deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-13380
Published: 2025-01-30
Description: The Alex Reservations: Smart Restaurant Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rr_form' shortcode in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/alex-reservations/trunk/includes/shortcodes.php#L14; https://plugins.trac.wordpress.org/changeset/3229743/; https://www.wordfence.com/threat-intel/vulnerabilities/id/89ddede9-3170-48bb-aae5-14f915330f67?source=cve
CVE: CVE-2024-13466
Published: 2025-01-30
Description: The Automatically Hierarchic Categories in Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'autocategorymenu' shortcode in all versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/automatically-hierarchic-categories-in-menu/trunk/includes/class-auto-hierarchic-category-menu.php#L312; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3229318%40automatically-hierarchic-categories-in-menu&new=3229318%40automatically-hierarchic-categories-in-menu&sfp_email=&sfph_mail=; https://wordpress.org/plugins/automatically-hierarchic-categories-in-menu
CVE: CVE-2025-0869
Published: 2025-01-30
Description: A vulnerability was found in Cianet ONU GW24AC up to 20250127. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Login. The manipulation of the argument browserLang leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://vuldb.com/?ctiid.294055; https://vuldb.com/?id.294055; https://vuldb.com/?submit.489867
CVE: CVE-2025-0870
Published: 2025-01-30
Description: A vulnerability was found in Axiomatic Bento4 up to 1.6.0-641. It has been rated as critical. Affected by this issue is the function AP4_DataBuffer::GetData in the library Ap4DataBuffer.h. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-119, CWE-122, CWE-787
References: https://github.com/axiomatic-systems/Bento4/issues/980; https://github.com/user-attachments/files/16929290/Bug2.zip; https://vuldb.com/?ctiid.294056
CVE: CVE-2024-10591
Published: 2025-01-30
Description: The MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hubwoo_save_updates() function in all versions up to, and including, 1.5.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/makewebbetter-hubspot-for-woocommerce/trunk/includes/class-hubwoo-ajax-handler.php#L845; https://plugins.trac.wordpress.org/changeset/3231984/; https://www.wordfence.com/threat-intel/vulnerabilities/id/bd38b5f2-f13e-4433-9a8a-2f42cc1782c6?source=cve
CVE: CVE-2024-10847
Published: 2025-01-30
Description: The Storely theme for WordPress is vulnerable to Stored Cross-Site Scripting via a malicious display name in all versions up to, and including, 18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/themes/storely/; https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a3fe11-76cc-4304-91b7-b9bc61f0ff70?source=cve
CVE: CVE-2024-11583
Published: 2025-01-30
Description: The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_zipped_font' function in all versions up to, and including, 1.5.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete icon fonts that were previously uploaded.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/borderless/tags/1.5.7/includes/icon-manager/icon-manager.php#L270; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3230461%40borderless%2Ftrunk&old=3209805%40borderless%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/0968fe3b-2256-41e8-8cc9-e800dd7f8c27?source=cve
CVE: CVE-2024-11600
Published: 2025-01-30
Description: The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.6.0 via the 'write_config' function. This is due to a lack of sanitization on an imported JSON file. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/borderless/tags/1.5.7/includes/icon-manager/icon-manager.php#L249; https://plugins.trac.wordpress.org/browser/borderless/tags/1.5.7/includes/icon-manager/icon-manager.php#L333; https://plugins.trac.wordpress.org/browser/borderless/tags/1.5.7/includes/icon-manager/icon-manager.php#L388
CVE: CVE-2024-12102
Published: 2025-01-30
Description: The Typer Core plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.6 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://wordpress.org/plugins/typer-core/; https://www.wordfence.com/threat-intel/vulnerabilities/id/de53b1d8-e38f-42c5-adfc-2b0ce8d6945b?source=cve
CVE: CVE-2024-12129
Published: 2025-01-30
Description: The Royal Core plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'royal_restore_backup' function in all versions up to, and including, 2.9.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://themeforest.net/item/hyperx-portfolio-for-freelancers-agencies/13439786; https://www.wordfence.com/threat-intel/vulnerabilities/id/a6ca0a45-cbb3-419b-a2fd[PII_REDACTED]d8?source=cve
CVE: CVE-2024-12177
Published: 2025-01-30
Description: The Ai Image Alt Text Generator for WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ai-image-alt-text-generator-for-wp/tags/1.0.2/includes/class-boomdevs-ai-image-alt-text-generator-custom-menu.php#L218; https://plugins.trac.wordpress.org/changeset/3230467/; https://www.wordfence.com/threat-intel/vulnerabilities/id/902ec583-c072-4c6d-8250-ad08d7ecf239?source=cve
CVE: CVE-2024-12269
Published: 2025-01-30
Description: The Safe Ai Malware Protection for WP plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_db() function in all versions up to, and including, 1.0.17. This makes it possible for unauthenticated attackers to retrieve a complete dump of the site's database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/safe-ai-malware-protection-for-wp/trunk/includes/class-mvsp-export-db.php#L7; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3232957%40safe-ai-malware-protection-for-wp&new=3232957%40safe-ai-malware-protection-for-wp&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/5247bf43-ae02-47cb-825e-23821b78eba9?source=cve
CVE: CVE-2024-12299
Published: 2025-01-30
Description: The System Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Filename parameter in all versions up to, and including, 2.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrative user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/system-dashboard/tags/2.8.15/admin/class-system-dashboard-admin.php#L2323; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3235119%40system-dashboard&new=3235119%40system-dashboard&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/993670b7-a3ea-497d-ad46-881bd47b9346?source=cve
CVE: CVE-2024-12320
Published: 2025-01-30
Description: The Team Rosters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/team-rosters/trunk/includes/mstw-tr-settings.php#L126; https://plugins.trac.wordpress.org/browser/team-rosters/trunk/includes/mstw-tr-settings.php#L54; https://plugins.trac.wordpress.org/changeset/3240856
CVE: CVE-2024-12444
Published: 2025-01-30
Description: The WP Dispensary plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpd_menu' shortcode in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-dispensary/trunk/admin/wp-dispensary-shortcodes.php#L256; https://wordpress.org/plugins/wp-dispensary; https://www.wordfence.com/threat-intel/vulnerabilities/id/13753c4d-1b51-4db2-a69e-523857a50e55?source=cve
CVE: CVE-2024-12451
Published: 2025-01-30
Description: The HTML5 chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'HTML5CHAT' shortcode in all versions up to, and including, 1.07 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/html5-chat/trunk/index.php#L159; https://plugins.trac.wordpress.org/changeset/3443134/; https://www.wordfence.com/threat-intel/vulnerabilities/id/98de0a50-8464-4ea6-bf55-add9aab2d716?source=cve
CVE: CVE-2024-12821
Published: 2025-01-30
Description: The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the upm_upload_media() function in all versions up to, and including, 3.12.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862, CWE-862
References: https://codecanyon.net/item/media-manager-for-userpro/8664618; https://www.wordfence.com/threat-intel/vulnerabilities/id/89afc78b-efd5-445e-884f-2345e08df705?source=cve
CVE: CVE-2024-12822
Published: 2025-01-30
Description: The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the add_capto_img() function in all versions up to, and including, 3.11.0. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://codecanyon.net/item/media-manager-for-userpro/8664618; https://www.wordfence.com/threat-intel/vulnerabilities/id/a57b2afa-b943-419f-9819-d7b6835c4d10?source=cve
CVE: CVE-2024-12861
Published: 2025-01-30
Description: The W2S – Migrate WooCommerce to Shopify plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.2.1 via the 'viw2s_view_log' AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-73
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3227799%40w2s-migrate-woo-to-shopify&new=3227799%40w2s-migrate-woo-to-shopify&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/8a8eeae9-572c-420a-be7d-a240c54e96ae?source=cve
CVE: CVE-2024-13349
Published: 2025-01-30
Description: The Stockdio Historical Chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stockdio-historical-chart' shortcode in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/stockdio-historical-chart/trunk/stockdioplugin.php#L1155; https://plugins.trac.wordpress.org/changeset/3231386/; https://wordpress.org/plugins/stockdio-historical-chart
CVE: CVE-2024-13400
Published: 2025-01-30
Description: The Kona Gallery Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Kona: Instagram for Gutenberg" Block, specifically in the "align" attribute, in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/kona-instagram-feed-for-gutenberg/; https://www.wordfence.com/threat-intel/vulnerabilities/id/e90045df-deb5-41ab-a285-c6b1573ae0f6?source=cve
CVE: CVE-2024-13460
Published: 2025-01-30
Description: The WE – Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Testimonial Author Names in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/we-testimonial-slider/; https://www.wordfence.com/threat-intel/vulnerabilities/id/704a7df0-8e6b-4145-96a2-d179a6d75aac?source=cve
CVE: CVE-2024-13512
Published: 2025-01-30
Description: The Wonder FontAwesome plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://wordpress.org/plugins/wonder-fontawesome/; https://www.wordfence.com/threat-intel/vulnerabilities/id/494f5c9f-ef5b-48d8-8f3a-27e5ed4bea5e?source=cve
CVE: CVE-2024-13549
Published: 2025-01-30
Description: The All Bootstrap Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Accordion" widget in all versions up to, and including, 1.3.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3228370/all-bootstrap-blocks/trunk/blocks/accordion-item.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/786e16be-dee9-43de-afe3-dcc0d17bc92b?source=cve
CVE: CVE-2024-13596
Published: 2025-01-30
Description: The WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'survey' shortcode in all versions up to, and including, 1.7.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/wp-survey-and-poll/trunk/wordpress-survey-and-poll.php#L1457; https://www.wordfence.com/threat-intel/vulnerabilities/id/996cb291-692d-4892-a3ab-ffad960ba732?source=cve
CVE: CVE-2024-13646
Published: 2025-01-30
Description: The Single-user-chat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to insufficient validation on the 'single_user_chat_update_login' function in all versions up to, and including, 0.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to update option values to 'login' on the WordPress site. This may be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
CVSS Score: 8.1 (HIGH)
CWE: CWE-285
References: https://plugins.trac.wordpress.org/browser/single-user-chat/trunk/single-user-chat.php#L326; https://www.wordfence.com/threat-intel/vulnerabilities/id/8a4978c1-087f-4784-9691-91ca5044f60a?source=cve
CVE: CVE-2024-13652
Published: 2025-01-30
Description: The ECPay Ecommerce for WooCommerce plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'clear_ecpay_debug_log' AJAX action in all versions up to, and including, 1.1.2411060. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear the plugin's log files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3235861%40ecpay-ecommerce-for-woocommerce&new=3235861%40ecpay-ecommerce-for-woocommerce&sfp_email=&sfph_mail=; https://wordpress.org/plugins/ecpay-ecommerce-for-woocommerce/; https://www.wordfence.com/threat-intel/vulnerabilities/id/5ae08e0b-ea17-46c1-aad3-4ecea69c1bdc?source=cve
CVE: CVE-2024-13661
Published: 2025-01-30
Description: The Table Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wptableeditor_vtabs' shortcode in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-table-editor/trunk/includes/public/shortcode.php#L333; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3228279%40wp-table-editor&new=3228279%40wp-table-editor&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/3fe1f3c3-4a81-4aae-9a5e-e5889f4c69ba?source=cve
CVE: CVE-2024-13664
Published: 2025-01-30
Description: The WP Post List Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpb_post_list_table' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3227735/; https://www.wordfence.com/threat-intel/vulnerabilities/id/b18f6817-86db-4a72-a2e9-a9e047e05bc5?source=cve
CVE: CVE-2024-13670
Published: 2025-01-30
Description: The Music Sheet Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pn_msv' shortcode in all versions up to, and including, 4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/music-sheet-viewer/trunk/music-sheet-viewer.php#L395; https://www.wordfence.com/threat-intel/vulnerabilities/id/8ec4eb8a-7b03-4392-9137-4f17622bfe54?source=cve