deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-23969
Published: 2025-01-31
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the wlanchnllst function. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1051/
CVE: CVE-2024-23970
Published: 2025-01-31
Description: This vulnerability allows network-adjacent attackers to compromise transport security on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the CURLOPT_SSL_VERIFYHOST setting. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-295
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1052/
CVE: CVE-2024-23971
Published: 2025-01-31
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of OCPP messages. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1053/
CVE: CVE-2024-23973
Published: 2025-01-31
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. 

The specific flaw exists within the handling of HTTP GET requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://community.silabs.com/a45Vm0000000Atp; https://www.zerodayinitiative.com/advisories/ZDI-24-873/
CVE: CVE-2024-24731
Published: 2025-01-31
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the http_download command. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://community.silabs.com/a45Vm0000000Atp; https://www.zerodayinitiative.com/advisories/ZDI-24-870/
CVE: CVE-2025-24336
Published: 2025-01-31
Description: SXF Common Library handles input data improperly. If a product using the library reads a crafted file, the product may be crashed.
CVSS Score: 3.3 (LOW)
CWE: CWE-237
References: https://jvn.jp/en/jp/JVN23839833/; https://ocf.or.jp/about/download/sxflibrary
CVE: CVE-2022-28653
Published: 2025-01-31
Description: Users can consume unlimited disk space in /var/crash
CVSS Score: 7.5 (HIGH)
References: https://www.cve.org/CVERecord?id=CVE-2022-28653
CVE: CVE-2024-23920
Published: 2025-01-31
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the onboardee module. The issue results from improper access control. An attacker can leverage this vulnerability to execute code in the context of root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1048/
CVE: CVE-2024-23921
Published: 2025-01-31
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the wlanapp module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://www.zerodayinitiative.com/advisories/ZDI-24-1049/
CVE: CVE-2024-23929
Published: 2025-01-31
Description: This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Pioneer DMH-WT7600NEX devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the telematics functionality. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.
CVSS Score: 7.3 (HIGH)
CWE: CWE-863
References: https://jpn.pioneer/ja/car/dl/dmh-sz700_sf700/; https://www.zerodayinitiative.com/advisories/ZDI-24-1044/
CVE: CVE-2020-11936
Published: 2025-01-31
Description: gdbus setgid privilege escalation
CVSS Score: 3.1 (LOW)
References: https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1885633; https://www.cve.org/CVERecord?id=CVE-2020-11936
CVE: CVE-2022-1736
Published: 2025-01-31
Description: Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.
CVSS Score: 9.8 (CRITICAL)
References: https://bugs.launchpad.net/ubuntu/+source/gnome-remote-desktop/+bug/1973028; https://ubuntu.com/security/CVE-2022-1736; https://ubuntu.com/security/notices/USN-5430-1
CVE: CVE-2023-0092
Published: 2025-01-31
Description: An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://github.com/advisories/GHSA-x5rv-w9pm-8qp8; https://github.com/juju/juju/commit/ef803e2a13692d355b784b7da8b4b1f01dab1556
CVE: CVE-2024-13396
Published: 2025-01-31
Description: The Frictionless plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'frictionless_form' shortcode[s] in all versions up to, and including, 0.0.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/frictionless/trunk/frictionless.php; https://wordpress.org/plugins/frictionless/; https://www.wordfence.com/threat-intel/vulnerabilities/id/b1ec9dce-d0fb-4b7b-a8e4-4ccb474c9d57?source=cve
CVE: CVE-2024-13397
Published: 2025-01-31
Description: The WPRadio – WordPress Radio Streaming Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpradio_player' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wpradio/trunk/Frontend/Frontend.php#L140; https://plugins.trac.wordpress.org/changeset/3339006/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f153174a-1226-4c16-ba8b-637be1d7e742?source=cve
CVE: CVE-2024-13399
Published: 2025-01-31
Description: The Gosign – Posts Slider Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'posts-slider-block' block in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/gosign-posts-slider-block/; https://www.wordfence.com/threat-intel/vulnerabilities/id/0778c676-92e6-4813-a564-06463fc84eec?source=cve
CVE: CVE-2024-13767
Published: 2025-01-31
Description: The Live2DWebCanvas plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ClearFiles() function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3231778%40live-2d&new=3231778%40live-2d&sfp_email=&sfph_mail=#file4; https://wordpress.org/plugins/live-2d/; https://www.wordfence.com/threat-intel/vulnerabilities/id/23c89d9f-8958-4333-8604-54173c31efac?source=cve
CVE: CVE-2024-13817
Published: 2025-01-31
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2024-46974
Published: 2025-01-31
Description: Software installed and run as a non-privileged user may conduct improper read/write operations on imported/exported DMA buffers.
CVSS Score: 7.8 (HIGH)
CWE: CWE-266, CWE-274
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2024-13463
Published: 2025-01-31
Description: The SeatReg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'seatreg' shortcode in all versions up to, and including, 1.56.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3227873%40seatreg&new=3227873%40seatreg&sfp_email=&sfph_mail=#file1224; https://www.wordfence.com/threat-intel/vulnerabilities/id/769bc1fa-4f41-431e-9907-6e03d2c921be?source=cve
CVE: CVE-2024-47891
Published: 2025-01-31
Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2024-47898
Published: 2025-01-31
Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2024-47899
Published: 2025-01-31
Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger use-after-free kernel exceptions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2024-47900
Published: 2025-01-31
Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to access OOB kernel memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-823
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2025-0470
Published: 2025-01-31
Description: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title parameter in all versions up to, and including, 1.38.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/forminator/tags/1.38.2/requirejs/main.js; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3226716%40forminator%2Ftrunk&old=3222217%40forminator%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/f5281d4b-c2cd-4972-b837-e101a8893c6e?source=cve
CVE: CVE-2024-10867
Published: 2025-01-31
Description: The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3242543%40borderless%2Ftrunk&old=3242167%40borderless%2Ftrunk&sfp_email=&sfph_mail=#file12; https://wordpress.org/plugins/borderless/; https://www.wordfence.com/threat-intel/vulnerabilities/id/88b0acee-f378-487d-8ab9-96146e0cde10?source=cve
CVE: CVE-2025-0493
Published: 2025-01-31
Description: The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Limited  Local File Inclusion in all versions up to, and including, 4.2.14 via the tabname parameter. This makes it possible for unauthenticated attackers to include PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/4.2.14/classes/class-mvx-ajax.php#L661; https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/tags/4.2.15/classes/class-mvx-ajax.php#L661; https://www.wordfence.com/threat-intel/vulnerabilities/id/812029d9-95d6-4bc9-98b2-700f462163b3?source=cve
CVE: CVE-2025-0507
Published: 2025-01-31
Description: The Ticketmeo – Sell Tickets – Event Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ploxel/tags/2.2.0/ploxel.php#L49; https://plugins.trac.wordpress.org/changeset/3231203/; https://www.wordfence.com/threat-intel/vulnerabilities/id/149edbdf-4a27-4d79-8dd1-b5b3efbf648b?source=cve
CVE: CVE-2024-11886
Published: 2025-01-31
Description: The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vCitaMeetingScheduler ' shortcode in all versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/lead-capturing-call-to-actions-by-vcita/trunk/lead-capturing-call-to-actions.php#L44; https://plugins.trac.wordpress.org/browser/lead-capturing-call-to-actions-by-vcita/trunk/vcita-widgets-functions.php#L104; https://plugins.trac.wordpress.org/browser/lead-capturing-call-to-actions-by-vcita/trunk/vcita-widgets-functions.php#L63
CVE: CVE-2024-12275
Published: 2025-01-31
Description: The Canvasflow for WordPress plugin through 1.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ca5bf8bd-a124-4088-a267-fd8a01cb4f4a/; https://wpscan.com/vulnerability/ca5bf8bd-a124-4088-a267-fd8a01cb4f4a/
CVE: CVE-2024-12772
Published: 2025-01-31
Description: The Ninja Tables  WordPress plugin before 5.0.17 does not sanitize and escape a parameter before outputting it back in the page when importing a CSV, leading to a Cross Site Scripting vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7b6d0f95-6632-4079-8c1b-517a8d02c330/
CVE: CVE-2024-12872
Published: 2025-01-31
Description: The Zalomení WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a8a706c6-7f0f-4148-9f6f-40c0ca95dd9a/; https://wpscan.com/vulnerability/a8a706c6-7f0f-4148-9f6f-40c0ca95dd9a/
CVE: CVE-2024-13100
Published: 2025-01-31
Description: The OPSI Israel Domestic Shipments WordPress plugin through 2.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b9261010-ab55-4d18-8fd2-2003f8692ae8/; https://wpscan.com/vulnerability/b9261010-ab55-4d18-8fd2-2003f8692ae8/
CVE: CVE-2024-13101
Published: 2025-01-31
Description: The WP MediaTagger WordPress plugin through 4.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/03f51b54-0ec2-40ce-a0fa-ef0c4ab0ea99/
CVE: CVE-2024-13112
Published: 2025-01-31
Description: The WP MediaTagger WordPress plugin through 4.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/155df231-30ef-47bb-aa91-a7deb1779bd1/
CVE: CVE-2024-13216
Published: 2025-01-31
Description: The HT Event – WordPress Event Manager Plugin for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.7 via the 'render' function in /includes/widgets/htevent_sponsor.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, and draft template data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-359
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3233664%40ht-event&new=3233664%40ht-event&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/155f494b-be25-4269-9d3b-379309619bbe?source=cve
CVE: CVE-2024-13218
Published: 2025-01-31
Description: The Fast Tube WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/79eb9432-3e3c-4a23-88a8-05aa3146061c/
CVE: CVE-2024-13219
Published: 2025-01-31
Description: The Privacy Policy Genius WordPress plugin through 2.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/3ad02238-dce1-48ce-986f-fef36b110b2d/
CVE: CVE-2024-13220
Published: 2025-01-31
Description: The WordPress Google Map Professional (Map In Your Language) WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/33ef27b4-e88f-46ec-9b3f-0a3e16d6f82e/
CVE: CVE-2024-13221
Published: 2025-01-31
Description: The Fantastic ElasticSearch WordPress plugin through 4.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/693f4cc4-a082-46bc-abc9-a08919f70157/
CVE: CVE-2024-13222
Published: 2025-01-31
Description: The User Messages WordPress plugin through 1.2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/069e1f81-448d-4d27-b288-87111dade2f2/
CVE: CVE-2024-13223
Published: 2025-01-31
Description: The Tabulate WordPress plugin through 2.10.3 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e3a52af1-7cb6-4361-b1c7-a50e0cc62fb1/
CVE: CVE-2024-13224
Published: 2025-01-31
Description: The SlideDeck 1 Lite Content Slider WordPress plugin through 1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/32a90907-e82f-41b3-b20e-d10a722e2999/
CVE: CVE-2024-13225
Published: 2025-01-31
Description: The ECT Home Page Products WordPress plugin through 1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/8efd7d62-3f74-4108-970e-bd5ed24914ff/
CVE: CVE-2024-13226
Published: 2025-01-31
Description: The A5 Custom Login Page WordPress plugin through 2.8.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/dd09fe99-2334-4d6f-8a70-e1cd856b1486/