deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-41115
Published: 2024-07-26
Description: streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `palette` variable on line 488 in `pages/1_📷_Timelapse.py` takes user input, which is later used in the `eval()` function on line 493, leading to remote code execution. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/1_%F0%9F%93%B7_Timelapse.py#L488; https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/1_%F0%9F%93%B7_Timelapse.py#L493; https://github.com/opengeos/streamlit-geospatial/commit/c4f81d9616d40c60584e36abb15300853a66e489
CVE: CVE-2024-41116
Published: 2024-07-26
Description: streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` variable on line 1254 in `pages/1_📷_Timelapse.py` takes user input, which is later used in the `eval()` function on line 1345, leading to remote code execution. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/1_%F0%9F%93%B7_Timelapse.py#L1254; https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/1_%F0%9F%93%B7_Timelapse.py#L1345; https://github.com/opengeos/streamlit-geospatial/commit/c4f81d9616d40c60584e36abb15300853a66e489
CVE: CVE-2024-41117
Published: 2024-07-26
Description: streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` variable on line 115 in `pages/10_🌍_Earth_Engine_Datasets.py` takes user input, which is later used in the `eval()` function on line 126, leading to remote code execution. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/10_%F0%9F%8C%8D_Earth_Engine_Datasets.py#L115; https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/10_%F0%9F%8C%8D_Earth_Engine_Datasets.py#L126; https://github.com/opengeos/streamlit-geospatial/commit/c4f81d9616d40c60584e36abb15300853a66e489
CVE: CVE-2024-41118
Published: 2024-07-26
Description: streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `url` variable on line 47 of `pages/7_📦_Web_Map_Service.py` takes user input, which is passed to `get_layers` function, in which `url` is used with `get_wms_layer` method. `get_wms_layer` method creates a request to arbitrary destinations, leading to blind server-side request forgery. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/7_%F0%9F%93%A6_Web_Map_Service.py#L25; https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/7_%F0%9F%93%A6_Web_Map_Service.py#L47; https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/7_%F0%9F%93%A6_Web_Map_Service.py#L53
CVE: CVE-2024-41119
Published: 2024-07-26
Description: streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` variable on line 80 in `8_🏜️_Raster_Data_Visualization.py` takes user input, which is later used in the `eval()` function on line 86, leading to remote code execution. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/8_%F0%9F%8F%9C%EF%B8%8F_Raster_Data_Visualization.py#L80; https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/8_%F0%9F%8F%9C%EF%B8%8F_Raster_Data_Visualization.py#L86; https://github.com/opengeos/streamlit-geospatial/commit/c4f81d9616d40c60584e36abb15300853a66e489
CVE: CVE-2024-41120
Published: 2024-07-26
Description: streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `url` variable on line 63 of `pages/9_🔲_Vector_Data_Visualization.py` takes user input, which is later passed to the `gpd.read_file` method. `gpd.read_file` method creates a request to arbitrary destinations, leading to blind server-side request forgery. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-918
References: https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/9_%F0%9F%94%B2_Vector_Data_Visualization.py#L63; https://github.com/opengeos/streamlit-geospatial/blob/4b89495f3bdd481998aadf1fc74b10de0f71c237/pages/9_%F0%9F%94%B2_Vector_Data_Visualization.py#L87; https://github.com/opengeos/streamlit-geospatial/commit/c4f81d9616d40c60584e36abb15300853a66e489
CVE: CVE-2024-41628
Published: 2024-07-26
Description: Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9780 allows a remote attacker to include and display file content in an HTTP request via the CMON API.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://clustercontrol.com; http://severalnines.com; https://docs.severalnines.com/docs/clustercontrol/changelogs/changes-in-v1-9-8/#maintenance-release-july-24th-2024
CVE: CVE-2024-41815
Published: 2024-07-26
Description: Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone. Version 1.20.0 fixes the vulnerability.
CVSS Score: 7.4 (HIGH)
CWE: CWE-77, CWE-78
References: https://github.com/starship/starship/commit/cfc58161e0ec595db90af686ad77a73df6d44d74; https://github.com/starship/starship/releases/tag/v1.20.0; https://github.com/starship/starship/security/advisories/GHSA-vx24-x4mv-vwr5
CVE: CVE-2024-37034
Published: 2024-07-26
Description: An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. It does not ensure that credentials are negotiated with the Key-Value (KV) service using SCRAM-SHA when remote link encryption is configured for Half-Secure.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326, CWE-326
References: https://www.couchbase.com/alerts/; https://www.couchbase.com/alerts/
CVE: CVE-2024-40433
Published: 2024-07-26
Description: Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate privileges via the web-view component.
CVSS Score: 8.8 (HIGH)
CWE: CWE-266
References: https://github.com/yikaikkk/CookieShareInWebView/blob/master/README.md; https://github.com/yikaikkk/CookieShareInWebView/blob/master/README.md
CVE: CVE-2024-1798
Published: 2024-07-27
Description: The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the tutor_lp_export_xml function in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to export courses, including private and password protected courses.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/tutor-lms-migration-tool/trunk/classes/LPtoTutorMigration.php#L762; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3132123%40tutor-lms-migration-tool&new=3132123%40tutor-lms-migration-tool&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/0cb67f55-6d21-4a4e-9651-fcf671788d16?source=cve
CVE: CVE-2024-1804
Published: 2024-07-27
Description: The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tutor_import_from_xml function in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to import courses.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/tutor-lms-migration-tool/trunk/classes/LPtoTutorMigration.php#L579; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3132123%40tutor-lms-migration-tool&new=3132123%40tutor-lms-migration-tool&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/0a49a22e-d54e-461d-83c2-8278494eac13?source=cve
CVE: CVE-2024-4410
Published: 2024-07-27
Description: The IgnitionDeck Crowdfunding Platform plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.9.8. This is due to missing capability checks on various functions called via AJAX actions in the ~/classes/class-idf-wizard.php file. This makes it possible for authenticated attackers, with subscriber access or higher, to execute various AJAX actions. This includes actions to change the permalink structure, plugin settings and others.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/ignitiondeck/trunk/classes/class-idf-wizard.php#L1162; https://plugins.trac.wordpress.org/browser/ignitiondeck/trunk/classes/class-idf-wizard.php#L186; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3134431%40ignitiondeck%2Ftrunk&old=3097520%40ignitiondeck%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-6152
Published: 2024-07-27
Description: The Flipbox Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5 via deserialization of untrusted input in the flipbox_builder_Flipbox_ShortCode function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/flipbox-builder/trunk/template-front/shortcode.php#L30; https://www.wordfence.com/threat-intel/vulnerabilities/id/0e9cd38a-b2cd-4801-a06b-4e965fa72e04?source=cve; https://plugins.trac.wordpress.org/browser/flipbox-builder/trunk/template-front/shortcode.php#L30
CVE: CVE-2024-6431
Published: 2024-07-27
Description: The Media.net Ads Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and missing capability check in the 'sendMail' function in all versions up to, and including, 2.10.13. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability is only exploitable if anyone has ever logged in through the API.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/media-net-ads-manager/tags/2.10.13/app/admin/MnetAdHandleAjaxCalls.php#L206; https://www.wordfence.com/threat-intel/vulnerabilities/id/54fac673-2d83-4d06-a4c0-8bffc269a90c?source=cve; https://plugins.trac.wordpress.org/browser/media-net-ads-manager/tags/2.10.13/app/admin/MnetAdHandleAjaxCalls.php#L206
CVE: CVE-2024-6545
Published: 2024-07-27
Description: The Admin Trim Interface plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.5.1. This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/admin-trim-interface/trunk/tests/bootstrap.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/92a50f24-7011-4fe4-a095-e7e320bfec81?source=cve; https://plugins.trac.wordpress.org/browser/admin-trim-interface/trunk/tests/bootstrap.php
CVE: CVE-2024-6546
Published: 2024-07-27
Description: The One Click Close Comments plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.7.1. This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/one-click-close-comments/tags/2.7.1/tests/bootstrap.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3276182%40one-click-close-comments&new=3276182%40one-click-close-comments&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/feb63b10-fe23-4f89-9ef3-0a61b4190320?source=cve
CVE: CVE-2024-6547
Published: 2024-07-27
Description: The Add Admin CSS plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1.  This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/add-admin-css/trunk/tests/phpunit/bootstrap.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3284552%40add-admin-css&new=3284552%40add-admin-css&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/0064244b-72a4-486d-aaad-be1f57e4a8a1?source=cve
CVE: CVE-2024-6548
Published: 2024-07-27
Description: The Add Admin JavaScript plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0. This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/add-admin-javascript/trunk/tests/phpunit/bootstrap.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/1069c845-30b9-4aca-8a60-8b66c48365af?source=cve; https://plugins.trac.wordpress.org/browser/add-admin-javascript/trunk/tests/phpunit/bootstrap.php
CVE: CVE-2024-6549
Published: 2024-07-27
Description: The Admin Post Navigation plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1. This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/admin-post-navigation/trunk/tests/bootstrap.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/d27ef0b4-266f-47b8-a7aa-ddff5adaac7a?source=cve; https://plugins.trac.wordpress.org/browser/admin-post-navigation/trunk/tests/bootstrap.php
CVE: CVE-2024-6566
Published: 2024-07-27
Description: The Aramex Shipping WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.21. This is due the plugin not preventing direct access to the composer-setup.php file which also has display_errors enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/aramex-shipping-woocommerce/trunk/vendor/jurosh/pdf-merge/bin/composer-setup.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/d62bd71c-3d08-4767-b471-a1d5a17fe6ba?source=cve; https://plugins.trac.wordpress.org/browser/aramex-shipping-woocommerce/trunk/vendor/jurosh/pdf-merge/bin/composer-setup.php
CVE: CVE-2024-6573
Published: 2024-07-27
Description: The Intelligence plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.0. This is due the plugin not preventing direct access to the /vendor/levelten/intel/realtime/index.php file and display_errors being enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/intelligence/trunk/vendor/levelten/intel/realtime/index.php; https://plugins.trac.wordpress.org/browser/intelligence/trunk/vendor/levelten/intel/realtime/settings.php#L12; https://www.wordfence.com/threat-intel/vulnerabilities/id/b5aa0222-1e70-4c06-860f-77643da4356c?source=cve
CVE: CVE-2024-6591
Published: 2024-07-27
Description: The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized email creation and sending due to a missing capability check on the 'send_auction_email_callback' and 'resend_auction_email_callback' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to craft emails that include links and send to any email address.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3132812/ultimate-auction/trunk/ultimate-auction.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/534a5d1d-cc34-4d84-b3a3-bf[PII_REDACTED]?source=cve; https://plugins.trac.wordpress.org/browser/ultimate-auction/trunk/ultimate-auction.php#L119
CVE: CVE-2024-6634
Published: 2024-07-27
Description: The Master Currency WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's currencyconverterform shortcode in all versions up to, and including, 1.1.61 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/mastercurrency-wp/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/fea71287-f92e-43e5-adbf-d89fce437e56?source=cve; https://wordpress.org/plugins/mastercurrency-wp/#developers
CVE: CVE-2024-6661
Published: 2024-07-27
Description: The ParityPress – Parity Pricing with Discount Rules plugin for WordPress is vulnerable to Stored Cross-Site Scripting via  'Discount Text' in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/paritypress/trunk/app/Hooks/Activator.php#L22; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3130198%40paritypress%2Ftrunk&old=3042149%40paritypress%2Ftrunk&sfp_email=&sfph_mail=; https://wordpress.org/plugins/paritypress/#developers
CVE: CVE-2024-42029
Published: 2024-07-27
Description: xdg-desktop-portal-hyprland (aka an XDG Desktop Portal backend for Hyprland) before 1.3.3 allows OS command execution, e.g., because single quotes are not used when sending a list of app IDs and titles via the environment.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-78
References: https://github.com/hyprwm/xdg-desktop-portal-hyprland/commit/0bb709491baffd69f4f861802f00cf60c77cc2cd; https://github.com/hyprwm/xdg-desktop-portal-hyprland/issues/242; https://github.com/hyprwm/xdg-desktop-portal-hyprland/releases/tag/v1.3.3
CVE: CVE-2024-5969
Published: 2024-07-27
Description: The AIomatic - Automatic AI Content Writer for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 2.0.5. This is due to insufficient limitations on the email recipient and the content in the 'aiomatic_send_email' function which are reachable via AJAX. This makes it possible for unauthenticated attackers to send emails with any content to any recipient.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: https://codecanyon.net/item/aiomatic-automatic-ai-content-writer/38877369?srsltid=AfmBOornCSKshlaSyZi2nonTcpSskMpBNJpdAS_No91A5V5lTIAD1h8S; https://www.wordfence.com/threat-intel/vulnerabilities/id/be5be40f-89da-4b97-9a85-527602d84c4d?source=cve; https://codecanyon.net/item/aiomatic-automatic-ai-content-writer/38877369?srsltid=AfmBOornCSKshlaSyZi2nonTcpSskMpBNJpdAS_No91A5V5lTIAD1h8S
CVE: CVE-2024-6458
Published: 2024-07-27
Description: The WooCommerce Product Table Lite plugin for WordPress is vulnerable to unauthorized post title modification due to a missing capability check on the wcpt_presets__duplicate_preset_to_table function in all versions up to, and including, 3.5.1. This makes it possible for authenticated attackers with subscriber access and above to change titles of arbitrary posts. Missing sanitization can lead to Stored Cross-Site Scripting when viewed by an admin via the WooCommerce Product Table.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/wc-product-table-lite/trunk/presets/presets.php#L120; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3125858%40wc-product-table-lite&new=3125858%40wc-product-table-lite&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/e06fb465-4c72-49a8-af35-ff6d629ff9a0?source=cve