deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-47727
Published: 2024-05-02
Description: IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.20.0 could allow an authenticated user to modify dashboard parameters due to improper input validation.  IBM X-Force ID:  272089.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/272089; https://www.ibm.com/support/pages/node/7149968; https://exchange.xforce.ibmcloud.com/vulnerabilities/272089
CVE: CVE-2024-3544
Published: 2024-05-02
Description: 
Unauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group. This vulnerability has been closed by enhancing LoadMaster partner communications to require a shared secret that must be exchanged between the partners before communication can proceed.


CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://kemptechnologies.com/; https://support.kemptechnologies.com/hc/en-us/articles/[PII_REDACTED]8605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543; https://kemptechnologies.com/
CVE: CVE-2024-4029
Published: 2024-05-02
Description: A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile limit as there is no possibility to configure or set a maximum number of connections.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-770
References: https://access.redhat.com/errata/RHSA-2024:8075; https://access.redhat.com/errata/RHSA-2024:8076; https://access.redhat.com/errata/RHSA-2024:8077
CVE: CVE-2024-4405
Published: 2024-05-02
Description: Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xiaomi Pro 13 smartphones. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the manual-upgrade.html file. When parsing the manualUpgradeInfo parameter, the process does not properly sanitize user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22379.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://www.zerodayinitiative.com/advisories/ZDI-24-418/; https://www.zerodayinitiative.com/advisories/ZDI-24-418/
CVE: CVE-2024-4406
Published: 2024-05-02
Description: Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xiaomi Pro 13 smartphones. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the integral-dialog-page.html file. When parsing the integralInfo parameter, the process does not properly sanitize user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22332.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://www.zerodayinitiative.com/advisories/ZDI-24-419/; https://www.zerodayinitiative.com/advisories/ZDI-24-419/
CVE: CVE-2023-50685
Published: 2024-05-02
Description: An issue in Hipcam Cameras RealServer v.1.0 allows a remote attacker to cause a denial of service via a crafted script to the client_port parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/UnderwaterCoder/Hipcam-RTSP-Format-Validation-Vulnerability; https://github.com/UnderwaterCoder/Hipcam-RTSP-Format-Validation-Vulnerability
CVE: CVE-2024-29309
Published: 2024-05-02
Description: An issue in Alfresco Content Services v.23.3.0.7 allows a remote attacker to execute arbitrary code via the Transfer Service.
CVSS Score: 7.7 (HIGH)
CWE: CWE-94
References: https://gist.github.com/Siebene/c22e1a4a4a8b[PII_REDACTED]5895e60858; https://gist.github.com/Siebene/c22e1a4a4a8b[PII_REDACTED]5895e60858
CVE: CVE-2024-31963
Published: 2024-05-02
Description: A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1.1 SP8 allows an authenticated attacker to conduct a buffer overflow attack due to insufficient bounds checking and input sanitization. A successful exploit could allow an attacker to gain access to sensitive information, modify system configuration or execute arbitrary commands within the context of the system.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-120
References: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0006; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0006
CVE: CVE-2024-31964
Published: 2024-05-02
Description: A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1.1 SP8 allows an unauthenticated attacker to conduct an authentication bypass attack due to improper authentication control. A successful exploit could allow an attacker to modify system configuration settings and potentially cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0007; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0007
CVE: CVE-2024-31965
Published: 2024-05-02
Description: A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1.1 SP8 allows an authenticated attacker with administrative privilege to conduct a path traversal attack due to insufficient input validation. A successful exploit could allow an attacker to access sensitive information.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-20, CWE-22
References: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0008; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0008
CVE: CVE-2024-31966
Published: 2024-05-02
Description: A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1.1 SP8 allows an authenticated attacker with administrative privilege to conduct an argument injection attack due to insufficient parameter sanitization. A successful exploit could allow an attacker to access sensitive information, modify system configuration or execute arbitrary commands.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-88
References: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0009; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0009
CVE: CVE-2024-31967
Published: 2024-05-02
Description: A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1.1 SP8 allows an unauthenticated attacker to conduct an unauthorized access attack due to improper access control. A successful exploit could allow an attacker to gain unauthorized access to user information or the system configuration.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0010; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0010
CVE: CVE-2024-32359
Published: 2024-05-02
Description: An RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute arbitrary code through designed commands to obtain the secrets of the entire cluster and further take over the cluster.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-285
References: http://carina.com; https://gist.github.com/HouqiyuA/568d9857dab4ddba6b8b6a791e90f906; https://github.com/HouqiyuA/k8s-rbac-poc
CVE: CVE-2024-33530
Published: 2024-05-02
Description: In Jitsi Meet before 9391, a logic flaw in password-protected Jitsi meetings (that make use of a lobby) leads to the disclosure of the meeting password when a user is invited to a call after waiting in the lobby.
CVSS Score: 7.5 (HIGH)
CWE: CWE-640
References: https://insinuator.net/2024/05/vulnerability-in-jitsi-meet-meeting-password-disclosure-affecting-meetings-with-lobbies/; https://insinuator.net/2024/05/vulnerability-in-jitsi-meet-meeting-password-disclosure-affecting-meetings-with-lobbies/
CVE: CVE-2024-4433
Published: 2024-05-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mr Digital Simple Image Popup allows Stored XSS.This issue affects Simple Image Popup: from n/a through 2.4.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/simple-image-popup/wordpress-simple-image-popup-plugin-2-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/simple-image-popup/wordpress-simple-image-popup-plugin-2-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-6214
Published: 2024-05-02
Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.6 via the purchased_products function. This makes it possible for unauthenticatied attackers to extract sensitive data including the previous 7 days of order data including products and customer PII.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.3.6/extensions/wc-sales-notification/classes/class.sale_notification.php; https://plugins.trac.wordpress.org/changeset/3048999/ht-mega-for-elementor/trunk/extensions/wc-sales-notification/classes/class.sale_notification.php?old=2654447&old_path=ht-mega-for-elementor%2Ftrunk%2Fextensions%2Fwc-sales-notification%2Fclasses%2Fclass.sale_notification.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/54043c6a-48a1-48e8-ba61-a7e8a1773036?source=cve
CVE: CVE-2023-6731
Published: 2024-05-02
Description: The WP Show Posts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with subscriber access and above, to view arbitrary post metadata, list posts, and view terms and taxonomies.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285, CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3071911%40wp-show-posts%2Ftrunk&old=3041416%40wp-show-posts%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/e6bb3680-0623-4633-971e-3bc4a52dfad3?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3071911%40wp-show-posts%2Ftrunk&old=3041416%40wp-show-posts%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2023-6961
Published: 2024-05-02
Description: The WP Meta SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Referer’ header in all versions up to, and including, 4.5.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3071453%40wp-meta-seo%2Ftrunk&old=3068145%40wp-meta-seo%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ca91e41d-b728-4eb0-86d5-043813d8c2c1?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3071453%40wp-meta-seo%2Ftrunk&old=3068145%40wp-meta-seo%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2023-6962
Published: 2024-05-02
Description: The WP Meta SEO plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5.12 via the meta description. This makes it possible for unauthenticated attackers to disclose potentially sensitive information via the meta description of password-protected posts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1230, CWE-922
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3071453%40wp-meta-seo%2Ftrunk&old=3068145%40wp-meta-seo%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/0323b54b-c15b-4d2d-9e8f-3df87c84dd49?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3071453%40wp-meta-seo%2Ftrunk&old=3068145%40wp-meta-seo%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2023-7030
Published: 2024-05-02
Description: The Collapse-O-Matic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'expand' shortcode in all versions up to, and including, 1.8.5.5 due to insufficient input sanitization and output escaping on the 'tag' user supplied attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3074011%40jquery-collapse-o-matic&new=3074011%40jquery-collapse-o-matic&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ea23bcc2-ce71-4f16-85f3-11276deb659f?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3074011%40jquery-collapse-o-matic&new=3074011%40jquery-collapse-o-matic&sfp_email=&sfph_mail=
CVE: CVE-2023-7064
Published: 2024-05-02
Description: The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.17.5 via deserialization of untrusted input from the vulnerable 'id' parameter in the 'auxin_template_control_importer' function. This makes it possible for authenticated attackers able to upload a separate PHAR payload as an image file to inject a PHP Object, though the action itself is available to subscribers. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502, CWE-502
References: https://plugins.trac.wordpress.org/browser/auxin-elements/trunk/admin/includes/admin-ajax.php?annotate=blame&rev=3251498; https://plugins.trac.wordpress.org/changeset/3251498; https://plugins.trac.wordpress.org/changeset/3271715/
CVE: CVE-2023-7067
Published: 2024-05-02
Description: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'woolentor_template_store' function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with contributor access and above to access the nonce used to access this function and set a blank template as the default template.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/changeset/3044764/woolentor-addons/trunk?contextall=1&old=3037382&old_path=%2Fwoolentor-addons%2Ftrunk; https://www.wordfence.com/threat-intel/vulnerabilities/id/860c2339-b2a9-4a4e-a186-07a5fb042b06?source=cve; https://plugins.trac.wordpress.org/changeset/3044764/woolentor-addons/trunk?contextall=1&old=3037382&old_path=%2Fwoolentor-addons%2Ftrunk
CVE: CVE-2024-0613
Published: 2024-05-02
Description: The Delete Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3.1. This is due to missing or incorrect nonce validation on the ajax_delete_field() function. This makes it possible for unauthenticated attackers to delete arbitrary post meta data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/delete-custom-fields/trunk/delete-custom-fields.php#L357; https://www.wordfence.com/threat-intel/vulnerabilities/id/c13ba1df-25fa-4cc8-9745-2d6f6168788a?source=cve; https://plugins.trac.wordpress.org/browser/delete-custom-fields/trunk/delete-custom-fields.php#L357
CVE: CVE-2024-0615
Published: 2024-05-02
Description: The Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0 via the API. This makes it possible for unauthenticated attackers to extract post titles, IDs, slugs, statuses and other information including post content. This includes published content only.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3052982%40content-control%2Ftrunk&old=3007200%40content-control%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/a14cce74-6432-4b92-85c8-8b899e4248fd?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3052982%40content-control%2Ftrunk&old=3007200%40content-control%2Ftrunk&sfp_email=&sfph_mail=
CVE: CVE-2024-0629
Published: 2024-05-02
Description: The 2Checkout Payment Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sniff_ins function in all versions up to, and including, 6.2. This makes it possible for unauthenticated attackers to make changes to orders and mark them as paid.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://wordpress.org/plugins/woocommerce-2checkout-payment/; https://www.wordfence.com/threat-intel/vulnerabilities/id/bcc6a4a5-b133-4ee1-a345-a7c812624b03?source=cve; https://wordpress.org/plugins/woocommerce-2checkout-payment/
CVE: CVE-2024-0710
Published: 2024-05-02
Description: The GP Unique ID plugin for WordPress is vulnerable to Unique ID Modification in all versions up to, and including, 1.5.5. This is due to insufficient input validation. This makes it possible for unauthenticated attackers to tamper with the generation of a unique ID on a form submission and replace the generated unique ID with a user-controlled one, leading to a loss of integrity in cases where the ID's uniqueness is relied upon in a security-specific context.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://github.com/karlemilnikka/CVE-2024-0710/blob/main/README.md; https://gravitywiz.com/documentation/gravity-forms-unique-id/; https://www.wordfence.com/threat-intel/vulnerabilities/id/26db2d25-01b8-49c5-a4d6-284780ac97bb?source=cve
CVE: CVE-2024-0847
Published: 2024-05-02
Description: The 5280 Bootstrap Modal Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation in class-sbmm-list-table.php. This makes it possible for unauthenticated attackers to bulk delete messages via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/5280-bootstrap-modal-contact-form/trunk/inc/class-sbmm-list-table.php#L142; https://www.wordfence.com/threat-intel/vulnerabilities/id/18464483-1d2f-4a4e-a1cc-6c1ddcc2dcf5?source=cve; https://plugins.trac.wordpress.org/browser/5280-bootstrap-modal-contact-form/trunk/inc/class-sbmm-list-table.php#L142
CVE: CVE-2024-0848
Published: 2024-05-02
Description: The AA Cash Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘invoice’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/aa-calculator/trunk/aacalculation.php#L79; https://www.wordfence.com/threat-intel/vulnerabilities/id/933ea8a2-3d1d-43a3-bb14-52f37576c9e5?source=cve; https://plugins.trac.wordpress.org/browser/aa-calculator/trunk/aacalculation.php#L79
CVE: CVE-2024-0908
Published: 2024-05-02
Description: The Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the apbPosts() function hooked via an AJAX action in all versions up to, and including, 1.13.4. This makes it possible for unauthenticated attackers to retrieve all post data, including those that may be password protected.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/advanced-post-block/trunk/plugin.php#L173; https://plugins.trac.wordpress.org/changeset/3081482/advanced-post-block/trunk/plugin.php?old=3077963&old_path=advanced-post-block%2Ftrunk%2Fplugin.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/8fb6c221-d885-42b5-977c-39e8608e3e31?source=cve
CVE: CVE-2024-1173
Published: 2024-05-02
Description: The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in all versions up to, and including, 1.13.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with accounting manager or admin access, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/erp/trunk/modules/accounting/includes/functions/people.php#L262; https://plugins.trac.wordpress.org/changeset/3071807/erp/trunk/modules/accounting/includes/functions/people.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/94772de9-6ab8-45ff-8b56-19b50a81b66f?source=cve
CVE: CVE-2024-1348
Published: 2024-05-02
Description: The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parameter in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3074455%40auxin-elements&new=3074455%40auxin-elements&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/0e9324ba-1cbf-4326-80b5-7b9d969441ad?source=cve; https://plugins.trac.wordpress.org/browser/auxin-elements/trunk/includes/general-hooks.php#L1928