987/classes/modules/wpr-ajax-search.php?old=3141814&old_path=royal-elementor-addons%2Ftags%2F1.3.985%2Fclasses%2Fmodules%2Fwpr-ajax-search.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/c3dfb0b7-5d9f-492b-9a1a-d4445d39c00c?source=cve
CVE: CVE-2024-8719
Published: 2024-10-17
Description: The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters like 'MaxBeds' and 'MinBeds' in all versions up to, and including, 3.14.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3169439%40flexmls-idx&new=3169439%40flexmls-idx&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/aac3fb8e-9b92-4ed1-ac9f-50870d4c5c9f?source=cve
CVE: CVE-2024-9263
Published: 2024-10-17
Description: The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to Account Takeover/Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 1.0.25 via the save() due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to reset the emails and passwords of arbitrary user accounts, including administrators, which makes account takeover and privilege escalation possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/timetics/tags/1.0.25/core/customers/customer.php#L299; https://plugins.trac.wordpress.org/changeset/3169771/timetics/trunk/core/customers/api-customer.php; https://plugins.trac.wordpress.org/changeset/3169771/timetics/trunk/core/customers/customer.php
CVE: CVE-2024-9347
Published: 2024-10-17
Description: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpext-export' parameter in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Please note this fix was reverted in version 3.0.11 and later fixed again in version 3.0.13.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wpextended/tags/3.0.9/includes/libraries/wpext_export/wpext_export.php#L209; https://plugins.trac.wordpress.org/changeset/3169963/wpextended/trunk/includes/libraries/wpext_export/wpext_export.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3220003%40wpextended&new=3220003%40wpextended&sfp_email=&sfph_mail=
CVE: CVE-2024-5429
Published: 2024-10-17
Description: The Logo Slider  WordPress plugin before 4.1.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ddb76c88-aeca-42df-830e-abffd29f1141/
CVE: CVE-2024-9351
Published: 2024-10-17
Description: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the quiz 'create_module' function. This makes it possible for unauthenticated attackers to create draft quizzes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/forminator/tags/1.35.0/library/modules/quizzes/admin/admin-loader.php#L719; https://plugins.trac.wordpress.org/changeset/3169243/; https://www.wordfence.com/threat-intel/vulnerabilities/id/8d89e3b7-d980-42bb-ab0c-d86ab174a69c?source=cve
CVE: CVE-2024-9352
Published: 2024-10-17
Description: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the custom form 'create_module' function. This makes it possible for unauthenticated attackers to create draft forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/forminator/tags/1.35.0/library/modules/custom-forms/admin/admin-loader.php#L418; https://plugins.trac.wordpress.org/changeset/3169243/; https://www.wordfence.com/threat-intel/vulnerabilities/id/81e6e266-078a-4f4f-a335-c9d388f41ef2?source=cve
CVE: CVE-2024-9213
Published: 2024-10-17
Description: The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.0.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/persian-woocommerce-sms/tags/7.0.2/src/Subscribe/Contacts.php#L290; https://plugins.trac.wordpress.org/browser/persian-woocommerce-sms/tags/7.0.2/src/Subscribe/Contacts.php#L412; https://plugins.trac.wordpress.org/browser/persian-woocommerce-sms/tags/7.0.2/src/Subscribe/Contacts.php#L527
CVE: CVE-2024-3184
Published: 2024-10-17
Description: Multiple CWE-476 NULL Pointer Dereference vulnerabilities were found in GoAhead Web Server up to version 6.0.0 when compiled with the ME_GOAHEAD_REPLACE_MALLOC flag. Without a memory notifier for allocation failures, remote attackers can exploit these vulnerabilities by sending malicious requests, leading to a crash and Denial of Service (DoS).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-3184
CVE: CVE-2024-3186
Published: 2024-10-17
Description: CWE-476 NULL Pointer Dereference vulnerability in the evalExpr() function of GoAhead Web Server (version <= 6.0.0) when compiled with the ME_GOAHEAD_JAVASCRIPT flag. This vulnerability allows a remote attacker with the privileges to modify JavaScript template (JST) files to trigger a crash and cause a Denial of Service (DoS) by providing malicious templates.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-3186
CVE: CVE-2024-3187
Published: 2024-10-17
Description: This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6.0.0. These are caused by JST values not being nulled when freed during parsing of JST templates. If the ME_GOAHEAD_JAVASCRIPT flag is enabled, a remote attacker with the privileges to modify JavaScript template (JST) files could exploit this by providing malicious templates. This may lead to memory corruption, potentially causing a Denial of Service (DoS) or, in rare cases, code execution, though the latter is highly context-dependent.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-415, CWE-416
References: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-3187
CVE: CVE-2024-9951
Published: 2024-10-17
Description: The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wppa-tab' parameter in all versions up to, and including, 8.8.05.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3170202%40wp-photo-album-plus&new=3170202%40wp-photo-album-plus&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/3a4f0c06-db88-4950-b1f5-b2aab480c974?source=cve
CVE: CVE-2024-10025
Published: 2024-10-17
Description: A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaintext credentials, an attacker can log into affected SICK products as an “Authorized Client” if the customer has not changed the default password.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-798
References: https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF; https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
CVE: CVE-2024-49386
Published: 2024-10-17
Description: Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-359
References: https://security-advisory.acronis.com/advisories/SEC-5129
CVE: CVE-2024-49389
Published: 2024-10-17
Description: Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://security-advisory.acronis.com/advisories/SEC-5319
CVE: CVE-2024-49390
Published: 2024-10-17
Description: Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://security-advisory.acronis.com/advisories/SEC-5845
CVE: CVE-2024-49391
Published: 2024-10-17
Description: Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://security-advisory.acronis.com/advisories/SEC-7220
CVE: CVE-2024-49392
Published: 2024-10-17
Description: Stored cross-site scripting (XSS) vulnerability on enrollment invitation page. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://security-advisory.acronis.com/advisories/SEC-7554
CVE: CVE-2024-8920
Published: 2024-10-17
Description: The Fonto – Custom Web Fonts Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/fonto/trunk/includes/class-fonto.php#L373; https://plugins.trac.wordpress.org/changeset/3169936/; https://plugins.trac.wordpress.org/changeset/3169936/#file2
CVE: CVE-2024-9184
Published: 2024-10-17
Description: The SendPulse Free Web Push plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.6 due to incorrect use of the wp_kses_allowed_html function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/sendpulse-web-push/trunk/settings.php#L10; https://plugins.trac.wordpress.org/changeset/3169899/; https://wordpress.org/plugins/sendpulse-web-push/#developers
CVE: CVE-2024-10068
Published: 2024-10-17
Description: A vulnerability was found in OpenSight Software FlashFXP 5.4.0.3970. It has been classified as critical. Affected is an unknown function in the library libcrypto-1_1.dll of the file FlashFXP.exe. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://vuldb.com/?ctiid.280716; https://vuldb.com/?id.280716; https://vuldb.com/?submit.419684
CVE: CVE-2024-45713
Published: 2024-10-17
Description: SolarWinds Kiwi CatTools is susceptible to a sensitive data disclosure vulnerability when a non-default setting has been enabled for troubleshooting purposes.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-209
References: https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45713
CVE: CVE-2024-9898
Published: 2024-10-17
Description: The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dd-parallax shortcode in all versions up to, and including, 1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/parallax-image/trunk/assets/shortcode.php#L145; https://plugins.trac.wordpress.org/changeset/3170176/; https://plugins.trac.wordpress.org/changeset/3170176/#file16
CVE: CVE-2024-48024
Published: 2024-10-17
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Fahad Mahmood Keep Backup Daily keep-backup-daily allows Retrieve Embedded Sensitive Data.This issue affects Keep Backup Daily: from n/a through <= 2.1.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/keep-backup-daily/vulnerability/wordpress-keep-backup-daily-plugin-2-0-7-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-48038
Published: 2024-10-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in tuxlog wp-Monalisa wp-monalisa.This issue affects wp-Monalisa: from n/a through <= 6.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-monalisa/vulnerability/wordpress-wp-monalisa-plugin-6-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-48043
Published: 2024-10-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Blind SQL Injection.This issue affects ShortPixel Image Optimizer: from n/a through <= 5.6.3.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/shortpixel-image-optimiser/vulnerability/wordpress-shortpixel-image-optimizer-plugin-5-6-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-48047
Published: 2024-10-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in Razon Komar Pal Linked Variation for WooCommerce linked-variation-for-woocommerce allows Cross Site Request Forgery.This issue affects Linked Variation for WooCommerce: from n/a through <= 1.0.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/linked-variation-for-woocommerce/vulnerability/wordpress-linked-variation-for-woocommerce-plugin-1-0-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve