deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-44016
Published: 2024-10-05
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in amarksteadman Podiant podiant allows PHP Local File Inclusion.This issue affects Podiant: from n/a through <= 1.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/podiant/vulnerability/wordpress-podiant-plugin-1-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-9146
Published: 2024-10-05
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in jamesdlow CSS JS Files css-js-files allows Path Traversal.This issue affects CSS JS Files: from n/a through <= 1.5.0.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/css-js-files/vulnerability/wordpress-css-js-files-plugin-1-5-0-directory-traversal-to-file-read-vulnerability?_s_id=cve
CVE: CVE-2024-9161
Published: 2024-10-05
Description: The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'update_metadata' function in all versions up to, and including, 1.0.228. This makes it possible for unauthenticated attackers to insert new and update existing metadata beginning with 'rank_math', and delete arbitrary existing user metadata and term metadata. Deleting existing usermeta can cause a loss of access to the administrator dashboard for any registered users, including Administrators.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/rest/class-shared.php#L120; https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/rest/class-shared.php#L161; https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/rest/class-shared.php#L162
CVE: CVE-2024-9314
Published: 2024-10-05
Description: The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.228 via deserialization of untrusted input 'set_redirections' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/admin/class-import-export.php#L507; https://plugins.trac.wordpress.org/browser/seo-by-rank-math/trunk/includes/admin/class-import-export.php#L514; https://plugins.trac.wordpress.org/changeset/3161896/
CVE: CVE-2024-44018
Published: 2024-10-05
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in istmoplugins Instant Chat Floating Button for WordPress Websites instant-chat-wp allows PHP Local File Inclusion.This issue affects Instant Chat Floating Button for WordPress Websites: from n/a through <= 1.0.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/instant-chat-wp/vulnerability/wordpress-instant-chat-wp-plugin-1-0-5-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-44023
Published: 2024-10-05
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in abcapp ABCApp Creator abcapp-creator.This issue affects ABCApp Creator: from n/a through <= 1.1.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/abcapp-creator/vulnerability/wordpress-abcapp-creator-plugin-1-1-2-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-44034
Published: 2024-10-05
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Martin Greenwood WPSPX wpspx allows PHP Local File Inclusion.This issue affects WPSPX: from n/a through <= 1.0.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/wpspx/vulnerability/wordpress-wpspx-plugin-1-0-2-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-47309
Published: 2024-10-05
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Condless Cities Shipping Zones for WooCommerce cities-shipping-zones-for-woocommerce allows PHP Local File Inclusion.This issue affects Cities Shipping Zones for WooCommerce: from n/a through <= 1.2.7.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/cities-shipping-zones-for-woocommerce/vulnerability/wordpress-cities-shipping-zones-for-woocommerce-plugin-1-2-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-47316
Published: 2024-10-05
Description: Authorization Bypass Through User-Controlled Key vulnerability in Dimitri Grassi Salon booking system salon-booking-system.This issue affects Salon booking system: from n/a through <= 10.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/Wordpress/Plugin/salon-booking-system/vulnerability/wordpress-salon-booking-wordpress-plugin-plugin-10-9-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2024-47319
Published: 2024-10-05
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form bit-form.This issue affects Bit Form: from n/a through <= 2.13.10.
CVSS Score: 8.0 (HIGH)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/bit-form/vulnerability/wordpress-bit-form-plugin-2-13-10-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-47323
Published: 2024-10-05
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n/a through <= 3.6.7.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/wp-timelines/vulnerability/wordpress-wp-timeline-plugin-3-6-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2024-47324
Published: 2024-10-05
Description: Path Traversal: '.../...//' vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n/a through <= 3.6.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Plugin/wp-timelines/vulnerability/wordpress-wp-timeline-plugin-3-6-7-local-file-inclusion-vulnerability-2?_s_id=cve
CVE: CVE-2024-47631
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Logo Carousel – Clients logo carousel for WP responsive-client-logo-carousel-slider allows Stored XSS.This issue affects Logo Carousel – Clients logo carousel for WP: from n/a through <= 1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/responsive-client-logo-carousel-slider/vulnerability/wordpress-logo-carousel-clients-logo-carousel-for-wp-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47632
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Detheme DethemeKit For Elementor dethemekit-for-elementor allows Stored XSS.This issue affects DethemeKit For Elementor: from n/a through <= 2.1.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/dethemekit-for-elementor/vulnerability/wordpress-dethemekit-for-elementor-plugin-2-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47633
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Forms Zoho Forms zoho-forms allows Stored XSS.This issue affects Zoho Forms: from n/a through <= 4.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/zoho-forms/vulnerability/wordpress-zoho-forms-plugin-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47635
Published: 2024-10-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in TinyPNG TinyPNG tiny-compress-images allows Cross Site Request Forgery.This issue affects TinyPNG: from n/a through <= 3.4.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/tiny-compress-images/vulnerability/wordpress-tinypng-plugin-3-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-47638
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Reflected XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.4.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/meeting-scheduler-by-vcita/vulnerability/wordpress-online-booking-scheduling-calendar-for-wordpress-plugin-4-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47639
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vibhav Sinha VdoCipher vdocipher allows Stored XSS.This issue affects VdoCipher: from n/a through <= 1.29.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/vdocipher/vulnerability/wordpress-vdocipher-plugin-1-29-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47642
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Keap Keap Official Opt-in Forms infusionsoft-official-opt-in-forms allows Stored XSS.This issue affects Keap Official Opt-in Forms: from n/a through <= 2.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/infusionsoft-official-opt-in-forms/vulnerability/wordpress-keap-official-opt-in-forms-plugin-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47643
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Include Fussball.de Widgets include-fussball-de-widgets allows Stored XSS.This issue affects Include Fussball.de Widgets: from n/a through <= 4.0.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/include-fussball-de-widgets/vulnerability/wordpress-include-fussball-de-widgets-plugin-4-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47644
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Copyscape Copyscape Premium copyscape-premium allows Stored XSS.This issue affects Copyscape Premium: from n/a through <= 1.3.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/copyscape-premium/vulnerability/wordpress-copyscape-premium-plugin-1-3-6-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve
CVE: CVE-2024-47646
Published: 2024-10-05
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in tomlister Payflex Payment Gateway payflex-payment-gateway.This issue affects Payflex Payment Gateway: from n/a through <= 2.6.1.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/payflex-payment-gateway/vulnerability/wordpress-payflex-payment-gateway-plugin-2-6-1-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2024-47647
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Essekia Helpie FAQ helpie-faq allows Stored XSS.This issue affects Helpie FAQ: from n/a through <= 1.27.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/helpie-faq/vulnerability/wordpress-faq-accordion-docs-helpie-wordpress-faq-accordion-plugin-plugin-1-27-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-9533
Published: 2024-10-05
Description: A vulnerability was found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This issue affects the function formDeviceReboot of the file /goform/formDeviceReboot. The manipulation of the argument next_page leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formDeviceReboot.md; https://vuldb.com/?ctiid.279239; https://vuldb.com/?id.279239
CVE: CVE-2024-47625
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelooks Enter Addons enteraddons allows Stored XSS.This issue affects Enter Addons: from n/a through <= 2.1.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/enteraddons/vulnerability/wordpress-enter-addons-ultimate-template-builder-for-elementor-plugin-2-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47626
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rometheme RTMKit rometheme-for-elementor allows Stored XSS.This issue affects RTMKit: from n/a through <= 1.5.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/rometheme-for-elementor/vulnerability/wordpress-romethemekit-for-elementor-plugin-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47627
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel WP Travel Gutenberg Blocks wp-travel-blocks allows Stored XSS.This issue affects WP Travel Gutenberg Blocks: from n/a through <= 3.6.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-travel-blocks/vulnerability/wordpress-wp-travel-gutenberg-blocks-plugin-3-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47628
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through <= 1.3.9.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/lastudio-element-kit/vulnerability/wordpress-la-studio-element-kit-for-elementor-plugin-1-3-9-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47629
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.0.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-store-kit/vulnerability/wordpress-ultimate-store-kit-elementor-addons-plugin-2-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47630
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Stored XSS.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.2.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/elementinvader-addons-for-elementor/vulnerability/wordpress-elementinvader-addons-for-elementor-plugin-1-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-9534
Published: 2024-10-05
Description: A vulnerability was found in D-Link DIR-605L 2.13B01 BETA. It has been classified as critical. Affected is the function formEasySetPassword of the file /goform/formEasySetPassword. The manipulation of the argument curTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formEasySetPassword.md; https://vuldb.com/?ctiid.279240; https://vuldb.com/?id.279240
CVE: CVE-2024-9535
Published: 2024-10-05
Description: A vulnerability was found in D-Link DIR-605L 2.13B01 BETA. It has been declared as critical. Affected by this vulnerability is the function formEasySetupWWConfig of the file /goform/formEasySetupWWConfig. The manipulation of the argument curTime leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formEasySetupWWConfig.md; https://vuldb.com/?ctiid.279241; https://vuldb.com/?id.279241
CVE: CVE-2024-47378
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lomu WPCOM Member wpcom-member allows Reflected XSS.This issue affects WPCOM Member: from n/a through <= 1.5.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpcom-member/vulnerability/wordpress-wpcom-member-plugin-1-5-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47379
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows Reflected XSS.This issue affects Web Directory Free: from n/a through <= 1.7.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/web-directory-free/vulnerability/wordpress-web-directory-free-plugin-1-7-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47380
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay allows Reflected XSS.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.6.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-lister-for-ebay/vulnerability/wordpress-wp-lister-lite-for-ebay-plugin-3-6-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47381
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in averta Depicter Slider depicter allows Stored XSS.This issue affects Depicter Slider: from n/a through <= 3.2.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/depicter/vulnerability/wordpress-slider-popup-builder-by-depicter-add-image-slider-carousel-slider-exit-intent-popup-popup-modal-coupon-popup-post-slider-carousel-plugin-3-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47382
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Page-list page-list allows Stored XSS.This issue affects Page-list: from n/a through <= 5.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/page-list/vulnerability/wordpress-page-list-plugin-5-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47383
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue affects The Pack Elementor addons: from n/a through <= 2.0.8.8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/the-pack-addon/vulnerability/wordpress-the-pack-elementor-addons-plugin-2-0-8-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47384
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Reflected XSS.This issue affects WP Compress: from n/a through <= 6.20.13.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-compress-image-optimizer/vulnerability/wordpress-wp-compress-plugin-6-20-13-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47385
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Stored XSS.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.8.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/essential-blocks/vulnerability/wordpress-essential-blocks-page-builder-gutenberg-blocks-patterns-templates-plugin-4-8-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47386
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Reflected XSS.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through <= 3.0.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpextended/vulnerability/wordpress-wp-extended-plugin-3-0-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47387
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Search Atlas Group Search Atlas SEO metasync allows Stored XSS.This issue affects Search Atlas SEO: from n/a through <= 1.8.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/metasync/vulnerability/wordpress-search-atlas-seo-plugin-1-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47388
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP slicewp allows Reflected XSS.This issue affects SliceWP: from n/a through <= 1.1.18.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/slicewp/vulnerability/wordpress-slicewp-affiliates-plugin-1-1-18-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-47389
Published: 2024-10-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through <= 8.7.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/nex-forms-express-wp-form-builder/vulnerability/wordpress-nex-forms-plugin-8-7-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve