deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-37502
Published: 2024-07-09
Description: Deserialization of Untrusted Data vulnerability in wpweb WooCommerce Social Login woo-social-login.This issue affects WooCommerce Social Login: from n/a through <= 2.6.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/woo-social-login/vulnerability/wordpress-social-login-wordpress-woocommerce-plugin-plugin-2-6-3-php-object-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woo-social-login/wordpress-social-login-wordpress-woocommerce-plugin-plugin-2-6-3-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2024-3228
Published: 2024-07-09
Description: The Social Sharing Plugin – Kiwi plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.7 via the 'kiwi-nw-pinterest' class. This makes it possible for unauthenticated attackers to view limited content from password protected posts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3109786%40kiwi-social-share&new=3109786%40kiwi-social-share&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/896a038f-fe54-4120-842e-093ef236a898?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3109786%40kiwi-social-share&new=3109786%40kiwi-social-share&sfp_email=&sfph_mail=
CVE: CVE-2024-3563
Published: 2024-07-09
Description: The Genesis Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sharing block in all versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-3901 is a duplicate of this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/genesis-blocks/trunk/src/blocks/block-sharing/index.php#L268; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3115122%40genesis-blocks&new=3115122%40genesis-blocks&sfp_email=&sfph_mail=#file4; https://research.cleantalk.org/cve-2024-3901/
CVE: CVE-2024-3603
Published: 2024-07-09
Description: The OSM – OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'osm_map' shortcode in all versions up to, and including, 6.0.3 due to insufficient input sanitization and output escaping on user supplied attributes such as 'theme'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3153019/; https://wordpress.org/plugins/osm/; https://www.wordfence.com/threat-intel/vulnerabilities/id/845cea77-ea74-4459-817b-cfbdb877b75a?source=cve
CVE: CVE-2024-3604
Published: 2024-07-09
Description: The OSM – OpenStreetMap plugin for WordPress is vulnerable to SQL Injection via the 'tagged_filter' attribute of the 'osm_map_v3' shortcode in all versions up to, and including, 6.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/changeset/3153019; https://wordpress.org/plugins/osm/; https://www.wordfence.com/threat-intel/vulnerabilities/id/c8eebc67-e590-4d7f-8925-e5e5090cedf0?source=cve
CVE: CVE-2024-3608
Published: 2024-07-09
Description: The Product Designer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the product_designer_ajax_delete_attach_id() function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to delete arbitrary attachments. CVE-2024-38726 appears to be a duplicate of this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3129823/product-designer/trunk/includes/designer-function.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/2f127fe5-67b8-40e1-a916-c607410b08b3?source=cve; https://plugins.trac.wordpress.org/browser/product-designer/trunk/includes/designer-function.php#L412
CVE: CVE-2024-4100
Published: 2024-07-09
Description: The Pricing Table plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.1. This is due to missing or incorrect nonce validation on the ajax() function. This makes it possible for unauthenticated attackers to perform a variety of actions related to managing pricing tables via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/elfsight-pricing-table/trunk/core/includes/widgets-api.php#L71; https://www.wordfence.com/threat-intel/vulnerabilities/id/4cb3d2d4-256c-4128-9397-8b9c7be1b9c8?source=cve; https://plugins.trac.wordpress.org/browser/elfsight-pricing-table/trunk/core/includes/widgets-api.php#L71
CVE: CVE-2024-4102
Published: 2024-07-09
Description: The Pricing Table plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to, and including, 2.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform unauthorized actions like editing pricing tables.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/elfsight-pricing-table/trunk/core/includes/widgets-api.php#L71; https://www.wordfence.com/threat-intel/vulnerabilities/id/aa769d51-8718-42e9-9070-0b878442dbc7?source=cve; https://plugins.trac.wordpress.org/browser/elfsight-pricing-table/trunk/core/includes/widgets-api.php#L71
CVE: CVE-2024-4868
Published: 2024-07-09
Description: The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's EE Events and EE Flipbox widgets in all versions up to, and including, 2.0.32 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3121661/extensions-for-elementor/trunk/modules/events/widgets/ee-events.php; https://plugins.trac.wordpress.org/changeset/3121661/extensions-for-elementor/trunk/modules/flipbox/widgets/ee-flipbox.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/4322d9d6-13b6-4476-9eb5-fea4aff2e5ce?source=cve
CVE: CVE-2024-5456
Published: 2024-07-09
Description: The Panda Video plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.0 via the 'selected_button' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/pandavideo/trunk/includes/widgets/PandaButton.php#L237; https://plugins.trac.wordpress.org/changeset?old_path=/pandavideo/tags/1.4.0&new_path=/pandavideo/tags/1.4.1&sfp_email=&sfph_mail=#file8; https://www.wordfence.com/threat-intel/vulnerabilities/id/94ab250a-387c-431e-9b75-16ede94bf0ef?source=cve
CVE: CVE-2024-5457
Published: 2024-07-09
Description: The Panda Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/pandavideo/trunk/includes/assets/buttons/button-1.php#L6; https://plugins.trac.wordpress.org/browser/pandavideo/trunk/includes/assets/buttons/button-2.php#L7; https://plugins.trac.wordpress.org/browser/pandavideo/trunk/includes/assets/buttons/button-3.php#L8
CVE: CVE-2024-5479
Published: 2024-07-09
Description: The Easy Pixels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/easy-pixels-by-jevnet/trunk/admin/easyPixelsAdmin.php#L48; https://plugins.trac.wordpress.org/browser/easy-pixels-by-jevnet/trunk/classes/easy-pixels.php#L87; https://plugins.trac.wordpress.org/browser/easy-pixels-by-jevnet/trunk/easyPixels.php#L66
CVE: CVE-2024-5600
Published: 2024-07-09
Description: The SCSS Happy Compiler – Compile SCSS to CSS & Automatic Enqueue plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check and insufficient sanitization on the import_settings() function in all versions up to, and including, 1.3.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject malicious web scripts.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/happy-scss-compiler/trunk/admin/class-hm-wp-scss-admin.php#L384; https://www.wordfence.com/threat-intel/vulnerabilities/id/3d0ecffe-8543-4d82-a1cc-f2474499f373?source=cve; https://plugins.trac.wordpress.org/browser/happy-scss-compiler/trunk/admin/class-hm-wp-scss-admin.php#L384
CVE: CVE-2024-5648
Published: 2024-07-09
Description: The LearnDash LMS – Reports plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions (i.e. wrld_set_configuration, wrld_exclude_settings_save, apply_time_tracking_settings, wp_ajax_wrld_gutenberg_block_visit, etc..) in all versions up to, and including, 1.8.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to update various plugin settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wisdm-reports-for-learndash/trunk/includes/admin/class-admin-functions.php#L261; https://plugins.trac.wordpress.org/browser/wisdm-reports-for-learndash/trunk/includes/admin/class-admin-functions.php#L284; https://plugins.trac.wordpress.org/browser/wisdm-reports-for-learndash/trunk/includes/admin/class-admin-functions.php#L423
CVE: CVE-2024-5669
Published: 2024-07-09
Description: The XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ffw_activate_template' function in all versions up to, and including, 1.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to store cross-site scripting that will trigger when viewing the dashboard templates or accessing FAQs.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3126842/faq-for-woocommerce/trunk/includes/admin/faq-woocommerce-admin-functions.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/c5a404de-ee26-44af-9e4f-f93694da7a77?source=cve; https://plugins.trac.wordpress.org/browser/faq-for-woocommerce/trunk/includes/admin/faq-woocommerce-admin-functions.php#L471
CVE: CVE-2024-5704
Published: 2024-07-09
Description: The XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions (i.e. ffw_insert_new_faq, ffw_hide_discount_notice, ffw_delete_all_faqs, ffw_delete_single_faq, etc...) in all versions up to, and including, 1.7.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to add new and update existing FAQs, FAQ lists, and modify FAQ associations with products.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3126842/faq-for-woocommerce/trunk/includes/admin/faq-woocommerce-admin-functions.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/1d3e476d-0885-4e8c-a682-bd64d9f13b53?source=cve; https://plugins.trac.wordpress.org/browser/faq-for-woocommerce/trunk/includes/admin/faq-woocommerce-admin-functions.php#L100
CVE: CVE-2024-5810
Published: 2024-07-09
Description: The WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.1. This is due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible for unauthenticated attackers to overwrite CSS, update the trial settings, purge the cache, and find attachments.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-798
References: https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L152; https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L165; https://plugins.trac.wordpress.org/browser/wp2speed/trunk/lib/includes/optimize.php#L263
CVE: CVE-2024-5856
Published: 2024-07-09
Description: The Comment Images Reloaded plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the cir_delete_image AJAX action in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary media attachments.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/comment-images-reloaded/trunk/functions/delete-comment.php#L7; https://www.wordfence.com/threat-intel/vulnerabilities/id/4f2dc3e7-1e10-4547-8469-726c6747465d?source=cve; https://plugins.trac.wordpress.org/browser/comment-images-reloaded/trunk/functions/delete-comment.php#L7
CVE: CVE-2024-5937
Published: 2024-07-09
Description: The Simple Alert Boxes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Alert shortcode in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/simple-alert-boxes/trunk/plugin.php#L71; https://www.wordfence.com/threat-intel/vulnerabilities/id/a25ad405-a97e-4821-b57a-0f39d5ce5e70?source=cve; https://plugins.trac.wordpress.org/browser/simple-alert-boxes/trunk/plugin.php#L71
CVE: CVE-2024-5992
Published: 2024-07-09
Description: The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_chatbot_token' and 'update_chatbot_position' functions in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to change chatbot settings, which can lead to unavailability or other changes to the chatbot.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3118688/; https://www.wordfence.com/threat-intel/vulnerabilities/id/a7f0afe8-234a-4c3f-87c8-f3f23ac94fe3?source=cve; https://plugins.trac.wordpress.org/browser/cliengo/trunk/admin/class-cliengo-form.php#L80
CVE: CVE-2024-5993
Published: 2024-07-09
Description: The Cliengo – Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_session' function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the session token of the chatbot.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3118688/; https://www.wordfence.com/threat-intel/vulnerabilities/id/0a13e87d-51cd-43b0-a658-900a174738fc?source=cve; https://plugins.trac.wordpress.org/browser/cliengo/trunk/admin/class-cliengo-form.php#L109
CVE: CVE-2024-6069
Published: 2024-07-09
Description: The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pieregister_install_addon function in all versions up to, and including, 3.8.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins. As a result attackers might achieve code execution on the targeted server
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/pie-register/tags/3.8.3.4/pie-register.php#L727; https://plugins.trac.wordpress.org/browser/pie-register/tags/3.8.3.4/pie-register.php#L761; https://plugins.trac.wordpress.org/browser/pie-register/tags/3.8.3.4/pie-register.php#L794
CVE: CVE-2024-6167
Published: 2024-07-09
Description: The Just Custom Fields plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several AJAX functions in all versions up to, and including, 3.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke this functionality intended for admin users. This enables subscribers to manage field groups, change visibility of items among other things.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://wordpress.org/plugins/just-custom-fields; https://www.wordfence.com/threat-intel/vulnerabilities/id/14d71220-be60-498d-92ca-055f1c237060?source=cve; https://wordpress.org/plugins/just-custom-fields
CVE: CVE-2024-6168
Published: 2024-07-09
Description: The Just Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.2. This is due to missing or incorrect nonce validation on several AJAX function. This makes it possible for unauthenticated attackers to invoke this functionality intended for admin users via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This enables subscribers to manage field groups, change visibility of items among other things.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wordpress.org/plugins/just-custom-fields; https://www.wordfence.com/threat-intel/vulnerabilities/id/9d98946e-864f-434e-8f45-85d663bbefee?source=cve; https://wordpress.org/plugins/just-custom-fields
CVE: CVE-2023-3285
Published: 2024-07-09
Description: A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system (including admin). This results in unauthorized data manipulation.
CVSS Score: 7.7 (HIGH)
CWE: CWE-639
References: https://github.com/alextselegidis/easyappointments; https://github.com/alextselegidis/easyappointments
CVE: CVE-2024-35777
Published: 2024-07-09
Description: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Automattic WooCommerce allows Content Spoofing.This issue affects WooCommerce: from n/a through 8.9.2.
CVSS Score: 3.5 (LOW)
CWE: CWE-74
References: https://patchstack.com/database/vulnerability/woocommerce/wordpress-woocommerce-plugin-8-9-2-content-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce/wordpress-woocommerce-plugin-8-9-2-content-injection-vulnerability?_s_id=cve
CVE: CVE-2024-37090
Published: 2024-07-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Masterstudy Elementor Widgets, StylemixThemes Consulting Elementor Widgets.This issue affects Masterstudy Elementor Widgets: from n/a through 1.2.2; Consulting Elementor Widgets: from n/a through 1.3.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/consulting-elementor-widgets/wordpress-consulting-elementor-widgets-plugin-1-3-0-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/masterstudy-elementor-widgets/wordpress-masterstudy-elementor-widgets-plugin-1-2-2-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/consulting-elementor-widgets/wordpress-consulting-elementor-widgets-plugin-1-3-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-37224
Published: 2024-07-09
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager: from n/a through 4.71.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/sp-client-document-manager/wordpress-sp-project-document-manager-plugin-4-71-directory-traversal-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/sp-client-document-manager/wordpress-sp-project-document-manager-plugin-4-71-directory-traversal-vulnerability?_s_id=cve
CVE: CVE-2024-37253
Published: 2024-07-09
Description: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in WpDirectoryKit WP Directory Kit allows Code Injection.This issue affects WP Directory Kit: from n/a through 1.3.6.
CVSS Score: 2.7 (LOW)
CWE: CWE-74, CWE-79
References: https://patchstack.com/database/vulnerability/wpdirectorykit/wordpress-wpdirectorykit-plugin-1-3-2-html-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wpdirectorykit/wordpress-wpdirectorykit-plugin-1-3-2-html-injection-vulnerability?_s_id=cve
CVE: CVE-2024-37266
Published: 2024-07-09
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Tutor LMS allows Path Traversal.This issue affects Tutor LMS: from n/a through 2.7.1.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/tutor/wordpress-tutor-lms-plugin-2-7-1-path-traversal-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/tutor/wordpress-tutor-lms-plugin-2-7-1-path-traversal-vulnerability?_s_id=cve
CVE: CVE-2024-37268
Published: 2024-07-09
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in kaptinlin Striking allows Path Traversal.This issue affects Striking: from n/a through 2.3.4.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/vulnerability/striking-r/wordpress-striking-theme-2-3-4-local-file-inclusion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/striking-r/wordpress-striking-theme-2-3-4-local-file-inclusion-vulnerability?_s_id=cve