deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-36116
Published: 2024-06-19
Description: Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite provides support for JavaDocs files, which are archives that contain documentation for artifacts. Specifically, JavadocEndpoints.kt controller allows to expand the javadoc archive into the server's file system and return its content. The problem is in the way how the archives are expanded, specifically how the new filename is created. The `file.name` taken from the archive can contain path traversal characters, such as '/../../../anything.txt', so the resulting extraction path can be outside the target directory. If the archive is taken from an untrusted source, such as Maven Central or JitPack for example, an attacker can craft a special archive to overwrite any local file on Reposilite instance. This could lead to remote code execution, for example by placing a new plugin into the '$workspace$/plugins' directory. Alternatively, an attacker can overwrite the content of any other package. Note that the attacker can use its own malicious package from Maven Central to overwrite any other package on Reposilite. Reposilite has addressed this issue in version 3.5.12. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-073.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/dzikoysk/reposilite/commit/848173738e4375482c70365db5cebae29f125eaa; https://github.com/dzikoysk/reposilite/releases/tag/3.5.12; https://github.com/dzikoysk/reposilite/security/advisories/GHSA-frvj-cfq4-3228
CVE: CVE-2024-36117
Published: 2024-06-19
Description: Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version 3.5.12. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-074.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://github.com/dzikoysk/reposilite/commit/e172ae4b539c822d0d6e04cf090713c7202a79d6; https://github.com/dzikoysk/reposilite/releases/tag/3.5.12; https://github.com/dzikoysk/reposilite/security/advisories/GHSA-82j3-hf72-7x93
CVE: CVE-2024-38352
Published: 2024-06-19
Description: Rejected reason: CVE was assigned in error.
CVE: CVE-2024-34993
Published: 2024-06-19
Description: In the module "Bulk Export products to Google Merchant-Google Shopping" (bagoogleshopping) up to version 1.0.26 from Buy Addons for PrestaShop, a guest can perform SQL injection via`GenerateCategories::renderCategories().
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-06-18-bagoogleshopping.md; https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-06-18-bagoogleshopping.md
CVE: CVE-2024-38355
Published: 2024-06-19
Description: Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.

CVSS Score: 7.3 (HIGH)
CWE: CWE-20, CWE-754
References: https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f[PII_REDACTED]5; https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c; https://github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj
CVE: CVE-2024-38356
Published: 2024-06-19
Description: TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the `noneditable_regexp` option, specially crafted HTML attributes containing malicious code were able to be executed when content was extracted from the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that, when using the `noneditable_regexp` option, any content within an attribute is properly verified to match the configured regular expression before being added. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/tinymce/tinymce/commit/5acb741665a98e83d62b91713c800abbff43b00d; https://github.com/tinymce/tinymce/security/advisories/GHSA-9hcv-j9pv-qmph; https://owasp.org/www-community/attacks/xss
CVE: CVE-2024-38357
Published: 2024-06-19
Description: TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when that content was loaded into the editor. This vulnerability has been patched in TinyMCE 7.2.0, TinyMCE 6.8.4 and TinyMCE 5.11.0 LTS by ensuring that content within noscript elements are properly parsed. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/tinymce/tinymce/commit/5acb741665a98e83d62b91713c800abbff43b00d; https://github.com/tinymce/tinymce/security/advisories/GHSA-w9jx-4g6g-rp7x; https://owasp.org/www-community/attacks/xss
CVE: CVE-2024-38358
Published: 2024-06-19
Description: Wasmer is a web assembly (wasm) Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both `oflags::creat` and `rights::fd_write`. Programs can also crash the runtime by creating a symlink pointing outside with `path_symlink` and `path_open`ing the link. This issue has been addressed in commit `b9483d022` which has been included in release version 4.3.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 2.9 (LOW)
CWE: CWE-22
References: https://github.com/wasmerio/wasmer/commit/b9483d022c602b994103f78ecfe46f017f8ac662; https://github.com/wasmerio/wasmer/security/advisories/GHSA-55f3-3qvg-8pv5; https://github.com/wasmerio/wasmer/commit/b9483d022c602b994103f78ecfe46f017f8ac662
CVE: CVE-2024-33836
Published: 2024-06-19
Description: In the module "JA Marketplace" (jamarketplace) up to version 9.0.1 from JA Module for PrestaShop, a guest can upload files with extensions .php. In version 6.X, the method `JmarketplaceproductModuleFrontController::init()` and in version 8.X, the method `JmarketplaceSellerproductModuleFrontController::init()` allow upload of .php files, which will lead to a critical vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-06-18-jamarketplace.md; https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-06-18-jamarketplace.md
CVE: CVE-2024-34990
Published: 2024-06-19
Description: In the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop, a customer can upload .php files. Methods `HelpdeskHelpdeskModuleFrontController::submitTicket()` and `HelpdeskHelpdeskModuleFrontController::replyTicket()` allow upload of .php files on a predictable path for connected customers.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-06-18-helpdesk.md; https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-06-18-helpdesk.md
CVE: CVE-2024-34994
Published: 2024-06-19
Description: In the module "Channable" (channable) up to version 3.2.1 from Channable for PrestaShop, a guest can perform SQL injection via `ChannableFeedModuleFrontController::postProcess()`.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-06-18-channable.md; https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-06-18-channable.md
CVE: CVE-2024-36677
Published: 2024-06-19
Description: In the module "Login as customer PRO" (loginascustomerpro) <1.2.7 from Weblir for PrestaShop, a guest can access direct link to connect to each customer account of the Shop if the module is not installed OR if a secret accessible to administrator is stolen.
CVSS Score: 7.5 (HIGH)
CWE: CWE-359
References: https://security.friendsofpresta.org/modules/2024/06/18/loginascustomerpro.html; https://security.friendsofpresta.org/modules/2024/06/18/loginascustomerpro.html
CVE: CVE-2024-36678
Published: 2024-06-19
Description: In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The script ajax.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://security.friendsofpresta.org/modules/2024/06/18/pk_themesettings.html; https://security.friendsofpresta.org/modules/2024/06/18/pk_themesettings.html
CVE: CVE-2024-36679
Published: 2024-06-19
Description: In the module "Module Live Chat Pro (All in One Messaging)" (livechatpro) <=8.4.0, a guest can perform PHP Code injection. Due to a predictable token, the method `Lcp::saveTranslations()` suffer of a white writer that can inject PHP code into a PHP file.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://security.friendsofpresta.org/modules/2024/06/18/livechatpro.html; https://security.friendsofpresta.org/modules/2024/06/18/livechatpro.html
CVE: CVE-2024-36680
Published: 2024-06-19
Description: In the module "Facebook" (pkfacebook) <=1.0.1 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The ajax script facebookConnect.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://security.friendsofpresta.org/modules/2024/06/18/pkfacebook.html; https://security.friendsofpresta.org/modules/2024/06/18/pkfacebook.html
CVE: CVE-2024-36684
Published: 2024-06-19
Description: In the module "Custom links" (pk_customlinks) <= 2.3 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The script ajax.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://security.friendsofpresta.org/modules/2024/06/18/pk_customlinks.html; https://security.friendsofpresta.org/modules/2024/06/18/pk_customlinks.html
CVE: CVE-2024-5182
Published: 2024-06-20
Description: A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the `model` parameter during the model deletion process to delete arbitrary files. Specifically, by crafting a request with a manipulated `model` parameter, an attacker can traverse the directory structure and target files outside of the intended directory, leading to the deletion of sensitive data. This vulnerability is due to insufficient input validation and sanitization of the `model` parameter.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/mudler/localai/commit/1a3dedece06cab1acc3332055d285ac540a47f0e; https://huntr.com/bounties/f7a87f29-c22a-48e8-9fce-b6d5a273e545; https://github.com/mudler/localai/commit/1a3dedece06cab1acc3332055d285ac540a47f0e
CVE: CVE-2024-6100
Published: 2024-06-20
Description: Type Confusion in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843, CWE-843
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_18.html; https://issues.chromium.org/issues/344608204; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP/
CVE: CVE-2024-6101
Published: 2024-06-20
Description: Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-358
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_18.html; https://issues.chromium.org/issues/343748812; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP/
CVE: CVE-2024-6102
Published: 2024-06-20
Description: Out of bounds memory access in Dawn in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-125
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_18.html; https://issues.chromium.org/issues/339169163; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP/
CVE: CVE-2024-6103
Published: 2024-06-20
Description: Use after free in Dawn in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_18.html; https://issues.chromium.org/issues/344639860; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP/
CVE: CVE-2024-6176
Published: 2024-06-20
Description: Allocation of Resources Without Limits or Throttling vulnerability in LG Electronics LG SuperSign CMS allows Port Scanning.This issue affects LG SuperSign CMS: from 4.1.3 before < 4.3.1.
CWE: CWE-770
References: https://lgsecurity.lge.com/bulletins/idproducts#updateDetails; https://lgsecurity.lge.com/bulletins/idproducts#updateDetails
CVE: CVE-2023-3204
Published: 2024-06-20
Description: The Materialis theme for WordPress is vulnerable to limited arbitrary options updates in versions up to, and including, 1.1.24. This is due to missing authorization checks on the companion_disable_popup() function called via an AJAX action. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to modify any option on the site to a numerical value.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://themes.trac.wordpress.org/browser/materialis/1.1.20/inc/companion.php#L45; https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=231816%40materialis&new=231816%40materialis&sfp_email=&sfph_mail=#file6; https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e05094-8344-4388-a703-518daf3d2948?source=cve
CVE: CVE-2024-1168
Published: 2024-06-20
Description: The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's social image URL in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping on user supplied image URLs. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3105305%40wp-seopress&new=3105305%40wp-seopress&sfp_email=&sfph_mail=; https://wordpress.org/plugins/wp-seopress/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/c446f429-1981-4d6d-a5ec-a5837428d212?source=cve
CVE: CVE-2024-3558
Published: 2024-06-20
Description: The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfs[post_title]' parameter versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://core.trac.wordpress.org/ticket/56655; https://en-gb.wordpress.org/plugins/custom-field-suite/; https://github.com/WordPress/WordPress/blob/22d95abc55824e83904dc0fef290464b6bec7708/wp-admin/includes/template.php#L1384
CVE: CVE-2024-3561
Published: 2024-06-20
Description: The Custom Field Suite plugin for WordPress is vulnerable to SQL Injection via the the 'Term' custom field in all versions up to, and including, 2.6.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://en-gb.wordpress.org/plugins/custom-field-suite/; https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/fields/term.php#L58; https://mgibbs189.github.io/custom-field-suite/field-types/term.html
CVE: CVE-2024-3562
Published: 2024-06-20
Description: The Custom Field Suite plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.6.7 via the Loop custom field. This is due to insufficient sanitization of input prior to being used in a call to the eval() function. This makes it possible for authenticated attackers, with contributor-level access and above, to execute arbitrary PHP code on the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-95, CWE-94
References: https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/fields/loop.php#L192; https://github.com/mgibbs189/custom-field-suite/blob/963dfcede18ff4ad697498556d9058db07d74fa3/includes/fields/loop.php#L224; https://mgibbs189.github.io/custom-field-suite/field-types/loop.html
CVE: CVE-2024-3597
Published: 2024-06-20
Description: The Export WP Page to Static HTML/CSS plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.2.2. This is due to insufficient validation on the redirect url supplied via the rc_exported_zip_file parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
CVSS Score: 7.1 (HIGH)
CWE: CWE-601, CWE-601
References: https://plugins.trac.wordpress.org/browser/export-wp-page-to-static-html/trunk/admin/class-export-wp-page-to-static-html-admin.php#L1289; https://plugins.trac.wordpress.org/changeset/3110378/; https://www.wordfence.com/threat-intel/vulnerabilities/id/598e2c2e-7dd5-435e-a366-6c7569243f2a?source=cve
CVE: CVE-2024-3602
Published: 2024-06-20
Description: The Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the disconnect_promolayer function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with subscriber access or higher, to remove the Promolayer connection.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/promolayer-popup-builder/trunk/admin/class-promolayer-admin.php#L208; https://plugins.trac.wordpress.org/changeset/3105496; https://www.wordfence.com/threat-intel/vulnerabilities/id/05b051bc-3b1c-412e-b3d0-98ff2c8bc06e?source=cve
CVE: CVE-2024-3605
Published: 2024-06-20
Description: The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to, and including, 2.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3105864%40wp-hotel-booking&new=3105864%40wp-hotel-booking&sfp_email=&sfph_mail=; https://wordpress.org/plugins/wp-hotel-booking/; https://www.wordfence.com/threat-intel/vulnerabilities/id/5931ad4e-7de3-41ac-b783-f7e58aaef569?source=cve
CVE: CVE-2024-3627
Published: 2024-06-20
Description: The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in the AjaxFunctions.php file in all versions up to, and including, 1.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts and modify settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/wheel-of-life/trunk/includes/functions/AjaxFunctions.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3107222%40wheel-of-life&new=3107222%40wheel-of-life&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/0615d1be-f9fa-45b3-9d5b-3ad1f36be8e1?source=cve
CVE: CVE-2024-4626
Published: 2024-06-20
Description: The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_type’ and 'id' parameters in all versions up to, and including, 1.0.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3103042/jetwidgets-for-elementor/tags/1.0.18/includes/addons/jet-widgets-image-comparison.php; https://plugins.trac.wordpress.org/changeset/3103042/jetwidgets-for-elementor/tags/1.0.18/includes/addons/jet-widgets-images-layout.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/4457d15e-2c01-498d-b94a-a6e93adcf70c?source=cve
CVE: CVE-2024-4742
Published: 2024-06-20
Description: The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the order_by shortcode attribute in all versions up to, and including, 1.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/changeset/3105489/youzify/trunk/includes/public/core/functions/youzify-account-verification-functions.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/08bd24ca-eec6-4b62-af49-192496e65a5b?source=cve; https://plugins.trac.wordpress.org/browser/youzify/trunk/includes/public/core/functions/youzify-account-verification-functions.php#L294