deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-9310
Published: 2025-01-22
Description: By utilizing software-defined radios and a custom low-latency processing pipeline, RF signals with spoofed location data can be transmitted to aircraft targets. This can lead to the appearance of fake aircraft on displays and potentially trigger undesired Resolution Advisories (RAs).
CWE: CWE-807
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-021-01
CVE: CVE-2024-56914
Published: 2025-01-22
Description: D-Link DSL-3782 v1.01 is vulnerable to Buffer Overflow in /New_GUI/ParentalControl.asp.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-120
References: https://github.com/[PII_REDACTED]/mycve/blob/main/BOF_in_D-Link_DSL-3782_1.pdf; https://github.com/[PII_REDACTED]/mycve/blob/main/BOF_in_D-Link_DSL-3782_1.pdf
CVE: CVE-2025-0611
Published: 2025-01-22
Description: Object corruption in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.2 (HIGH)
CWE: CWE-122
References: https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_22.html; https://issues.chromium.org/issues/386143468
CVE: CVE-2025-0612
Published: 2025-01-22
Description: Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_22.html; https://issues.chromium.org/issues/385155406
CVE: CVE-2024-56923
Published: 2025-01-22
Description: Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6.4.1 allows a remote attacker to execute arbitrary JavaScript code. This is achieved by injecting a malicious payload into the Name field of a subscription. The attack can lead to session hijacking, data theft, or unauthorized actions when an admin user views the affected subscription.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Mohamed-Saqib-C/CVEs/blob/main/CVE-2024-56923/README.md; https://github.com/Mohamed-Saqib-C/CVEs/blob/main/CVE-2024-56923/README.md
CVE: CVE-2024-56924
Published: 2025-01-22
Description: A Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admin page (pages_account), potentially leading to unauthorized actions such as changing account settings or stealing sensitive user information. This vulnerability occurs due to improper validation of user requests, which enables attackers to exploit the system by tricking the admin user into executing malicious scripts.
CVSS Score: 7.3 (HIGH)
CWE: CWE-352
References: https://github.com/ipratheep/CVE-2024-56924; https://github.com/ipratheep/CVE-2024-56924
CVE: CVE-2024-12477
Published: 2025-01-22
Description: The Avada Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.11.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://avada.com; https://www.wordfence.com/threat-intel/vulnerabilities/id/7c54588f-6436-406f-93cb-b08965586d11?source=cve
CVE: CVE-2024-42182
Published: 2025-01-23
Description: BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerability.  It may allow the application to download files from an internally hosted server on localhost.
CVSS Score: 2.5 (LOW)
CWE: CWE-918
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118565
CVE: CVE-2024-57719
Published: 2025-01-23
Description: lunasvg v3.0.0 was discovered to contain a segmentation violation via the component blend_transformed_tiled_argb.isra.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/keepinggg/poc/blob/main/poc_of_lunasvg_3.1.0; https://github.com/sammycage/lunasvg/issues/209
CVE: CVE-2024-57720
Published: 2025-01-23
Description: lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-653
References: https://github.com/keepinggg/poc/blob/main/poc_of_lunasvg_3.1.0; https://github.com/sammycage/lunasvg/issues/209
CVE: CVE-2024-57721
Published: 2025-01-23
Description: lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-653
References: https://github.com/keepinggg/poc/blob/main/poc_of_lunasvg_3.1.0; https://github.com/sammycage/lunasvg/issues/209
CVE: CVE-2024-57722
Published: 2025-01-23
Description: lunasvg v3.0.0 was discovered to contain a allocation-size-too-big bug via the component plutovg_surface_create.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/keepinggg/poc/blob/main/poc_of_lunasvg_3.1.0; https://github.com/sammycage/lunasvg/issues/209
CVE: CVE-2024-57723
Published: 2025-01-23
Description: lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-653
References: https://github.com/keepinggg/poc/blob/main/poc_of_lunasvg_3.1.0; https://github.com/sammycage/lunasvg/issues/209
CVE: CVE-2024-57724
Published: 2025-01-23
Description: lunasvg v3.0.0 was discovered to contain a segmentation violation via the component gray_record_cell.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/keepinggg/poc/blob/main/poc_of_lunasvg_3.1.0; https://github.com/sammycage/lunasvg/issues/209
CVE: CVE-2024-42183
Published: 2025-01-23
Description: BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability.  It could allow a malicious operator to download files from arbitrary URLs without any proper validation or allowlist controls.
CVSS Score: 2.5 (LOW)
CWE: CWE-494
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118565
CVE: CVE-2023-32340
Published: 2025-01-23
Description: IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7176082
CVE: CVE-2023-50309
Published: 2025-01-23
Description: IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7176082
CVE: CVE-2024-42184
Published: 2025-01-23
Description: BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme.  It could allow a malicious operator to attempt to download files using the file:// URI scheme.
CVSS Score: 2.5 (LOW)
CWE: CWE-84
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118565
CVE: CVE-2024-42185
Published: 2025-01-23
Description: BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks.  This allows an attacker to exploit this vulnerability by injecting malicious XML content, which can lead to various issues including denial of service and unauthorized access.
CVSS Score: 2.5 (LOW)
CWE: CWE-611
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118565
CVE: CVE-2024-42186
Published: 2025-01-23
Description: BigFix Patch Download Plug-ins are affected by an insecure protocol support.  The application can allow improper handling of SSL certificates validation.
CVSS Score: 2.8 (LOW)
CWE: CWE-295
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118565
CVE: CVE-2024-42187
Published: 2025-01-23
Description: BigFix Patch Download Plug-ins are affected by path traversal vulnerability.  The application could allow operators to download files from a local repository which is vulnerable to path traversal attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118565
CVE: CVE-2025-24030
Published: 2025-01-23
Description: Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior to 1.2.6. The admin interface can be used to terminate the Envoy process and extract the Envoy configuration (possibly containing confidential data). Version 1.2.6 fixes the issue. As a workaround, the `EnvoyProxy` API can be used to apply a bootstrap config patch that restricts access strictly to the prometheus stats endpoint. Find below an example of such a bootstrap patch.
CVSS Score: 7.1 (HIGH)
CWE: CWE-419
References: https://github.com/envoyproxy/gateway/commit/3eb3301ab3dbf12b201b47bdb6074d1233be07bd; https://github.com/envoyproxy/gateway/security/advisories/GHSA-j777-63hf-hx76; https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/edge
CVE: CVE-2024-43707
Published: 2025-01-23
Description: An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions.
CVSS Score: 7.7 (HIGH)
CWE: CWE-200
References: https://discuss.elastic.co/t/kibana-8-15-0-security-update-esa-2024-29-esa-2024-30/373521
CVE: CVE-2024-43710
Published: 2025-01-23
Description: A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON could be accessed. This can be carried out by users with read access to Fleet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://discuss.elastic.co/t/kibana-8-15-0-security-update-esa-2024-29-esa-2024-30/373521
CVE: CVE-2025-24529
Published: 2025-01-23
Description: An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the Insert tab.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.phpmyadmin.net/security/PMASA-2025-2/; https://lists.debian.org/debian-lts-announce/2025/04/msg00016.html
CVE: CVE-2025-24530
Published: 2025-01-23
Description: An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables feature. A crafted table or database name could be used for XSS.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.phpmyadmin.net/security/PMASA-2025-1/; https://lists.debian.org/debian-lts-announce/2025/04/msg00016.html
CVE: CVE-2024-52972
Published: 2025-01-23
Description: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in Kibana.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://discuss.elastic.co/t/kibana-7-17-23-8-15-0-security-updates-esa-2024-32-esa-2024-33/373548
CVE: CVE-2024-52975
Published: 2025-01-23
Description: An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on INFO and ERROR log levels. The nature of the sensitive information largely depends on the integrations enabled.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-200
References: https://discuss.elastic.co/t/fleet-server-8-15-0-security-update-esa-2024-31/373522
CVE: CVE-2024-53299
Published: 2025-01-23
Description: The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources.
Users are recommended to upgrade to versions 9.19.0 or 10.3.0, which fixes this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://lists.apache.org/thread/gyp2ht00c62827y0379lxh5dbx3hhho5; http://www.openwall.com/lists/oss-security/2025/01/22/12
CVE: CVE-2024-12957
Published: 2025-01-23
Description: A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary file deletion.
Refer to the '01/23/2025 Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.
CWE: CWE-306
References: https://www.asus.com/content/asus-product-security-advisory/
CVE: CVE-2024-13511
Published: 2025-01-23
Description: The Variation Swatches for WooCommerce plugin, in all versions starting at 1.0.8 up until 1.3.2, contains a vulnerability due to improper nonce verification in its settings reset functionality. The issue exists in the settings_init() function, which processes a reset action based on specific query parameters in the URL. The related delete_settings() function performs a faulty nonce validation check, making the reset operation insecure and susceptible to unauthorized access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/th-variation-swatches/tags/1.3.1/inc/thvs-settings.php; https://plugins.trac.wordpress.org/changeset/3226822/th-variation-swatches/trunk/inc/thvs-settings.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/6c43b9b4-4394-428a-b381-d6a776fcd130?source=cve
CVE: CVE-2024-13593
Published: 2025-01-23
Description: The BMLT Meeting Map plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.6.0 via the 'bmlt_meeting_map' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://plugins.trac.wordpress.org/browser/bmlt-meeting-map/trunk/meeting_map.php#L510; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3226454%40bmlt-meeting-map&new=3226454%40bmlt-meeting-map&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c22e5765-54bd-4677-947c-8a7c48bdf65b?source=cve
CVE: CVE-2024-12043
Published: 2025-01-23
Description: The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Post Slider and Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'social_link_title' parameter of the 'blog' widget in all versions up to, and including, 3.16.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3222179%40bdthemes-prime-slider-lite&new=3222179%40bdthemes-prime-slider-lite&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/23e1fffa-9170-4bc2-ad7e-27708a08033b?source=cve
CVE: CVE-2024-13234
Published: 2025-01-23
Description: The Product Table by WBW plugin for WordPress is vulnerable to SQL Injection via the 'additionalCondition' parameter in all versions up to, and including, 2.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3221872%40woo-product-tables&new=3221872%40woo-product-tables&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/67db430e-d796-4ace-b5d1-de492edb8ea8?source=cve
CVE: CVE-2024-43708
Published: 2025-01-23
Description: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with read access to any feature in Kibana.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://discuss.elastic.co/t/kibana-7-17-23-8-15-0-security-updates-esa-2024-32-esa-2024-33/373548
CVE: CVE-2025-0619
Published: 2025-01-23
Description: Unsafe password recovery from configuration in M-Files Server before 25.1 allows a highly privileged user to recover external connector passwords
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-522
References: https://empower.m-files.com/security-advisories/CVE-2025-0619; https://product.m-files.com/security-advisories/cve-2025-0619/
CVE: CVE-2025-0635
Published: 2025-01-23
Description: Denial of service condition in M-Files Server in versions before 

25.1.14445.5 allows an unauthenticated user to consume computing resources in certain conditions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://empower.m-files.com/security-advisories/CVE-2025-0635; https://product.m-files.com/security-advisories/cve-2025-0635/
CVE: CVE-2025-0648
Published: 2025-01-23
Description: Unexpected server crash in database driver in M-Files Server before 25.1.14445.5 and before 24.8 LTS SR3  allows a highly privileged attacker to cause denial of service via configuration change.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-248
References: https://empower.m-files.com/security-advisories/CVE-2025-0648; https://product.m-files.com/security-advisories/cve-2025-0648/
CVE: CVE-2024-12118
Published: 2025-01-23
Description: The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Event Calendar Link Widget through the html_tag attribute in all versions up to, and including, 6.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.8.1/src/Events/Integrations/Plugins/Elementor/Widgets/Event_Calendar_Link.php#L90; https://plugins.trac.wordpress.org/changeset/3227009/the-events-calendar/tags/6.9.1/src/views/integrations/elementor/widgets/event-calendar-link.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/d67de4f2-b680-49f8-be95-c2464b70f7d0?source=cve
CVE: CVE-2024-12504
Published: 2025-01-23
Description: The Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_hls' shortcode in all versions up to, and including, 6.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3218331%40videowhisper-live-streaming-integration&new=3218331%40videowhisper-live-streaming-integration&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/74b27798-3c6f-4c4e-80f8-7aa40f704fb7?source=cve
CVE: CVE-2024-13236
Published: 2025-01-23
Description: The Tainacan plugin for WordPress is vulnerable to SQL Injection via the 'collection_id' parameter in all versions up to, and including, 0.21.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/tainacan/tags/0.21.12/classes/api/endpoints/class-tainacan-rest-reports-controller.php#L707; https://plugins.trac.wordpress.org/browser/tainacan/tags/0.21.12/classes/api/endpoints/class-tainacan-rest-reports-controller.php#L732; https://plugins.trac.wordpress.org/changeset/3226475/tainacan/trunk/classes/api/endpoints/class-tainacan-rest-reports-controller.php
CVE: CVE-2024-13340
Published: 2025-01-23
Description: The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mdf_results_by_ajax' shortcode in all versions up to, and including, 1.3.3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3224186%40wp-meta-data-filter-and-taxonomy-filter&new=3224186%40wp-meta-data-filter-and-taxonomy-filter&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3226055%40wp-meta-data-filter-and-taxonomy-filter&new=3226055%40wp-meta-data-filter-and-taxonomy-filter&sfp_email=&sfph_mail=; https://wordpress.org/plugins/wp-meta-data-filter-and-taxonomy-filter/
CVE: CVE-2024-13389
Published: 2025-01-23
Description: The Cliptakes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cliptakes_input_email' shortcode in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3226472/cliptakes/tags/1.3.5/public/class-cliptakes-public.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/a939be31-7475-4626-ba1b-af9a9d6d5eda?source=cve
CVE: CVE-2024-13422
Published: 2025-01-23
Description: The SEO Blogger to WordPress Migration using 301 Redirection plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 0.4.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/seo-blogger-to-wordpress-301-redirector/trunk/seo-blogger-to-wordpress.php#L356; https://www.wordfence.com/threat-intel/vulnerabilities/id/a3e095b5-9c0b-45ac-a78d-e50feda348cb?source=cve