deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-50299
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

sctp: properly validate chunk size in sctp_sf_ootb()

A size validation fix similar to that in Commit 50619dbf8db7 ("sctp: add
size validation when walking chunks") is also required in sctp_sf_ootb()
to address a crash reported by syzbot:

  BUG: KMSAN: uninit-value in sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712
  sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712
  sctp_do_sm+0x181/0x93d0 net/sctp/sm_sideeffect.c:1166
  sctp_endpoint_bh_rcv+0xc38/0xf90 net/sctp/endpointola.c:407
  sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88
  sctp_rcv+0x3831/0x3b20 net/sctp/input.c:243
  sctp4_rcv+0x42/0x50 net/sctp/protocol.c:1159
  ip_protocol_deliver_rcu+0xb51/0x13d0 net/ipv4/ip_input.c:205
  ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908, CWE-908
References: https://git.kernel.org/stable/c/0ead60804b64f5bd6999eec88e503c6a1a242d41; https://git.kernel.org/stable/c/40b283ba76665437bc2ac72079c51b57b25bff9e; https://git.kernel.org/stable/c/67b9a278b80f71ec62091ded97c6bcbea33b5ec3
CVE: CVE-2024-50300
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

regulator: rtq2208: Fix uninitialized use of regulator_config

Fix rtq2208 driver uninitialized use to cause kernel error.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908, CWE-908
References: https://git.kernel.org/stable/c/2feb023110843acce790e9089e72e9a9503d9fa5; https://git.kernel.org/stable/c/64fbab934ae59be9caffc80a75450984b1e108e0; https://git.kernel.org/stable/c/9b7c0405af667857b3ad24a7ef6723f5475a9e43
CVE: CVE-2024-50302
Published: 2024-11-19
Description: In the Linux kernel, the following vulnerability has been resolved:

HID: core: zero-initialize the report buffer

Since the report buffer is used by all kinds of drivers in various ways, let's
zero-initialize it during allocation to make sure that it can't be ever used
to leak kernel memory via specially-crafted report.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908, CWE-908
References: https://git.kernel.org/stable/c/05ade5d[PII_REDACTED]e7ef664e7ac8e0c734f1aaf; https://git.kernel.org/stable/c/177f25d1292c7e16e1199b39c85480f7f8815552; https://git.kernel.org/stable/c/1884ab3d22536a5c14b17c78c2ce76d1734e8b0b
CVE: CVE-2024-21539
Published: 2024-11-19
Description: Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by exploiting this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333, CWE-770
References: https://github.com/eslint/rewrite/commit/071be842f0bd58de4863cdf2ab86d60f49912abf; https://security.snyk.io/vuln/SNYK-JS-ESLINTPLUGINKIT-8340627
CVE: CVE-2024-10103
Published: 2024-11-19
Description: In the process of testing the MailPoet  WordPress plugin before 5.3.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/89660883-5f34-426a-ad06-741c0c213ecc/
CVE: CVE-2024-8403
Published: 2024-11-19
Description: Improper Validation of Specified Type of Input vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET versions 1.100 to 1.200 and FX5-ENET/IP versions 1.100 to 1.104 allows a remote attacker to cause a Denial of Service condition in Ethernet communication of the products by sending specially crafted SLMP packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1287
References: https://jvn.jp/vu/JVNVU97790713/; https://www.cisa.gov/news-events/ics-advisories/icsa-24-324-01; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-009_en.pdf
CVE: CVE-2024-10268
Published: 2024-11-19
Description: The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sonaar_audioplayer shortcode in all versions up to, and including, 5.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3188034/; https://wordpress.org/plugins/mp3-music-player-by-sonaar/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/861d0218-0f0f-4299-a0ff[PII_REDACTED]57?source=cve
CVE: CVE-2024-10388
Published: 2024-11-19
Description: The WordPress GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr_firstname' and 'gdpr_lastname' parameters in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://www.welaunch.io/en/product/wordpress-gdpr/#changelog; https://www.wordfence.com/threat-intel/vulnerabilities/id/bf707d9b-2b96-4d1b-b798-38f7fe958eaf?source=cve
CVE: CVE-2024-11069
Published: 2024-11-19
Description: The WordPress GDPR plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'WordPress_GDPR_Data_Delete::check_action' function in all versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to delete arbitrary users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://www.welaunch.io/en/product/wordpress-gdpr/#changelog; https://www.wordfence.com/threat-intel/vulnerabilities/id/a089026a-5da9-467c-a1e4-622bb74363e2?source=cve
CVE: CVE-2024-11098
Published: 2024-11-19
Description: The SVG Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.1.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3188270/; https://wordpress.org/plugins/svg-block/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/79cc1f11-9b53-4e71-b0cc-8f8ebd4a5f32?source=cve
CVE: CVE-2024-31141
Published: 2024-11-19
Description: Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients.

Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables.
In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.

In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products.
This issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0.


Users with affected applications are recommended to upgrade kafka-clients to version >=3.8.0, and set the JVM system property "org.apache.kafka.automatic.config.providers=none".
Users of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate "allowlist.pattern" and "allowed.paths" to restrict their operation to appropriate bounds.


For users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property.
For users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269, CWE-552
References: https://lists.apache.org/thread/9whdzfr0zwdhr364604w5ssnzmg4v2lv; http://www.openwall.com/lists/oss-security/2024/11/18/5; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-11036
Published: 2024-11-19
Description: The The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_get_user_earnings AJAX action in all versions up to, and including, 7.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/gamipress/; https://plugins.trac.wordpress.org/browser/gamipress/tags/7.1.4/includes/functions.php#L693; https://plugins.trac.wordpress.org/browser/gamipress/tags/7.1.4/includes/functions.php#L702
CVE: CVE-2024-11038
Published: 2024-11-19
Description: The The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup plugin for WordPress is vulnerable to arbitrary shortcode execution via wpb_pcf_fire_contact_form AJAX action in all versions up to, and including, 1.7.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 7.3 (HIGH)
CWE: CWE-94
References: https://gist.github.com/wpbean/1a5abfea883621b4e150eab1362a420f; https://plugins.trac.wordpress.org/browser/wpb-popup-for-contact-form-7/tags/1.7.4/includes/class.ajax.php#L34; https://plugins.trac.wordpress.org/changeset/3188864/
CVE: CVE-2024-11195
Published: 2024-11-19
Description: The Email Subscription Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's print_email_subscribe_form shortcode in all versions up to, and including, 1.2.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/email-subscribe/tags/1.2.22/wp-email-subscription.php#L2860; https://plugins.trac.wordpress.org/changeset/3189989/; https://wordpress.org/plugins/email-subscribe/#developers
CVE: CVE-2024-11194
Published: 2024-11-19
Description: The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a misconfigured check on the 'rtcl_import_settings' function in all versions up to, and including, 3.1.15.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update limited arbitrary options on the WordPress site. This can be leveraged to update the Subscriber role with Administrator-level capabilities to gain administrative user access to a vulnerable site. The vulnerability is limited in that the option updated must have a value that is an array.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/classified-listing/tags/3.1.12/app/Controllers/Ajax/Import.php#L309; https://plugins.trac.wordpress.org/browser/classified-listing/tags/3.1.12/app/Controllers/Ajax/Import.php#L473; https://plugins.trac.wordpress.org/changeset/3189516/
CVE: CVE-2024-11198
Published: 2024-11-19
Description: The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘extra_class’ parameter in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/gd-rating-system/tags/3.6.1/d4plib/plugin/d4p.shortcodes.php#L63; https://plugins.trac.wordpress.org/changeset/3189622/; https://wordpress.org/plugins/gd-rating-system/#developers
CVE: CVE-2024-11224
Published: 2024-11-19
Description: The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘position’ parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/parallax-image/tags/1.9/assets/shortcode.php#L156; https://plugins.trac.wordpress.org/changeset/3189649/; https://wordpress.org/plugins/parallax-image/#developers
CVE: CVE-2024-52675
Published: 2024-11-19
Description: SourceCodester Sentiment Based Movie Rating System 1.0 is vulnerable to SQL Injection in /msrps/movies.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/xubeining/Cve_report/blob/main/Sourcecodester-SQLi-Sentiment-Based-Moive-Rating.md
CVE: CVE-2024-9777
Published: 2024-11-19
Description: The Ashe theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.243. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://themes.trac.wordpress.org/browser/ashe/2.242/functions.php#L101; https://themes.trac.wordpress.org/browser/ashe/2.242/functions.php#L112; https://themes.trac.wordpress.org/changeset/248853/
CVE: CVE-2024-9830
Published: 2024-11-19
Description: The Bard theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.216. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://themes.trac.wordpress.org/browser/bard/2.216/functions.php#L109; https://themes.trac.wordpress.org/browser/bard/2.216/functions.php#L98; https://themes.trac.wordpress.org/changeset/248854/
CVE: CVE-2024-10204
Published: 2024-11-19
Description: Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in the X_B and SAT file reading procedure in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025. These vulnerabilities could allow an attacker to execute arbitrary code while opening a specially crafted X_B or SAT file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-457
References: https://www.3ds.com/vulnerability/advisories
CVE: CVE-2024-11075
Published: 2024-11-19
Description: A vulnerability in the Incoming Goods Suite allows a user with unprivileged access to the underlying system (e.g. local or via SSH) a privilege escalation to the administrative level due to the usage of component vendor Docker images running with root permissions. Exploiting this misconfiguration leads to the fact that an attacker can gain administrative control. over the whole system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-250
References: https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF; https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
CVE: CVE-2024-52711
Published: 2024-11-19
Description: DI-8100 v16.07.26A1 is vulnerable to Buffer Overflow In the ip_position_asp function via the ip parameter.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/CLan-nad/CVE/blob/main/D-Link/ip_position_asp/1.md
CVE: CVE-2024-10524
Published: 2024-11-19
Description: Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778; https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/; https://seclists.org/oss-sec/2024/q4/107
CVE: CVE-2024-50803
Published: 2024-11-19
Description: The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker to escalate privileges
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://redaxo-core.com; http://redaxo.com; https://github.com/Praison001/CVE-2024-50803-Redaxo
CVE: CVE-2024-52582
Published: 2024-11-19
Description: Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to version 0.14.0, secrets may be shown in logs when an unhandled exception is triggered because the tool is logging locals of each function. This may uncover secrets if tool used in CI/build pipelines as it's the main use case. Version 0.14.0 contains a patch for the issue. No known workarounds are available.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-497
References: https://github.com/containerbuildsystem/cachi2/commit/d6638e5e14474061a1ab1ba5d0ee72f58b9a11a9; https://github.com/containerbuildsystem/cachi2/security/advisories/GHSA-w9qc-9m5h-qqmh; https://typer.tiangolo.com/tutorial/exceptions/?h=#disable-local-variables-for-security
CVE: CVE-2024-43338
Published: 2024-11-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in Automattic Crowdsignal Dashboard – Polls, Surveys & more polldaddy allows Cross Site Request Forgery.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through <= 3.1.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/polldaddy/vulnerability/wordpress-crowdsignal-polls-ratings-plugin-3-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-48071
Published: 2024-11-19
Description: E-cology has a directory traversal vulnerability. An attacker can exploit this vulnerability to delete the server directory, causing the server to permanently deny service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://gist.github.com/CoinIsMoney/d437f267f2d65cb80dd7da97cb2068e8; https://github.com/stuven1989/TemporaryGuild/blob/main/files/exp-eng-3.pdf
CVE: CVE-2024-49680
Published: 2024-11-19
Description: Missing Authorization vulnerability in RexTheme WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through <= 8.5.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wpvr/vulnerability/wordpress-wpvr-plugin-8-5-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-49689
Published: 2024-11-19
Description: Missing Authorization vulnerability in Harmonic Design HD Quiz – Save Results Light hd-quiz-save-results-light allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HD Quiz – Save Results Light: from n/a through <= 0.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/hd-quiz-save-results-light/vulnerability/wordpress-hd-quiz-save-results-light-plugin-0-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-49697
Published: 2024-11-19
Description: Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/sunshine-photo-cart/vulnerability/wordpress-sunshine-photo-cart-plugin-3-2-9-broken-access-control-vulnerability-2?_s_id=cve
CVE: CVE-2024-50417
Published: 2024-11-19
Description: Missing Authorization vulnerability in boldthemes Bold Page Builder bold-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bold Page Builder: from n/a through <= 5.1.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/bold-page-builder/vulnerability/wordpress-bold-page-builder-plugin-5-1-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-50513
Published: 2024-11-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post allows Stored XSS.This issue affects PostX: from n/a through <= 4.1.15.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-post/vulnerability/wordpress-post-grid-gutenberg-blocks-and-wordpress-blog-plugin-postx-plugin-4-1-15-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50514
Published: 2024-11-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ninja-forms/vulnerability/wordpress-ninja-forms-the-contact-form-builder-that-grows-with-you-plugin-3-8-16-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50515
Published: 2024-11-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ninja-forms/vulnerability/wordpress-ninja-forms-the-contact-form-builder-that-grows-with-you-plugin-3-8-16-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2024-50516
Published: 2024-11-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in adamskaat Countdown & Clock countdown-builder allows Stored XSS.This issue affects Countdown & Clock: from n/a through <= 3.0.8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/countdown-builder/vulnerability/wordpress-countdown-clock-plugin-2-8-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50517
Published: 2024-11-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDSK team ID-SK Toolkit idsk-toolkit allows Stored XSS.This issue affects ID-SK Toolkit: from n/a through <= 1.7.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/idsk-toolkit/vulnerability/wordpress-id-sk-toolkit-plugin-1-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve