deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-2117
Published: 2024-04-09
Description: The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Path Widget in all versions up to, and including, 3.20.2 due to insufficient output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3058940%40elementor&new=3058940%40elementor&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c8d7448a-b8a6-4b0b-92df-a15272fc56bf?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3058940%40elementor&new=3058940%40elementor&sfp_email=&sfph_mail=
CVE: CVE-2024-2125
Published: 2024-04-09
Description: The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the gallery_add function. This makes it possible for unauthenticated attackers to upload malicious files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The Cross-Site Request Forgery was patched in 2.4, however, nothing was done about the ability to upload arbitrary files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-352
References: https://plugins.trac.wordpress.org/browser/envialosimple-email-marketing-y-newsletters-gratis/trunk/api/gallery.php#L29; https://plugins.trac.wordpress.org/changeset/3065710/; https://www.wordfence.com/threat-intel/vulnerabilities/id/2b39abc8-9281-4d58-a9ec-877c5bae805a?source=cve
CVE: CVE-2024-2138
Published: 2024-04-09
Description: The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animated Box widget in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3050010/jetwidgets-for-elementor; https://www.wordfence.com/threat-intel/vulnerabilities/id/f807b605-68a8-4340-a275-776eac0936fa?source=cve; https://plugins.trac.wordpress.org/changeset/3050010/jetwidgets-for-elementor
CVE: CVE-2024-2165
Published: 2024-04-09
Description: The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt parameter in all versions up to, and including, 7.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3056025%40wp-seopress%2Ftrunk&old=3047913%40wp-seopress%2Ftrunk&sfp_email=&sfph_mail=#file14; https://www.wordfence.com/threat-intel/vulnerabilities/id/46e66230-06d6-452e-a7aa-862b2bb8c27d?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3056025%40wp-seopress%2Ftrunk&old=3047913%40wp-seopress%2Ftrunk&sfp_email=&sfph_mail=#file14
CVE: CVE-2024-2181
Published: 2024-04-09
Description: The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3046905/wpzoom-addons-for-beaver-builder; https://www.wordfence.com/threat-intel/vulnerabilities/id/6baa44c7-1c13-45ad-9fb5-da06933f3cd0?source=cve; https://plugins.trac.wordpress.org/changeset/3046905/wpzoom-addons-for-beaver-builder
CVE: CVE-2024-2183
Published: 2024-04-09
Description: The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-30424 is likely a duplicate of this issue.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3046905/wpzoom-addons-for-beaver-builder; https://www.wordfence.com/threat-intel/vulnerabilities/id/781987af-3753-46ec-9d56-fb8b6ef42277?source=cve; https://plugins.trac.wordpress.org/changeset/3046905/wpzoom-addons-for-beaver-builder
CVE: CVE-2024-2185
Published: 2024-04-09
Description: The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Box widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3046905/wpzoom-addons-for-beaver-builder; https://www.wordfence.com/threat-intel/vulnerabilities/id/03564cae-df90-454b-8379-6ad9f22b7389?source=cve; https://plugins.trac.wordpress.org/changeset/3046905/wpzoom-addons-for-beaver-builder
CVE: CVE-2024-2186
Published: 2024-04-09
Description: The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Team Members widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3046905/wpzoom-addons-for-beaver-builder; https://www.wordfence.com/threat-intel/vulnerabilities/id/746385e0-6bb9-47f2-a3e7-72f8e28be731?source=cve; https://plugins.trac.wordpress.org/changeset/3046905/wpzoom-addons-for-beaver-builder
CVE: CVE-2024-2187
Published: 2024-04-09
Description: The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonials widget in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3046905/wpzoom-addons-for-beaver-builder; https://www.wordfence.com/threat-intel/vulnerabilities/id/02fceb91-7691-4629-b18b-57959e9f3f62?source=cve; https://plugins.trac.wordpress.org/changeset/3046905/wpzoom-addons-for-beaver-builder
CVE: CVE-2024-2198
Published: 2024-04-09
Description: The Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cntctfrm_contact_address’ parameter in all versions up to, and including, 4.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3047840/contact-form-plugin; https://www.wordfence.com/threat-intel/vulnerabilities/id/5eb66ca3-768e-4d8c-a0fa-74e78250aee3?source=cve; https://plugins.trac.wordpress.org/changeset/3047840/contact-form-plugin
CVE: CVE-2024-2200
Published: 2024-04-09
Description: The Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cntctfrm_contact_subject’ parameter in all versions up to, and including, 4.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3047840/contact-form-plugin; https://www.wordfence.com/threat-intel/vulnerabilities/id/28[PII_REDACTED]-4fca-afe8-71b3f2dd983d?source=cve; https://plugins.trac.wordpress.org/changeset/3047840/contact-form-plugin
CVE: CVE-2024-2222
Published: 2024-04-09
Description: The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the ajax_callback_delete_attachment function in all versions up to, and including, 3.0.0. This makes it possible for authenticated attackers, with subscriber access or higher, to delete arbitrary media uploads.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/advanced-classifieds-and-directory-pro/trunk/admin/admin.php#L757; https://plugins.trac.wordpress.org/browser/advanced-classifieds-and-directory-pro/trunk/public/user.php#L689; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3054455%40advanced-classifieds-and-directory-pro%2Ftrunk&old=3012747%40advanced-classifieds-and-directory-pro%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-2226
Published: 2024-04-09
Description: The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id parameter in the google-map block in all versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access and higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3050429/otter-blocks; https://www.wordfence.com/threat-intel/vulnerabilities/id/217d3148-d411-4fff-a4f6-d5d02ef207af?source=cve; https://plugins.trac.wordpress.org/changeset/3050429/otter-blocks
CVE: CVE-2024-2261
Published: 2024-04-09
Description: The Event Tickets and Registration plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.8.2 via the RSVP functionality. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including emails and street addresses.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset?old_path=/event-tickets/tags/5.8.2&old=3059268&new_path=/event-tickets/tags/5.8.3&new=3059268&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/2e42dd1c-adf7-471a-a14a-9038c56413a2?source=cve; https://plugins.trac.wordpress.org/changeset?old_path=/event-tickets/tags/5.8.2&old=3059268&new_path=/event-tickets/tags/5.8.3&new=3059268&sfp_email=&sfph_mail=
CVE: CVE-2024-2287
Published: 2024-04-09
Description: The Knight Lab Timeline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.9.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?old_path=/knight-lab-timelinejs/tags/3.9.3.3&old=3051910&new_path=/knight-lab-timelinejs/tags/3.9.3.4&new=3051910&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/afb3e68e-6f79-4c46-b41e-8fd6eb43c755?source=cve; https://plugins.trac.wordpress.org/changeset?old_path=/knight-lab-timelinejs/tags/3.9.3.3&old=3051910&new_path=/knight-lab-timelinejs/tags/3.9.3.4&new=3051910&sfp_email=&sfph_mail=
CVE: CVE-2024-2289
Published: 2024-04-09
Description: The PowerPack Lite for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link in multiple elements in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3051551/; https://www.wordfence.com/threat-intel/vulnerabilities/id/a22c7b45-752c-482d-8812-888d5bc3d630?source=cve; https://plugins.trac.wordpress.org/changeset/3051551/
CVE: CVE-2024-2302
Published: 2024-04-09
Description: The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.9. This makes it possible for unauthenticated attackers to download the debug log via Directory Listing. This file may include PII.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://plugins.trac.wordpress.org/browser/easy-digital-downloads/trunk/includes/class-edd-logging.php#L621; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3060808%40easy-digital-downloads%2Ftrunk&old=3042139%40easy-digital-downloads%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/0837ba20-4b47-4cc8-9eb3-322289513d79?source=cve
CVE: CVE-2024-2305
Published: 2024-04-09
Description: The Cards for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the BootstrapCard link  in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?old_path=/bb-bootstrap-cards/tags/1.1.2&old=3056277&new_path=/bb-bootstrap-cards/tags/1.1.3&new=3056277&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ac0dfaac-cce6-45f7-ad5b-d7dcb66453bd?source=cve; https://plugins.trac.wordpress.org/changeset?old_path=/bb-bootstrap-cards/tags/1.1.2&old=3056277&new_path=/bb-bootstrap-cards/tags/1.1.3&new=3056277&sfp_email=&sfph_mail=
CVE: CVE-2024-2306
Published: 2024-04-09
Description: The Revslider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg upload in all versions up to, and including, 6.6.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure revslider can be extended to authors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.sliderrevolution.com/documentation/changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f6af1e90-9bad-470b-9e00-137000c0450c?source=cve; https://www.sliderrevolution.com/documentation/changelog/
CVE: CVE-2024-2311
Published: 2024-04-09
Description: The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.11.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://gist.github.com/Xib3rR4dAr/8b0f2bf40092e00851fe2f57f15e947e; https://gist.github.com/Xib3rR4dAr/af52a553c[PII_REDACTED]1189d53c1d4fe; https://gist.github.com/Xib3rR4dAr/d3c36f7befe7d380ed240d3cb141d64c
CVE: CVE-2024-2325
Published: 2024-04-09
Description: The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the searchll parameter in all versions up to, and including, 7.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3050134/link-library; https://www.wordfence.com/threat-intel/vulnerabilities/id/b93af9cc-cd9a-4bbb-8cb1-bf45c59e469c?source=cve; https://plugins.trac.wordpress.org/changeset/3050134/link-library
CVE: CVE-2024-2327
Published: 2024-04-09
Description: The Global Elementor Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button link URL in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/global-elementor-buttons/; https://www.wordfence.com/threat-intel/vulnerabilities/id/d84f9b06-9127-4526-8f17-21608ec2f601?source=cve; https://wordpress.org/plugins/global-elementor-buttons/
CVE: CVE-2024-2334
Published: 2024-04-09
Description: The Template Kit – Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the template upload functionality in all versions up to, and including, 1.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/template-kit-import/trunk/vendor/template-kit-import/inc/class-importer.php#L61; https://plugins.trac.wordpress.org/changeset/3058805/; https://www.wordfence.com/threat-intel/vulnerabilities/id/6203a15d-f90f-4147-8e43-afc424bbb750?source=cve
CVE: CVE-2024-2335
Published: 2024-04-09
Description: The Elements Plus! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget link URLs in all versions up to, and including, 2.16.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?old_path=/elements-plus/tags/2.16.2&old=3051181&new_path=/elements-plus/tags/2.16.3&new=3051181&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/9efb7dc8-d0a1-4707-a465-6a55b2d4a426?source=cve; https://plugins.trac.wordpress.org/changeset?old_path=/elements-plus/tags/2.16.2&old=3051181&new_path=/elements-plus/tags/2.16.3&new=3051181&sfp_email=&sfph_mail=
CVE: CVE-2024-2336
Published: 2024-04-09
Description: The Popup Maker – Popup for opt-ins, lead gen, & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.18.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3053244%40popup-maker%2Ftrunk&old=2989642%40popup-maker%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/40e1215c-ac00-4fd6-b428-a57cef95aed1?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3053244%40popup-maker%2Ftrunk&old=2989642%40popup-maker%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-2340
Published: 2024-04-09
Description: The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form with a file upload mechanism.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-548
References: https://avada.com/documentation/avada-changelog/; https://www.wordfence.com/threat-intel/vulnerabilities/id/8db8bbc3-43ca-4ef5-a44d-2987c8597961?source=cve; https://avada.com/documentation/avada-changelog/