deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-37485
Published: 2024-07-21
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vinny Alves (UseStrict Consulting) bbPress Notify allows Reflected XSS.This issue affects bbPress Notify: from n/a through 2.18.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/bbpress-notify-nospam/wordpress-bbpress-notify-no-spam-plugin-2-18-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/bbpress-notify-nospam/wordpress-bbpress-notify-no-spam-plugin-2-18-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-38781
Published: 2024-07-21
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ArtistScope CopySafe Web Protection allows Reflected XSS.This issue affects CopySafe Web Protection: from n/a through 3.15.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-copysafe-web/wordpress-copysafe-web-protection-plugin-3-15-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-copysafe-web/wordpress-copysafe-web-protection-plugin-3-15-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-38782
Published: 2024-07-21
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MapsMarker.Com e.U. Leaflet Maps Marker allows Stored XSS.This issue affects Leaflet Maps Marker: from n/a through 3.12.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/leaflet-maps-marker/wordpress-leaflet-maps-marker-plugin-3-12-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/leaflet-maps-marker/wordpress-leaflet-maps-marker-plugin-3-12-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37446
Published: 2024-07-21
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kiboko Labs Chained Quiz allows Stored XSS.This issue affects Chained Quiz: from n/a through 1.3.2.8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/chained-quiz/wordpress-chained-quiz-plugin-1-3-2-8-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/chained-quiz/wordpress-chained-quiz-plugin-1-3-2-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37447
Published: 2024-07-21
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager allows Stored XSS.This issue affects PixelYourSite – Your smart PIXEL (TAG) Manager: from n/a through 9.6.1.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/pixelyoursite/wordpress-pixelyoursite-your-smart-pixel-tag-api-manager-plugin-9-6-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/pixelyoursite/wordpress-pixelyoursite-your-smart-pixel-tag-api-manager-plugin-9-6-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37449
Published: 2024-07-21
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemePunch OHG Slider Revolution.This issue affects Slider Revolution: from n/a through 6.7.13.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/revslider/wordpress-slider-revolution-plugin-6-7-13-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/revslider/wordpress-slider-revolution-plugin-6-7-13-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37457
Published: 2024-07-21
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ultimate Blocks Ultimate Blocks – Gutenberg Blocks Plugin allows Stored XSS.This issue affects Ultimate Blocks – Gutenberg Blocks Plugin: from n/a through 3.1.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ultimate-blocks/wordpress-ultimate-blocks-wordpress-blocks-plugin-plugin-3-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ultimate-blocks/wordpress-ultimate-blocks-wordpress-blocks-plugin-plugin-3-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-6962
Published: 2024-07-22
Description: A vulnerability classified as critical was found in Tenda O3 1.0.0.10. This vulnerability affects the function formQosSet. The manipulation of the argument remark/ipRange/upSpeed/downSpeed/enable leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272116. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/O3V2.0/formQosSet.md; https://vuldb.com/?ctiid.272116; https://vuldb.com/?id.272116
CVE: CVE-2024-6963
Published: 2024-07-22
Description: A vulnerability, which was classified as critical, has been found in Tenda O3 1.0.0.10. This issue affects the function formexeCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272117 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/O3V2.0/formexeCommand.md; https://vuldb.com/?ctiid.272117; https://vuldb.com/?id.272117
CVE: CVE-2024-6964
Published: 2024-07-22
Description: A vulnerability, which was classified as critical, was found in Tenda O3 1.0.0.10. Affected is the function fromDhcpSetSer. The manipulation of the argument dhcpEn/startIP/endIP/preDNS/altDNS/mask/gateway leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-272118 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/O3V2.0/fromDhcpSetSer.md; https://vuldb.com/?ctiid.272118; https://vuldb.com/?id.272118
CVE: CVE-2024-6965
Published: 2024-07-22
Description: A vulnerability has been found in Tenda O3 1.0.0.10 and classified as critical. Affected by this vulnerability is the function fromVirtualSet. The manipulation of the argument ip/localPort/publicPort/app leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272119. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/O3V2.0/fromVirtualSet.md; https://vuldb.com/?ctiid.272119; https://vuldb.com/?id.272119
CVE: CVE-2024-6966
Published: 2024-07-22
Description: A vulnerability was found in itsourcecode Online Blood Bank Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file login.php of the component Login. The manipulation of the argument user/pass leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272120.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/HermesCui/CVE/issues/1; https://vuldb.com/?ctiid.272120; https://vuldb.com/?id.272120
CVE: CVE-2024-6967
Published: 2024-07-22
Description: A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. It has been classified as critical. This affects an unknown part of the file /employee_gatepass/admin/?page=employee/manage_employee. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272121 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/rtsjx-cve/cve/blob/main/sql.md; https://vuldb.com/?ctiid.272121; https://vuldb.com/?id.272121
CVE: CVE-2024-6968
Published: 2024-07-22
Description: A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /print_patients_visits.php. The manipulation of the argument from/to leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-272122 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Xu-Mingming/cve/blob/main/sql3.md; https://vuldb.com/?ctiid.272122; https://vuldb.com/?id.272122
CVE: CVE-2024-6969
Published: 2024-07-22
Description: A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /ajax/get_patient_history.php. The manipulation of the argument patient_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272123.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Xu-Mingming/cve/blob/main/sql4.md; https://vuldb.com/?ctiid.272123; https://vuldb.com/?id.272123
CVE: CVE-2024-6970
Published: 2024-07-22
Description: A vulnerability classified as critical has been found in itsourcecode Tailoring Management System 1.0. Affected is an unknown function of the file /staffcatadd.php. The manipulation of the argument title leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272124.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/nosaltsea/cve/issues/1; https://vuldb.com/?ctiid.272124; https://vuldb.com/?id.272124
CVE: CVE-2024-41703
Published: 2024-07-22
Description: LibreChat through 0.7.4-rc1 has incorrect access control for message updates.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/danny-avila/LibreChat/discussions/3315#discussioncomment-10074284; https://github.com/danny-avila/LibreChat/pull/3363; https://github.com/realestate-com-au/vulnerability-disclosures/blob/main/LibreChat/CVE-2024-41703.md
CVE: CVE-2024-41704
Published: 2024-07-22
Description: LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/danny-avila/LibreChat/discussions/3315#discussioncomment-10074284; https://github.com/danny-avila/LibreChat/pull/3363; https://github.com/realestate-com-au/vulnerability-disclosures/blob/main/LibreChat/CVE-2024-41704.md
CVE: CVE-2024-41709
Published: 2024-07-22
Description: Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer fields" permission.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://backdropcms.org/security/backdrop-sa-core-2024-001; https://backdropcms.org/security/backdrop-sa-core-2024-001
CVE: CVE-2024-5004
Published: 2024-07-22
Description: The CM Popup Plugin for WordPress  WordPress plugin before 1.6.6 does not sanitise and escape some of the campaign settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4bea7baa-84a2-4b21-881c-4f17822329e7/; https://wpscan.com/vulnerability/4bea7baa-84a2-4b21-881c-4f17822329e7/
CVE: CVE-2024-5529
Published: 2024-07-22
Description: The WP QuickLaTeX WordPress plugin before 3.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/66d0b4b7-cd4b-4ec4-95c0-d50773cb0b8f/; https://wpscan.com/vulnerability/66d0b4b7-cd4b-4ec4-95c0-d50773cb0b8f/
CVE: CVE-2024-5973
Published: 2024-07-22
Description: The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.3.24 does not prevent students from creating instructor accounts, which could be used to get access to functionalities they shouldn't have.
CVSS Score: 8.8 (HIGH)
References: https://wpscan.com/vulnerability/59abfb7c-d5ea-45f2-ab9a-4391978e3805/; https://wpscan.com/vulnerability/59abfb7c-d5ea-45f2-ab9a-4391978e3805/
CVE: CVE-2024-6243
Published: 2024-07-22
Description: The HTML Forms  WordPress plugin before 1.3.33 does not sanitize and escape the form message inputs, allowing high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disabled.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/f4097877-ba19-4738-a994-9593b9a5a635/; https://wpscan.com/vulnerability/f4097877-ba19-4738-a994-9593b9a5a635/
CVE: CVE-2024-6244
Published: 2024-07-22
Description: The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wpscan.com/vulnerability/73ba55a5-6cff-40fc-9686-30c50f060732/; https://wpscan.com/vulnerability/73ba55a5-6cff-40fc-9686-30c50f060732/
CVE: CVE-2024-6271
Published: 2024-07-22
Description: The Community Events WordPress plugin before 1.5 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete arbitrary events via a CSRF attack
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/44d9d085-34cb-490f-a3f5-f9eafae85ab8/; https://wpscan.com/vulnerability/44d9d085-34cb-490f-a3f5-f9eafae85ab8/
CVE: CVE-2024-37391
Published: 2024-07-22
Description: ProtonVPN before 3.2.10 on Windows mishandles the drive installer path, which should use this: '"' + ExpandConstant('{autopf}\Proton\Drive') + '"' in Setup/setup.iss.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://github.com/ProtonVPN/win-app/commit/2e4e25036842aaf48838c6a59f14671b86c20aa7; https://github.com/ProtonVPN/win-app/compare/3.2.9...3.2.10; https://github.com/ProtonVPN/win-app/commit/2e4e25036842aaf48838c6a59f14671b86c20aa7
CVE: CVE-2024-40430
Published: 2024-07-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-37245
Published: 2024-07-22
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vsourz Digital All In One Redirection allows Reflected XSS.This issue affects All In One Redirection: from n/a through 2.2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/all-in-one-redirection/wordpress-all-in-one-redirection-plugin-2-2-0-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/all-in-one-redirection/wordpress-all-in-one-redirection-plugin-2-2-0-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2024-37246
Published: 2024-07-22
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jethin Gallery Slideshow allows Stored XSS.This issue affects Gallery Slideshow: from n/a through 1.4.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/gallery-slideshow/wordpress-gallery-slideshow-plugin-1-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/gallery-slideshow/wordpress-gallery-slideshow-plugin-1-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37257
Published: 2024-07-22
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Maciej Bis Permalink Manager Lite allows Reflected XSS.This issue affects Permalink Manager Lite: from n/a through 2.4.3.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/permalink-manager/wordpress-permalink-manager-lite-plugin-2-4-3-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/permalink-manager/wordpress-permalink-manager-lite-plugin-2-4-3-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37258
Published: 2024-07-22
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Social Rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/social-rocket/wordpress-social-rocket-plugin-1-3-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/social-rocket/wordpress-social-rocket-plugin-1-3-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37259
Published: 2024-07-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through <= 2.4.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpextended/vulnerability/wordpress-wp-extended-plugin-2-4-7-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpextended/wordpress-wp-extended-plugin-2-4-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37261
Published: 2024-07-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister Lite for Amazon wp-lister-for-amazon.This issue affects WP-Lister Lite for Amazon: from n/a through <= 2.6.16.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-lister-for-amazon/vulnerability/wordpress-wp-lister-lite-for-amazon-plugin-2-6-16-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-lister-for-amazon/wordpress-wp-lister-lite-for-amazon-plugin-2-6-16-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37262
Published: 2024-07-22
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in vCita.Com Online Booking & Scheduling Calendar for WordPress by vcita allows Reflected XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through 4.4.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/meeting-scheduler-by-vcita/wordpress-online-booking-scheduling-calendar-plugin-4-4-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/meeting-scheduler-by-vcita/wordpress-online-booking-scheduling-calendar-plugin-4-4-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37263
Published: 2024-07-22
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeLooks Enter Addons enteraddons allows Stored XSS.This issue affects Enter Addons: from n/a through 2.1.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/enteraddons/wordpress-enter-addons-ultimate-template-builder-for-elementor-plugin-2-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/enteraddons/wordpress-enter-addons-ultimate-template-builder-for-elementor-plugin-2-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37264
Published: 2024-07-22
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Groundhogg Inc. Groundhogg allows Reflected XSS.This issue affects Groundhogg: from n/a through 3.4.2.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/groundhogg/wordpress-groundhogg-plugin-3-4-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/groundhogg/wordpress-groundhogg-plugin-3-4-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37265
Published: 2024-07-22
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Martin Gibson IdeaPush allows Stored XSS.This issue affects IdeaPush: from n/a through 8.60.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/ideapush/wordpress-ideapush-plugin-8-60-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/ideapush/wordpress-ideapush-plugin-8-60-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37267
Published: 2024-07-22
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in kaptinlin Striking allows Reflected XSS.This issue affects Striking: from n/a through 2.3.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/striking-r/wordpress-striking-theme-2-3-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/striking-r/wordpress-striking-theme-2-3-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37271
Published: 2024-07-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Nelson Print My Blog print-my-blog.This issue affects Print My Blog: from n/a through <= 3.27.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/print-my-blog/vulnerability/wordpress-print-my-blog-plugin-3-27-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/print-my-blog/wordpress-print-my-blog-plugin-3-27-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-37275
Published: 2024-07-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NextScripts NextScripts social-networks-auto-poster-facebook-twitter-g allows DOM-Based XSS.This issue affects NextScripts: from n/a through <= 4.4.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/social-networks-auto-poster-facebook-twitter-g/vulnerability/wordpress-nextscripts-plugin-4-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/social-networks-auto-poster-facebook-twitter-g/wordpress-nextscripts-plugin-4-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve