deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-3776
Published: 2024-04-15
Description: The parameter used in the login page of Netvision airPASS is not properly filtered for user input. An unauthenticated remote attacker can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.twcert.org.tw/tw/cp-132-7730-584e3-1.html; https://www.twcert.org.tw/tw/cp-132-7730-584e3-1.html
CVE: CVE-2024-3777
Published: 2024-04-15
Description: The password reset feature of Ai3 QbiBot lacks proper access control, allowing unauthenticated remote attackers to reset any user's password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.twcert.org.tw/tw/cp-132-7732-9a54e-1.html; https://www.twcert.org.tw/tw/cp-132-7732-9a54e-1.html
CVE: CVE-2024-3778
Published: 2024-04-15
Description: The file upload functionality of Ai3 QbiBot does not properly restrict types of uploaded files, allowing remote attackers with administrator privilege to upload files with dangerous type containing malicious code.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://www.twcert.org.tw/tw/cp-132-7732-9a54e-1.html; https://www.twcert.org.tw/tw/cp-132-7732-9a54e-1.html
CVE: CVE-2023-6067
Published: 2024-04-15
Description: The WP User Profile Avatar WordPress plugin through 1.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ae8e225a-5273-4db1-9c72-060304cca658/; https://wpscan.com/vulnerability/ae8e225a-5273-4db1-9c72-060304cca658/
CVE: CVE-2023-7201
Published: 2024-04-15
Description: The Everest Backup  WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
CVSS Score: 6.5 (MEDIUM)
References: https://wpscan.com/vulnerability/64ba4461-bbba-45eb-981f-bb5f2e5e56e1/; https://wpscan.com/vulnerability/64ba4461-bbba-45eb-981f-bb5f2e5e56e1/
CVE: CVE-2024-0399
Published: 2024-04-15
Description: The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://wpscan.com/vulnerability/1550e30c-bf80-48e0-bc51-67d29ebe7272/; https://wpscan.com/vulnerability/1550e30c-bf80-48e0-bc51-67d29ebe7272/
CVE: CVE-2024-0902
Published: 2024-04-15
Description: The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/fd53e40a-516b-47b9-b[PII_REDACTED]32367/; https://wpscan.com/vulnerability/fd53e40a-516b-47b9-b[PII_REDACTED]32367/
CVE: CVE-2024-1204
Published: 2024-04-15
Description: The Meta Box  WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts.
CVSS Score: 4.3 (MEDIUM)
References: https://wpscan.com/vulnerability/03191b00-0b05-42db-9ce2-fc525981b6c9/; https://wpscan.com/vulnerability/03191b00-0b05-42db-9ce2-fc525981b6c9/
CVE: CVE-2024-1306
Published: 2024-04-15
Description: The Smart Forms  WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as editing entries, and we consider it a medium risk.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/c7ce2649-b2b0-43f4-994d-07b1023405e9/; https://wpscan.com/vulnerability/c7ce2649-b2b0-43f4-994d-07b1023405e9/
CVE: CVE-2024-1307
Published: 2024-04-15
Description: The Smart Forms  WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as low as a subscriber to call them and perform unauthorized actions
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://wpscan.com/vulnerability/bbc6cebd-e9bf-4b08-a474-f9312b3c0947/; https://wpscan.com/vulnerability/bbc6cebd-e9bf-4b08-a474-f9312b3c0947/
CVE: CVE-2024-1310
Published: 2024-04-15
Description: The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. (e.g. private, draft and trashed products)
CVSS Score: 4.9 (MEDIUM)
References: https://wpscan.com/vulnerability/a7735feb-876e-461c-9a56-ea6067faf277/; https://wpscan.com/vulnerability/a7735feb-876e-461c-9a56-ea6067faf277/
CVE: CVE-2024-1660
Published: 2024-04-15
Description: The Top Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5bd16f84-22bf-4170-b65c-08caf67d0005/; https://wpscan.com/vulnerability/5bd16f84-22bf-4170-b65c-08caf67d0005/
CVE: CVE-2024-1712
Published: 2024-04-15
Description: The Carousel Slider WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/23805a61-9fcd-4744-a60d-05c8cb43ee01/; https://wpscan.com/vulnerability/23805a61-9fcd-4744-a60d-05c8cb43ee01/
CVE: CVE-2024-1746
Published: 2024-04-15
Description: The Testimonial Slider WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5f35572a-4129-4fe0-a465-d25f4c3b4419/; https://wpscan.com/vulnerability/5f35572a-4129-4fe0-a465-d25f4c3b4419/
CVE: CVE-2024-1754
Published: 2024-04-15
Description: The NPS computy WordPress plugin through 2.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/c061e792-e37a-4cf6-b46b-ff111c5a5c84/; https://wpscan.com/vulnerability/c061e792-e37a-4cf6-b46b-ff111c5a5c84/
CVE: CVE-2024-1755
Published: 2024-04-15
Description: The NPS computy WordPress plugin through 2.7.5 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://wpscan.com/vulnerability/481a376b-55be-4afa-94f5-c3cf8a88b8d1/; https://wpscan.com/vulnerability/481a376b-55be-4afa-94f5-c3cf8a88b8d1/
CVE: CVE-2024-1846
Published: 2024-04-15
Description: The Responsive Tabs WordPress plugin before 4.0.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ea2a8420-4b0e-4efb-a0c6-ceea996dae5a/; https://wpscan.com/vulnerability/ea2a8420-4b0e-4efb-a0c6-ceea996dae5a/
CVE: CVE-2024-1849
Published: 2024-04-15
Description: The WP Customer Reviews WordPress plugin before 3.7.1 does not validate a parameter allowing contributor and above users to redirect a page to a malicious URL
CVSS Score: 5.4 (MEDIUM)
References: https://wpscan.com/vulnerability/e6d9fe28-def6-4f25-9967-a77f91899bfe/; https://wpscan.com/vulnerability/e6d9fe28-def6-4f25-9967-a77f91899bfe/
CVE: CVE-2024-2739
Published: 2024-04-15
Description: The Advanced Search WordPress plugin through 1.1.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVSS Score: 8.7 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/5b84145b-f94e-4ea7-84d5-56cf776817a2/; https://wpscan.com/vulnerability/5b84145b-f94e-4ea7-84d5-56cf776817a2/
CVE: CVE-2024-2836
Published: 2024-04-15
Description: The Social Share, Social Login and Social Comments Plugin  WordPress plugin before 7.13.64 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/36f95b19-af74-4c56-9848-8ff270af4723/; https://wpscan.com/vulnerability/36f95b19-af74-4c56-9848-8ff270af4723/
CVE: CVE-2024-2857
Published: 2024-04-15
Description: The Simple Buttons Creator WordPress plugin through 1.04 does not have any authorisation as well as CSRF in its add button function, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/b7a35c5b-474a-444a-85ee-c50782c7a6c2/; https://wpscan.com/vulnerability/b7a35c5b-474a-444a-85ee-c50782c7a6c2/
CVE: CVE-2024-2858
Published: 2024-04-15
Description: The Simple Buttons Creator WordPress plugin through 1.04 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/43297210-17a6-4b51-b8ca-32ceef9fc09a/; https://wpscan.com/vulnerability/43297210-17a6-4b51-b8ca-32ceef9fc09a/
CVE: CVE-2024-3770
Published: 2024-04-15
Description: A vulnerability has been found in PHPGurukul Student Record System 3.20 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /manage-courses.php?del=1. The manipulation of the argument del leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260617 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/BurakSevben/CVEs/blob/main/Student%20Record%20System%203.20/Student%20Record%20System%20-%20SQL%20Injection%20-%203.md; https://vuldb.com/?ctiid.260617; https://vuldb.com/?id.260617
CVE: CVE-2024-32488
Published: 2024-04-15
Description: In Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during update checks because weak permissions on the update-service folder allow attackers to place crafted DLL files there.
CVSS Score: 7.8 (HIGH)
CWE: CWE-280
References: https://www.foxit.com/support/security-bulletins.html; https://www.foxit.com/support/security-bulletins.html
CVE: CVE-2024-32489
Published: 2024-04-15
Description: TCPDF before 6.7.4 mishandles calls that use HTML syntax.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80
References: https://github.com/tecnickcom/TCPDF/commit/51cd1b39de5643836e62661d162c472d63167df7; https://github.com/tecnickcom/TCPDF/commit/82fc97bf1c74c8dbe62b1d3cc6d10fa4b87e0262; https://github.com/tecnickcom/TCPDF/compare/6.6.2...6.7.4
CVE: CVE-2024-3771
Published: 2024-04-15
Description: A vulnerability was found in PHPGurukul Student Record System 3.20 and classified as critical. Affected by this issue is some unknown functionality of the file /edit-subject.php. The manipulation of the argument sub1/sub2/sub3/sub4/udate leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-260618 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/BurakSevben/CVEs/blob/main/Student%20Record%20System%203.20/Student%20Record%20System%20-%20SQL%20Injection%20-%204.md; https://vuldb.com/?ctiid.260618; https://vuldb.com/?id.260618
CVE: CVE-2023-52144
Published: 2024-04-15
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RexTheme Product Feed Manager.This issue affects Product Feed Manager: from n/a through 7.3.15.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/best-woocommerce-feed/wordpress-product-feed-manager-plugin-7-3-15-directory-traversal-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/best-woocommerce-feed/wordpress-product-feed-manager-plugin-7-3-15-directory-traversal-vulnerability?_s_id=cve
CVE: CVE-2024-32079
Published: 2024-04-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Dempfle Advanced iFrame allows Stored XSS.This issue affects Advanced iFrame: from n/a through 2024.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/advanced-iframe/wordpress-advanced-iframe-plugin-2024-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-iframe/wordpress-advanced-iframe-plugin-2024-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32133
Published: 2024-04-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Schuppenies EZ Form Calculator allows Reflected XSS.This issue affects EZ Form Calculator: from n/a through 2.14.0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ez-form-calculator/wordpress-ez-form-calculator-plugin-2-14-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ez-form-calculator/wordpress-ez-form-calculator-plugin-2-14-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32138
Published: 2024-04-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaizenCoders Short URL allows Reflected XSS.This issue affects Short URL: from n/a through 1.6.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/shorten-url/wordpress-short-url-plugin-1-6-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/shorten-url/wordpress-short-url-plugin-1-6-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32140
Published: 2024-04-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in libsyn Libsyn Publisher Hub libsyn-podcasting.This issue affects Libsyn Publisher Hub: from n/a through <= 1.4.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/libsyn-podcasting/vulnerability/wordpress-libsyn-publisher-hub-plugin-1-4-4-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/libsyn-podcasting/wordpress-libsyn-publisher-hub-plugin-1-4-4-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2024-32145
Published: 2024-04-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PineWise WP Google Analytics Events allows Reflected XSS.This issue affects WP Google Analytics Events: from n/a through 2.8.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-google-analytics-events/wordpress-wp-google-analytics-events-no-code-custom-event-tracking-for-google-analytics-plugin-2-8-0-reflected-cross-site-scripting-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-google-analytics-events/wordpress-wp-google-analytics-events-no-code-custom-event-tracking-for-google-analytics-plugin-2-8-0-reflected-cross-site-scripting-vulnerability?_s_id=cve
CVE: CVE-2024-32147
Published: 2024-04-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Form Plugin Team - GhozyLab Easy Contact Form Lite allows Stored XSS.This issue affects Easy Contact Form Lite : from n/a through 1.1.23.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/contact-form-lite/wordpress-contact-form-plugin-plugin-1-1-23-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contact-form-lite/wordpress-contact-form-plugin-plugin-1-1-23-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32149
Published: 2024-04-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlueGlass Jobs for WordPress allows Reflected XSS.This issue affects Jobs for WordPress: from n/a through 2.7.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/job-postings/wordpress-jobs-for-wordpress-plugin-2-7-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/job-postings/wordpress-jobs-for-wordpress-plugin-2-7-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32428
Published: 2024-04-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moss Web Works MWW Disclaimer Buttons allows Stored XSS.This issue affects MWW Disclaimer Buttons: from n/a through 3.0.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mww-disclaimer-buttons/wordpress-mww-disclaimer-buttons-plugin-3-0-2-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mww-disclaimer-buttons/wordpress-mww-disclaimer-buttons-plugin-3-0-2-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32429
Published: 2024-04-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPChill Remove Footer Credit allows Stored XSS.This issue affects Remove Footer Credit: from n/a through 1.0.13.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/remove-footer-credit/wordpress-remove-footer-credit-plugin-1-0-13-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/remove-footer-credit/wordpress-remove-footer-credit-plugin-1-0-13-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32453
Published: 2024-04-15
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POEditor allows Stored XSS.This issue affects POEditor: from n/a through 0.9.8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/poeditor/wordpress-poeditor-plugin-0-9-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/poeditor/wordpress-poeditor-plugin-0-9-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32454
Published: 2024-04-15
Description: Server-Side Request Forgery (SSRF) vulnerability in Wappointment Appointment Bookings for Zoom GoogleMeet and more – Wappointment.This issue affects Appointment Bookings for Zoom GoogleMeet and more – Wappointment: from n/a through 2.6.0.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/vulnerability/wappointment/wordpress-wappointment-plugin-2-6-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wappointment/wordpress-wappointment-plugin-2-6-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2024-30545
Published: 2024-04-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Nick Powers Social Author Bio allows Stored XSS.This issue affects Social Author Bio: from n/a through 2.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/social-autho-bio/wordpress-social-author-bio-plugin-2-4-stored-xss-via-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/social-autho-bio/wordpress-social-author-bio-plugin-2-4-stored-xss-via-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-31086
Published: 2024-04-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Change default login logo,url and title allows Cross-Site Scripting (XSS).This issue affects Change default login logo,url and title: from n/a through 2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/change-default-login-logo-url-and-title/wordpress-change-default-login-logo-url-and-title-plugin-2-0-csrf-to-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/change-default-login-logo-url-and-title/wordpress-change-default-login-logo-url-and-title-plugin-2-0-csrf-to-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31093
Published: 2024-04-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Kaloyan K. Tsvetkov Broken Images allows Cross-Site Scripting (XSS).This issue affects Broken Images: from n/a through 0.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-broken-images/wordpress-broken-images-plugin-0-2-csrf-to-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-broken-images/wordpress-broken-images-plugin-0-2-csrf-to-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32082
Published: 2024-04-15
Description: Cross-Site Request Forgery (CSRF) vulnerability in Kamlesh Parmar Sync Post With Other Site sync-post-with-other-site allows Cross Site Request Forgery.This issue affects Sync Post With Other Site: from n/a through <= 1.9.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/sync-post-with-other-site/vulnerability/wordpress-sync-post-with-other-site-plugin-1-4-2-cross-site-request-forgery-csrf-to-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sync-post-with-other-site/wordpress-sync-post-with-other-site-plugin-1-4-2-cross-site-request-forgery-csrf-to-xss-vulnerability?_s_id=cve
CVE: CVE-2024-32087
Published: 2024-04-15
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExportFeed.Com Product Feed on WooCommerce for Google.This issue affects Product Feed on WooCommerce for Google: from n/a through 3.5.7.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/purple-xmls-google-product-feed-for-woocommerce/wordpress-product-feed-on-woocommerce-for-google-awin-shareasale-bing-and-more-plugin-3-5-7-auth-sql-injection-sqli-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/purple-xmls-google-product-feed-for-woocommerce/wordpress-product-feed-on-woocommerce-for-google-awin-shareasale-bing-and-more-plugin-3-5-7-auth-sql-injection-sqli-vulnerability?_s_id=cve