deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-50418
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Time Slot Booking Time Slot timeslot allows DOM-Based XSS.This issue affects Time Slot: from n/a through <= 1.3.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/timeslot/vulnerability/wordpress-time-slot-plugin-1-3-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50420
Published: 2024-10-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in aDirectory aDirectory adirectory allows Upload a Web Shell to a Web Server.This issue affects aDirectory: from n/a through <= 1.3.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/adirectory/vulnerability/wordpress-adirectory-plugin-1-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-50426
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.0.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/survey-maker/vulnerability/wordpress-survey-maker-plugin-5-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50427
Published: 2024-10-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in devsoftbaltic SurveyJS surveyjs.This issue affects SurveyJS: from n/a through <= 1.9.136.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/surveyjs/vulnerability/wordpress-surveyjs-plugin-1-9-136-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-50473
Published: 2024-10-29
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Ajar Productions Ajar in5 Embed ajar-productions-in5-embed allows Upload a Web Shell to a Web Server.This issue affects Ajar in5 Embed: from n/a through <= 3.1.3.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/ajar-productions-in5-embed/vulnerability/wordpress-ajar-in5-embed-plugin-3-1-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2024-50475
Published: 2024-10-29
Description: Missing Authorization vulnerability in Scott Gamon Signup Page signup-page allows Privilege Escalation.This issue affects Signup Page: from n/a through <= 1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/signup-page/vulnerability/wordpress-signup-page-plugin-1-0-arbitrary-option-update-to-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-50476
Published: 2024-10-29
Description: Missing Authorization vulnerability in GRÜN Software Group GmbH GRÜN spendino Spendenformular spendino allows Privilege Escalation.This issue affects GRÜN spendino Spendenformular: from n/a through <= 1.0.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/spendino/vulnerability/wordpress-gruen-spendino-spendenformular-plugin-1-0-1-arbitrary-option-update-to-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-50481
Published: 2024-10-29
Description: Incorrect Privilege Assignment vulnerability in stackthemes Bstone Demo Importer bstone-demo-importer allows Privilege Escalation.This issue affects Bstone Demo Importer: from n/a through <= 1.0.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/bstone-demo-importer/vulnerability/wordpress-bstone-demo-importer-plugin-1-0-1-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-50485
Published: 2024-10-29
Description: Incorrect Privilege Assignment vulnerability in Udit Rawat Exam Matrix exam-matrix allows Privilege Escalation.This issue affects Exam Matrix: from n/a through <= 1.5.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/exam-matrix/vulnerability/wordpress-exam-matrix-plugin-1-5-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-50490
Published: 2024-10-29
Description: Missing Authorization vulnerability in lowcage PegaPoll pegapoll allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects PegaPoll: from n/a through <= 1.0.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/pegapoll/vulnerability/wordpress-pegapoll-plugin-1-0-2-arbitrary-option-update-to-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-9438
Published: 2024-10-29
Description: The SEUR Oficial plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'change_service' parameter in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80
References: https://plugins.trac.wordpress.org/browser/seur/trunk/core/pages/seur-get-labels.php#L60; https://plugins.trac.wordpress.org/changeset/3176965/seur/trunk/core/pages/seur-get-labels.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/88edf229-2be2-49d0-b500-e8ff7708f806?source=cve
CVE: CVE-2024-10227
Published: 2024-10-29
Description: The affiliate-toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's atkp_product shortcode in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3174286/; https://servit.dev/; https://wordpress.org/plugins/affiliate-toolkit-starter/#developers
CVE: CVE-2024-10436
Published: 2024-10-29
Description: The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.1 via the get_condition_value function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 8.8 (HIGH)
CWE: CWE-98
References: https://plugins.trac.wordpress.org/browser/wpc-smart-messages/tags/4.2.1/includes/class-backend.php#L418; https://plugins.trac.wordpress.org/changeset/3177426/wpc-smart-messages/trunk/includes/class-backend.php?contextall=1; https://wordpress.org/plugins/wpc-smart-messages/
CVE: CVE-2024-10437
Published: 2024-10-29
Description: The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to unauthorized Smar Message activation/deactivation due to a missing capability check on the ajax_enable function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate or deactivate smart messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wpc-smart-messages/tags/4.2.1/includes/class-backend.php#L775; https://plugins.trac.wordpress.org/changeset/3177426/wpc-smart-messages/trunk/includes/class-backend.php?contextall=1; https://www.wordfence.com/threat-intel/vulnerabilities/id/4acb4fda-0217-44b9-a85e-64807eb4a011?source=cve
CVE: CVE-2024-50550
Published: 2024-10-29
Description: Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from n/a through <= 6.5.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-266, CWE-326
References: https://patchstack.com/database/Wordpress/Plugin/litespeed-cache/vulnerability/wordpress-litespeed-cache-plugin-6-5-1-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2024-9376
Published: 2024-10-29
Description: The Kata Plus – Addons for Elementor – Widgets, Extensions and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://climaxthemes.com/kata/documentation/changelog/; https://plugins.trac.wordpress.org/changeset/3174359/; https://wordpress.org/plugins/kata-plus/#developers
CVE: CVE-2024-10184
Published: 2024-10-29
Description: The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sw-kick-embed shortcode in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3176023; https://wordpress.org/plugins/streamweasels-kick-integration/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/077a31e7-de4b-418f-ac90-5c51a690bc65?source=cve
CVE: CVE-2024-10185
Published: 2024-10-29
Description: The StreamWeasels YouTube Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sw-youtube-embed shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3176030; https://wordpress.org/plugins/streamweasels-youtube-integration/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/41f6b12e-49bb-4bee-bbde-ce4e5ebd4cad?source=cve
CVE: CVE-2024-10233
Published: 2024-10-29
Description: The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sa_subscribe shortcode in all versions up to, and including, 3.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3175629/; https://wordpress.org/plugins/sms-alert/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/c923d1d6-04c6-4ea2-a69e-041fea1e280a?source=cve
CVE: CVE-2024-10266
Published: 2024-10-29
Description: The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video Box widget in all versions up to, and including, 4.10.60 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3176303/premium-addons-for-elementor; https://www.wordfence.com/threat-intel/vulnerabilities/id/c6102c07-2776-4963-8d16-a779c5979275?source=cve
CVE: CVE-2024-10360
Published: 2024-10-29
Description: The Move Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the render function in includes/widgets/accordion/widget.php, includes/widgets/remote-template/widget.php, and other widget.php files. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3176341/move-addons; https://www.wordfence.com/threat-intel/vulnerabilities/id/eafe73b4-b492-45c7-adca-d9a3042144b4?source=cve
CVE: CVE-2024-49670
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sam Glover Client Power Tools Portal client-power-tools allows Reflected XSS.This issue affects Client Power Tools Portal: from n/a through <= 1.9.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/client-power-tools/vulnerability/wordpress-client-power-tools-portal-plugin-1-8-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49672
Published: 2024-10-29
Description: Cross-Site Request Forgery (CSRF) vulnerability in giffordcheung Google Docs RSVP google-docs-rsvp-guestlist allows Stored XSS.This issue affects Google Docs RSVP: from n/a through <= 2.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/google-docs-rsvp-guestlist/vulnerability/wordpress-google-docs-rsvp-plugin-2-0-1-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49673
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Van Abel LaTeX2HTML latex2html allows Reflected XSS.This issue affects LaTeX2HTML: from n/a through <= 2.5.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/latex2html/vulnerability/wordpress-latex2html-plugin-2-5-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49678
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jinwen js allows Reflected XSS.This issue affects js paper: from n/a through 2.5.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/js-paper/wordpress-js-paper-theme-2-5-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49679
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpkoithemes WPKoi Templates for Elementor wpkoi-templates-for-elementor allows Stored XSS.This issue affects WPKoi Templates for Elementor: from n/a through <= 3.1.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpkoi-templates-for-elementor/vulnerability/wordpress-wpkoi-templates-for-elementor-plugin-3-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49692
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCenter AffiliateX affiliatex allows Stored XSS.This issue affects AffiliateX: from n/a through <= 1.2.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/affiliatex/vulnerability/wordpress-affiliatex-plugin-1-2-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50407
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Reflected XSS.This issue affects Namaste! LMS: from n/a through <= 2.6.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/namaste-lms/vulnerability/wordpress-namaste-lms-plugin-2-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-50409
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Stored XSS.This issue affects Namaste! LMS: from n/a through <= 2.6.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/namaste-lms/vulnerability/wordpress-namaste-lms-plugin-2-6-2-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2024-50410
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Stored XSS.This issue affects Namaste! LMS: from n/a through <= 2.6.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/namaste-lms/vulnerability/wordpress-namaste-lms-plugin-2-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2017-20195
Published: 2024-10-29
Description: A vulnerability was found in LUNAD3v AreaLoad up to 1a1103182ed63a06dde63d1712f3262eda19c3ec. It has been rated as critical. This issue affects some unknown processing of the file request.php. The manipulation of the argument phone leads to sql injection. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 264813c546dba03989ac0fc365f2022bf65e3be2. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/LUNAD3v/areaload/commit/264813c546dba03989ac0fc365f2022bf65e3be2; https://vuldb.com/?ctiid.281987; https://vuldb.com/?id.281987
CVE: CVE-2024-10181
Published: 2024-10-29
Description: The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's newsletters_video shortcode in all versions up to, and including, 4.9.9.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3175816/; https://wordpress.org/plugins/newsletters-lite/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/915c46f9-a342-4cc6-a726-2f1581a5d481?source=cve
CVE: CVE-2024-49646
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ioannup Code Generate code-generator allows Reflected XSS.This issue affects Code Generate: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/code-generator/vulnerability/wordpress-code-generate-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49647
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Carl Alberto Simple Custom Admin simple-custom-admin allows Reflected XSS.This issue affects Simple Custom Admin: from n/a through <= 1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-custom-admin/vulnerability/wordpress-simple-custom-admin-plugin-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49648
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rafasashi SVG Captcha svg-captcha allows Reflected XSS.This issue affects SVG Captcha: from n/a through <= 1.0.11.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/svg-captcha/vulnerability/wordpress-svg-captcha-plugin-1-0-11-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49650
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xarbo BuddyPress Greeting Message bp-greeting-message allows Reflected XSS.This issue affects BuddyPress Greeting Message: from n/a through <= 1.0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bp-greeting-message/vulnerability/wordpress-buddypress-greeting-message-plugin-1-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49651
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Royal WooCommerce Maintenance Mode woocommerce-maintenance-mode allows Reflected XSS.This issue affects WooCommerce Maintenance Mode: from n/a through <= 2.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-maintenance-mode/vulnerability/wordpress-woocommerce-maintenance-mode-plugin-2-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49654
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marian Heddesheimer Extra Privacy for Elementor extra-privacy-for-elementor allows Reflected XSS.This issue affects Extra Privacy for Elementor: from n/a through <= 0.1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/extra-privacy-for-elementor/vulnerability/wordpress-extra-privacy-for-elementor-plugin-0-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49656
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifthsegment DocumentPress documentpress-display-any-document-on-your-site allows Reflected XSS.This issue affects DocumentPress: from n/a through <= 2.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/documentpress-display-any-document-on-your-site/vulnerability/wordpress-documentpress-plugin-2-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49659
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Coub Coub coub allows DOM-Based XSS.This issue affects Coub: from n/a through <= 1.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/coub/vulnerability/wordpress-coub-plugin-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49660
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CampusExplorer Campus Explorer Widget campus-explorer-widget allows Reflected XSS.This issue affects Campus Explorer Widget: from n/a through <= 1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/campus-explorer-widget/vulnerability/wordpress-campus-explorer-widget-plugin-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-49661
Published: 2024-10-29
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lew Ayotte leenk.me leenkme allows Reflected XSS.This issue affects leenk.me: from n/a through <= 2.16.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/leenkme/vulnerability/wordpress-leenk-me-plugin-2-16-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve