deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-9305
Published: 2024-10-16
Description: The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.4. This is due to the appp_reset_password() and validate_reset_password() functions not having enough controls to prevent a successful brute force attack of the OTP to change a password, or verify that a password reset request came from an authorized user. This makes it possible for unauthenticated attackers to generate and brute force an OTP that makes it possible to change any users passwords, including an administrator.
CVSS Score: 8.1 (HIGH)
CWE: CWE-640
References: https://plugins.trac.wordpress.org/browser/apppresser/tags/4.4.4/inc/AppPresser_Ajax_Extras.php#L31; https://plugins.trac.wordpress.org/browser/apppresser/tags/4.4.4/inc/AppPresser_WPAPI_Mods.php#L92; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3168744%40apppresser&new=3168744%40apppresser&sfp_email=&sfph_mail=
CVE: CVE-2024-9521
Published: 2024-10-16
Description: The SEO Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/seo-manager/trunk/seo-manager.php?rev=2963205#L458; https://www.wordfence.com/threat-intel/vulnerabilities/id/17457ff2-917d-4cc4-8c5e-c80cd320cc90?source=cve
CVE: CVE-2024-9634
Published: 2024-10-16
Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3 via deserialization of untrusted input from the give_company_name parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/give/tags/3.16.2/src/Donations/Repositories/DonationRepository.php?rev=3157829; https://plugins.trac.wordpress.org/changeset/3166836/give/tags/3.16.4/includes/process-donation.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/b8eb3aa9-fe60-48b6-aa24-7873dd68b47e?source=cve
CVE: CVE-2024-9647
Published: 2024-10-16
Description: The Kama SpamBlock plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_POST values in all versions up to, and including, 1.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/kama-spamblock/tags/1.8.2/Kama_Spamblock.php#L106; https://plugins.trac.wordpress.org/changeset/3167874/kama-spamblock/tags/1.8.3/Kama_Spamblock.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/7f2d3acb-5931-4629-8f03-4ab40fadf7c7?source=cve
CVE: CVE-2024-9649
Published: 2024-10-16
Description: The WP ULike – The Ultimate Engagement Toolkit for Websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.7.4. This is due to missing or incorrect nonce validation on the wp_ulike_delete_history_api() function. This makes it possible for unauthenticated attackers to delete engagements via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/WordpressPluginDirectory/wp-ulike/blob/fd5eb54948cc1af9c348530a3cbd89c5a4bc68d0/wp-ulike/admin/admin-ajax.php#L78-L100; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3168233%40wp-ulike&new=3168233%40wp-ulike&sfp_email=&sfph_mail=#file0; https://www.wordfence.com/threat-intel/vulnerabilities/id/3fcb35f8-ed88-4440-8cdf-95c1f0028253?source=cve
CVE: CVE-2024-9652
Published: 2024-10-16
Description: The Locatoraid Store Locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_POST keys in all versions up to, and including, 3.9.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/locatoraid/trunk/happ2/modules/input/lib.php#L705; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3167512%40locatoraid&new=3167512%40locatoraid&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/7821b17a-7da7-434f-8e3f-540e7d7cf6bb?source=cve
CVE: CVE-2024-9891
Published: 2024-10-16
Description: The Multiline files upload for contact form 7 plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the mfcf7_zl_custom_handle_deactivation_plugin_form_submission() function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate the plugin and send a custom reason from the site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3169228/; https://plugins.trac.wordpress.org/tags/2.8.1/multiline-files-for-contact-form-7/multiline-admin.php#L410; https://www.wordfence.com/threat-intel/vulnerabilities/id/5cf62f45-a142-497e-9838-ce0b1b1bb3d3?source=cve
CVE: CVE-2024-10018
Published: 2024-10-16
Description: Improper permission control in the mobile application (com.transsion.aivoiceassistant) can lead to the launch of any unexported component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://security.tecno.com/SRC/blogdetail/323?lang=en_US; https://security.tecno.com/SRC/securityUpdates?type=SA
CVE: CVE-2024-9873
Published: 2024-10-16
Description: The Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URLs in posts, comments, and profiles when Markdown support is enabled in all versions up to, and including, 6.4.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3168989/peepso-core/tags/6.4.6.2/peepso.php?old=3157925&old_path=peepso-core%2Ftags%2F6.4.6.1%2Fpeepso.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/33585791-be40-438c-bebc-8852e7cf8ae5?source=cve
CVE: CVE-2024-9888
Published: 2024-10-16
Description: The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contact form widget redirect URL in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3168782/elementinvader-addons-for-elementor/trunk/modules/forms/ajax-handler.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/ba9d12c5-fe3a-4958-8d35-c63bb05b6d5a?source=cve
CVE: CVE-2024-9937
Published: 2024-10-16
Description: The Woo Manage Fraud Orders plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/woo-manage-fraud-orders/trunk/includes/admin/class-wmfo-fraud-attempts-table.php#L108; https://plugins.trac.wordpress.org/browser/woo-manage-fraud-orders/trunk/includes/admin/class-wmfo-logs-table.php#L108; https://www.wordfence.com/threat-intel/vulnerabilities/id/fc8b0944-f669-40d3-899b-d7f91b1a1fea?source=cve
CVE: CVE-2012-10018
Published: 2024-10-16
Description: The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Server-Side Request Forgery in versions up to, and including 6.1, 1.0 respectively. This makes it possible for attackers to forgery requests coming from a vulnerable site's server and ultimately perform an XSS attack if requesting an SVG file.
CVSS Score: 8.3 (HIGH)
CWE: CWE-918
References: https://packetstormsecurity.com/files/161919/; https://packetstormsecurity.com/files/161920/; https://plugins.trac.wordpress.org/changeset/2503447
CVE: CVE-2016-15040
Published: 2024-10-16
Description: The Kento Post View Counter plugin for WordPress is vulnerable to SQL Injection via the 'kento_pvc_geo' parameter in versions up to, and including, 2.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/kento-post-view-counter/trunk/index.php#L216; https://www.wordfence.com/threat-intel/vulnerabilities/id/525b466d-137a-467b-8b49-e51393a73866?source=cve
CVE: CVE-2016-15041
Published: 2024-10-16
Description: The MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mwp_setup_purchase_username’ parameter in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://klikki.fi/adv/mainwp.html; https://web.archive.org/web/[PII_REDACTED]0009/https%3A//klikki.fi/adv/mainwp.html; https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-mainwp-dashboard-cross-site-scripting-3-1-2/
CVE: CVE-2017-20192
Published: 2024-10-16
Description: The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters submitted during form entries like 'after_html' in versions before 2.05.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.
CVSS Score: 8.3 (HIGH)
CWE: CWE-79
References: https://klikki.fi/adv/formidable.html; https://wordpress.org/plugins/formidable/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/900fcaab-2424-4ae8-af18-95659db0dbe3?source=cve
CVE: CVE-2018-25105
Published: 2024-10-16
Description: The  File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in versions up to, and including, 3.0. This makes it possible for unauthenticated attackers to download arbitrary files from the server and upload arbitrary files that can be used for remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1942390%40wp-file-manager&new=1942390%40wp-file-manager&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/a56d5a2f-ae13-4523-bc4a-17bb2fb4c6f0?source=cve
CVE: CVE-2019-25213
Published: 2024-10-16
Description: The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter. This allows unauthenticated attackers to read any file on the server, including sensitive files such as wp-config.php
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/changeset/2098838/advanced-access-manager/trunk/application/Core/Media.php?old=2151316&old_path=advanced-access-manager%2Ftrunk%2Fapplication%2FCore%2FMedia.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/55e0f0df-7be2-4e18-988c-2cc558768eff?source=cve
CVE: CVE-2019-25214
Published: 2024-10-16
Description: The ShopWP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST API routes in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to call the endpoints and perform unauthorized actions such as updating the plugin's settings and injecting malicious scripts.
CVSS Score: 7.2 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2132502%40wpshopify&new=2132502%40wpshopify&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/d04f11b4-ee58-428b-aaa2-dc7d9f3e68e3?source=cve
CVE: CVE-2019-25215
Published: 2024-10-16
Description: The ARI-Adminer plugin for WordPress is vulnerable to authorization bypass due to a lack of file access controls in nearly every file of the plugin in versions up to, and including, 1.1.14. This makes it possible for unauthenticated attackers to call the files directly and perform a wide variety of unauthorized actions such as accessing a site's database and making changes.
CVSS Score: 7.3 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2065317%40ari-adminer&new=2065317%40ari-adminer&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/67ad04d4-49ef-4bc4-b3b0-f[PII_REDACTED]e?source=cve
CVE: CVE-2019-25216
Published: 2024-10-16
Description: The Rich Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the POST body 'update' parameter in versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://wordpress.org/support/topic/plugin-not-supported-open-to-malware-uninstall-now/; https://wpscan.com/vulnerability/81bdc004-9b9c-49e2-b337-35a6d8395c5d; https://www.wordfence.com/blog/2019/09/rich-reviews-plugin-vulnerability-exploited-in-the-wild/
CVE: CVE-2019-25217
Published: 2024-10-16
Description: The SiteGround Optimizer plugin for WordPress is vulnerable to authorization bypass leading to Remote Code Execution and Local File Inclusion in versions up to, and including, 5.0.12 due to incorrect use of an access control attribute on the switch_php function called via the /switch-php REST API route. This allows attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://blog.sucuri.net/2019/03/vulnerability-disclosure-siteground-optimizer-caldera-forms.html; https://www.wordfence.com/threat-intel/vulnerabilities/id/657f3bd7-2cdc-4eb6-ba50-7c7fca468df0?source=cve
CVE: CVE-2020-36831
Published: 2024-10-16
Description: The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on multiple user privilege/security functions provided in versions up to, and including 4.3.17. This makes it possible for low-privileged attackers, like subscribers, to perform restricted actions that would be otherwise locked to a administrative-level user.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://blog.sucuri.net/2020/09/insufficient-privilege-validation-in-nextscripts-social-networks-auto-poster.html; https://wpscan.com/vulnerability/0641578b-16b9-4d79-af69-b4886840da36; https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-nextscripts-social-networks-auto-poster-security-bypass-4-3-17/
CVE: CVE-2020-36832
Published: 2024-10-16
Description: The Ultimate Membership Pro plugin for WordPress is vulnerable to Authentication Bypass in versions between, and including, 7.3 to 8.6. This makes it possible for unauthenticated attackers to login as any user, including the site administrator with a default user ID of 1, via the username or user ID.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://codecanyon.net/item/ultimate-membership-pro-wordpress-plugin/12159253; https://wpscan.com/vulnerability/9811025e-ab17-4255-aaaf-4f0306f5d281; https://www.wordfence.com/threat-intel/vulnerabilities/id/a5341bbd-55bd-41ad-b5d1-d6b56c141277?source=cve
CVE: CVE-2020-36833
Published: 2024-10-16
Description: The Indeed Membership Pro plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on various AJAX actions in versions 7.3 - 8.6. This makes it possible for authenticated attacker, with minimal permission, such as a subscriber, to perform a variety of actions such as modifying settings and viewing sensitive data.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://wpscan.com/vulnerability/9811025e-ab17-4255-aaaf-4f0306f5d281; https://www.wordfence.com/threat-intel/vulnerabilities/id/ab1cc1ef-d0e0-491d-91a8-eaa0605fc1da?source=cve
CVE: CVE-2020-36834
Published: 2024-10-16
Description: The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.0.2 due to missing capability checks on various functions. This makes it possible for subscriber-level attackers to execute various actions and perform a wide variety of actions such as modifying rules and saving configurations.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/articles/multiple-vulnerabilities-in-discount-rules-for-woocommerce-plugin/; https://www.wordfence.com/threat-intel/vulnerabilities/id/33cf27ba-a01b-4e34-9584-b1d3fc87af34?source=cve
CVE: CVE-2020-36835
Published: 2024-10-16
Description: The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to sensitive information disclosure of a WordPress site's database due to missing capability checks on the wp_ajax_wpvivid_add_remote AJAX action that allows low-level authenticated attackers to send back-ups to a remote location of their choice for review. This affects versions up to, and including 0.9.35.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200, CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2261665%40wpvivid-backuprestore%2Ftrunk&old=2252870%40wpvivid-backuprestore%2Ftrunk&sfp_email=&sfph_mail=; https://www.webarxsecurity.com/vulnerability-in-wpvivid-backup-plugin-can-lead-to-database-leak/?fbclid=IwAR3Ve74ZIvmx-aC0OssIWYwcWEjGq6yU16DcyVGHD1XUT3uYaZ3QyVu_Eos&utm_content=buffer4435b&utm_medium=social&utm_source=facebook.com&utm_campaign=buffer; https://www.wordfence.com/threat-intel/vulnerabilities/id/90c3f8bc-fc41-4ba7-b9f2-8873203d5794?source=cve
CVE: CVE-2020-36836
Published: 2024-10-16
Description: The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capability checking and insufficient path validation. This makes it possible for authenticated users with minimal permissions to delete arbitrary files from the server.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352, CWE-22
References: https://plugins.trac.wordpress.org/changeset/2235160/wp-fastest-cache; https://wearetradecraft.com/advisories/tc-2020-0001/; https://www.wordfence.com/threat-intel/vulnerabilities/id/82f80916-37ab-4c5a-9787-2544c620acac?source=cve
CVE: CVE-2020-36837
Published: 2024-10-16
Description: The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the reset_wizard_actions function in versions 1.3.4 through 1.6.1. This makes it possible for authenticated attackers to reset the WordPress database. After which, if there is a user named 'admin', the attacker will become automatically logged in as an administrator.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-862
References: https://raw.githubusercontent.com/themegrill/themegrill-demo-importer/master/CHANGELOG.txt; https://www.openwall.com/lists/oss-security/2020/02/19/1; https://www.webarxsecurity.com/critical-issue-in-themegrill-demo-importer/
CVE: CVE-2020-36838
Published: 2024-10-16
Description: The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_update_options function in versions up to, and including, 1.5. This flaw makes it possible for low-level authenticated attackers to connect their own Facebook Messenger account to any site running the vulnerable plugin and engage in chats with site visitors on affected sites.
CVSS Score: 7.4 (HIGH)
CWE: CWE-284
References: https://www.wordfence.com/blog/2020/08/the-official-facebook-chat-plugin-created-vector-for-social-engineering-attacks/; https://www.wordfence.com/threat-intel/vulnerabilities/id/36ae4183-5fa7-484c-b858-5df10ae3d3f2?source=cve
CVE: CVE-2020-36839
Published: 2024-10-16
Description: The WP Lead Plus X plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.99. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform administrative actions, such as adding pages to the site and/or replacing site content with malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.3 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/free-sales-funnel-squeeze-pages-landing-page-builder-templates-make/#developers; https://www.wordfence.com/blog/2020/04/critical-vulnerabilities-in-the-wp-lead-plus-x-wordpress-plugin/; https://www.wordfence.com/threat-intel/vulnerabilities/id/ddb97db0-cbf3-42be-a5c7-12fc2a2bc9e8?source=cve
CVE: CVE-2021-4443
Published: 2024-10-16
Description: The WordPress Mega Menu plugin for WordPress is vulnerable to Arbitrary File Creation in versions up to, and including, 2.0.6 via the compiler_save AJAX action. This makes it possible for unauthenticated attackers to create arbitrary PHP files that can be used to execute malicious code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://sh3llcon.org/la-debilidad-de-wordpress/; https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-wordpress-mega-menu-quadmenu-remote-code-execution-2-0-6/; https://www.wordfence.com/threat-intel/vulnerabilities/id/04003542-fd62-4587-9834-70e7fe8f08ef?source=cve