deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-9382
Published: 2024-10-18
Description: The Gantry 4 Framework plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'override_id' parameter in all versions up to, and including, 4.1.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/gantry/trunk/admin_functions.php#L677; https://www.wordfence.com/threat-intel/vulnerabilities/id/d539a066-6b59-4235-868e-f3085436e9f4?source=cve
CVE: CVE-2024-9383
Published: 2024-10-18
Description: The Parcel Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 1.8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/woo-parcel-pro/trunk/admin/class-parcelpro-admin.php#L274; https://plugins.trac.wordpress.org/changeset/3174370/woo-parcel-pro/trunk/admin/class-parcelpro-admin.php?contextall=1; https://www.wordfence.com/threat-intel/vulnerabilities/id/8e8fe6f4-7e41-44d3-9980-b5e7f43aa849?source=cve
CVE: CVE-2024-9452
Published: 2024-10-18
Description: The Branding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/branding/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/8736cf81-3fb8-4c81-a878-7d73a3e68fc2?source=cve
CVE: CVE-2024-9848
Published: 2024-10-18
Description: The Product Customizer Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/product-customizer-light/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/18d1feee-347c-4f43-a01b-67b3d0a5b2d6?source=cve
CVE: CVE-2024-9892
Published: 2024-10-18
Description: The Add Widget After Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/add-widget-after-content/trunk/add-widget-after-content-admin.php#L320; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3170427%40add-widget-after-content&new=3170427%40add-widget-after-content&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3170428%40add-widget-after-content&new=3170428%40add-widget-after-content&sfp_email=&sfph_mail=
CVE: CVE-2024-38820
Published: 2024-10-18
Description: The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.
CVSS Score: 3.1 (LOW)
CWE: CWE-178
References: https://spring.io/security/cve-2024-38820; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-46897
Published: 2024-10-18
Description: Incorrect permission assignment for critical resource issue exists in Exment v6.1.4 and earlier and Exment v5.0.11 and earlier. A logged-in user with the permission of table management may obtain and/or alter the information of the unauthorized table.
CVSS Score: 3.8 (LOW)
CWE: CWE-732, CWE-732
References: https://exment.net/docs/#/weakness/20241010_2; https://exment.net/vulnerability-correspondence-version-6-1-5-and-5-0-12-released/; https://jvn.jp/en/jp/JVN74538317/
CVE: CVE-2024-47793
Published: 2024-10-18
Description: Stored cross-site scripting vulnerability exists in Exment v6.1.4 and earlier and Exment v5.0.11 and earlier. When accessing the edit screen containing custom columns (column type: images or files), an arbitrary script may be executed on the web browser of the user.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://exment.net/docs/#/weakness/20241010; https://exment.net/vulnerability-correspondence-version-6-1-5-and-5-0-12-released/; https://jvn.jp/en/jp/JVN74538317/
CVE: CVE-2024-9206
Published: 2024-10-18
Description: The MAS Companies For WP Job Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.13. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/mas-wp-job-manager-company/tags/1.0.13/templates/company-dashboard.php#L99; https://plugins.trac.wordpress.org/changeset/3170459/; https://www.wordfence.com/threat-intel/vulnerabilities/id/dc277e7c-86ec-448f-a91e-e4d12a4b4177?source=cve
CVE: CVE-2024-9703
Published: 2024-10-18
Description: The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3170741%40arconix-shortcodes&new=3170741%40arconix-shortcodes&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ef395956-477c-4970-becd-4f437e4807a3?source=cve
CVE: CVE-2023-49567
Published: 2024-10-18
Description: A vulnerability has been identified in the Bitdefender Total Security HTTPS scanning functionality where the product incorrectly checks the site's certificate, which allows an attacker to make MITM SSL connections to an arbitrary site. The product trusts certificates that are issued using the MD5 and SHA1 collision hash functions which allow attackers to create rogue certificates that appear legitimate.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-295
References: https://www.bitdefender.com/support/security-advisories/insecure-trust-of-certificates-using-collision-hash-functions-in-bitdefender-total-security-https-scanning-va-11239/
CVE: CVE-2023-6055
Published: 2024-10-18
Description: A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software fails to properly validate website certificates. Specifically, if a site certificate lacks the "Server Authentication" specification in the Extended Key Usage extension, the product does not verify the certificate's compliance with the site, deeming such certificates as valid. This flaw could allow an attacker to perform a Man-in-the-Middle (MITM) attack, intercepting and potentially altering communications between the user and the website.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://bitdefender.com/support/security-advisories/improper-certificate-validation-in-bitdefender-total-security-https-scanning-va-11158/
CVE: CVE-2023-6056
Published: 2024-10-18
Description: A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of self-signed certificates. The product is found to trust certificates signed with the RIPEMD-160 hashing algorithm without proper validation, allowing an attacker to establish MITM SSL connections to arbitrary sites.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://www.bitdefender.com/support/security-advisories/insecure-trust-of-self-signed-certificates-in-bitdefender-total-security-https-scanning-va-11164/
CVE: CVE-2023-6057
Published: 2024-10-18
Description: A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of certificates issued using the DSA signature algorithm. The product does not properly check the certificate chain, allowing an attacker to establish MITM SSL connections to arbitrary sites using a DSA-signed certificate.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://www.bitdefender.com/support/security-advisories/insecure-trust-of-dsa-signed-certificates-in-bitdefender-total-security-https-scanning-va-11166/
CVE: CVE-2023-6058
Published: 2024-10-18
Description: A vulnerability has been identified in Bitdefender Safepay's handling of HTTPS connections. The issue arises when the product blocks a connection due to an untrusted server certificate but allows the user to add the site to exceptions, resulting in the product trusting the certificate for subsequent HTTPS scans. This vulnerability allows an attacker to perform a Man-in-the-Middle (MITM) attack by using a self-signed certificate, which the product will trust after the site has been added to exceptions. This can lead to the interception and potential alteration of secure communications.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-295
References: https://www.bitdefender.com/support/security-advisories/https-certificate-validation-issue-in-bitdefender-safepay-va-11167/
CVE: CVE-2024-10055
Published: 2024-10-18
Description: The Click to Chat – WP Support All-in-One Floating Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsaio_snapchat shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-49281 may be a duplicate of this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3169768/; https://wordpress.org/plugins/support-chat/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/b4c13600-0791-4ade-9c28-f43f164aedae?source=cve
CVE: CVE-2024-10078
Published: 2024-10-18
Description: The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 1.4.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify, or delete plugin options and posts.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L111; https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L112; https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L113
CVE: CVE-2024-10079
Published: 2024-10-18
Description: The WP Easy Post Types plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.4 via deserialization of untrusted input from the 'text' parameter in the 'ajax_import_content' function. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L1318; https://www.wordfence.com/threat-intel/vulnerabilities/id/d038f1a2-4755-417f-965d-508b57c05738?source=cve
CVE: CVE-2024-10080
Published: 2024-10-18
Description: The WP Easy Post Types plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/easy-post-types/tags/1.4.4/custom-type.php#L1622; https://www.wordfence.com/threat-intel/vulnerabilities/id/1bee1eeb-5354-47c9-9ae1-b1608d87d7bb?source=cve
CVE: CVE-2023-49570
Published: 2024-10-18
Description: A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that isn't authorized to issue certificates. This occurs when the "Basic Constraints" extension in the certificate indicates that it is meant to be an "End Entity”. This flaw could allow an attacker to perform a Man-in-the-Middle (MITM) attack, intercepting and potentially altering communications between the user and the website.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://www.bitdefender.com/support/security-advisories/insecure-trust-of-basic-constraints-certificate-in-bitdefender-total-security-https-scanning-va-11210/
CVE: CVE-2024-47485
Published: 2024-10-18
Description: There is a CSV injection vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could build malicious data to generate executable commands in the CSV file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1236, CWE-1236
References: https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikcentral-product-series/
CVE: CVE-2024-47486
Published: 2024-10-18
Description: There is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts into certain pages by building malicious data.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikcentral-product-series/
CVE: CVE-2024-47487
Published: 2024-10-18
Description: There is a SQL injection vulnerability in some HikCentral Professional versions. This could allow an authenticated user to execute arbitrary SQL queries.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikcentral-product-series/
CVE: CVE-2024-4739
Published: 2024-10-18
Description: The lack of access restriction to a resource from unauthorized users makes MXsecurity software versions v1.1.0 and prior vulnerable. By acquiring a valid authenticator, an attacker can pose as an authorized user and successfully access the resource.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-749
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-231878-mxsecurity-series-multiple-vulnerabilities
CVE: CVE-2024-4740
Published: 2024-10-18
Description: MXsecurity software versions v1.1.0 and prior are vulnerable because of the use of hard-coded credentials. This vulnerability could allow an attacker to tamper with sensitive data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-798, CWE-798
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-231878-mxsecurity-series-multiple-vulnerabilities
CVE: CVE-2024-10057
Published: 2024-10-18
Description: The RSS Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rfw-youtube-videos shortcode in all versions up to, and including, 2.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3170773/; https://wordpress.org/plugins/rss-feed-widget/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/b77ea258-dced-4c36-bd0d-8977a347d1c9?source=cve
CVE: CVE-2024-49224
Published: 2024-10-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mahesh_9696 Mitm Bug Tracker mitm-bug-tracker allows Reflected XSS.This issue affects Mitm Bug Tracker: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mitm-bug-tracker/vulnerability/wordpress-mitm-bug-tracker-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49225
Published: 2024-10-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in swebdeveloper wpPricing Builder wppricing-builder-lite-responsive-pricing-table-builder allows Stored XSS.This issue affects wpPricing Builder: from n/a through <= 1.5.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wppricing-builder-lite-responsive-pricing-table-builder/vulnerability/wordpress-wppricing-builder-plugin-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49228
Published: 2024-10-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edwin Rivera bVerse Convert bverse-convert allows Stored XSS.This issue affects bVerse Convert: from n/a through <= 1.3.7.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bverse-convert/vulnerability/wordpress-bverse-convert-plugin-1-3-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49230
Published: 2024-10-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in harry005 Ajax Custom CSS/JS ajax-awesome-css allows Reflected XSS.This issue affects Ajax Custom CSS/JS: from n/a through <= 2.0.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ajax-awesome-css/vulnerability/wordpress-ajax-custom-css-js-plugin-2-0-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49231
Published: 2024-10-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cyclop WordPress Video wordpress-video allows Stored XSS.This issue affects WordPress Video: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wordpress-video/vulnerability/wordpress-wordpress-video-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49232
Published: 2024-10-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in derethor El mejor Cluster mejorcluster allows DOM-Based XSS.This issue affects El mejor Cluster: from n/a through <= 1.1.15.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mejorcluster/vulnerability/wordpress-el-mejor-cluster-plugin-1-1-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49233
Published: 2024-10-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MadrasThemes MAS Elementor mas-addons-for-elementor allows DOM-Based XSS.This issue affects MAS Elementor: from n/a through <= 1.1.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mas-addons-for-elementor/vulnerability/wordpress-mas-elementor-plugin-1-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49234
Published: 2024-10-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeworm Plexx Elementor Extension plexx-elementor-extension allows DOM-Based XSS.This issue affects Plexx Elementor Extension: from n/a through <= 1.3.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/plexx-elementor-extension/vulnerability/wordpress-plexx-elementor-extension-plugin-1-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49236
Published: 2024-10-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hafiz Uddin Ahmed Crazy Call To Action Box crazy-call-to-action-box allows DOM-Based XSS.This issue affects Crazy Call To Action Box: from n/a through <= 1.0.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/crazy-call-to-action-box/vulnerability/wordpress-crazy-call-to-action-box-plugin-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49238
Published: 2024-10-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emka73 ADIF Log Search Widget adif-log-search-widget allows Reflected XSS.This issue affects ADIF Log Search Widget: from n/a through <= 1.0f.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/adif-log-search-widget/vulnerability/wordpress-adif-log-search-widget-plugin-1-0f-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49239
Published: 2024-10-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nikhilvaghela Add Categories Post Footer add-categories-post-footer allows Reflected XSS.This issue affects Add Categories Post Footer: from n/a through <= 2.2.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/add-categories-post-footer/vulnerability/wordpress-add-categories-post-footer-plugin-2-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49240
Published: 2024-10-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ajberasategui AB Categories Search Widget  ab-categories-search-widget allows Reflected XSS.This issue affects AB Categories Search Widget : from n/a through <= 0.2.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ab-categories-search-widget/vulnerability/wordpress-ab-categories-search-widget-plugin-0-2-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49241
Published: 2024-10-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tady Tito tito allows DOM-Based XSS.This issue affects Tito: from n/a through <= 2.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/tito/vulnerability/wordpress-tito-plugin-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve