deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-12099
Published: 2024-12-04
Description: The Dollie Hub – Build Your Own WordPress Cloud Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.2.0 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3201770%40dollie&new=3201770%40dollie&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/f29514d0-20a5-43f2-bf36[PII_REDACTED]20?source=cve
CVE: CVE-2024-12123
Published: 2024-12-04
Description: A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. 

When an authenticated user submits a ticket, the request can be intercepted and subsequently modified by using a proxy.  The ticket requester can be changed from the original requester to another user in the same application, 
which the application then accepts.
CWE: CWE-472, CWE-837
References: https://helpcenter.issuetrak.com/home/2340-issuetrak-release-notes
CVE: CVE-2024-9404
Published: 2024-12-04
Description: This vulnerability could lead to denial-of-service or service crashes. Exploitation of the moxa_cmd service, because of insufficient input validation, allows attackers to disrupt operations. If exposed to public networks, the vulnerability poses a significant remote threat, potentially allowing attackers to shut down affected systems.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1287
References: https://www.moxa.com/en/support/product-support/security-advisory/mpsa-240930-cve-2024-9404-denial-of-service-vulnerability-identified-in-the-vport-07-3-series; https://www.moxa.com/en/support/product-support/security-advisory/mpsa-240931-cve-2024-9404-denial-of-service-vulnerability-identified-in-multiple-eds,-ics,-iks,-and-sds-switches; https://www.moxa.com/en/support/product-support/security-advisory/mpsa-240933-cve-2024-9404-denial-of-service-vulnerability-identified-in-multiple-pt-switches
CVE: CVE-2024-54661
Published: 2024-12-04
Description: readline.sh in socat before1.8.0.2 relies on the /tmp/$USER/stderr2 file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-61
References: http://www.dest-unreach.org/socat/contrib/socat-secadv9.html; https://repo.or.cz/socat.git/blob/6ff391324d2d3b9f6bfb58e7d16a20be43b47af7:/readline.sh#l29
CVE: CVE-2024-54664
Published: 2024-12-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-52945. Reason: This candidate is a reservation duplicate of CVE-2024-52945. Notes: All CVE users should reference CVE-2024-52945 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2023-52943
Published: 2024-12-04
Description: Incorrect authorization vulnerability in Alert.Setting webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to to perform limited actions on the alerting function via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://www.synology.com/en-global/security/advisory/Synology_SA_24_04
CVE: CVE-2023-52944
Published: 2024-12-04
Description: Incorrect authorization vulnerability in ActionRule webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to perform limited actions on the set action rules function via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://www.synology.com/en-global/security/advisory/Synology_SA_24_04
CVE: CVE-2024-11398
Published: 2024-12-04
Description: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in OTP reset functionality in Synology Router Manager (SRM) before 1.3.1-9346-9 allows remote authenticated users to delete arbitrary files via unspecified vectors.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://www.synology.com/en-global/security/advisory/Synology_SA_24_03
CVE: CVE-2024-45717
Published: 2024-12-04
Description: The SolarWinds Platform was susceptible to a XSS vulnerability that affects the search and node information section of the user interface. This vulnerability requires authentication and requires user interaction.
CVSS Score: 7.0 (HIGH)
CWE: CWE-79
References: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-4-1_release_notes.htm; https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45717
CVE: CVE-2023-6978
Published: 2024-12-04
Description: The WP Job Manager – Company Profiles plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'company' parameter in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3198763%40wp-job-manager-companies&new=3198763%40wp-job-manager-companies&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c8edba5b-9bce-4a93-86a6-bb6dcb30fa60?source=cve
CVE: CVE-2024-10664
Published: 2024-12-04
Description: The Knowledge Base documentation & wiki plugin – BasePress Docs plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the basepress_db_posts_update() function in all versions up to, and including, 2.16.3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the database.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3201489%40basepress&new=3201489%40basepress&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/3aa6f3c2-0e45-4243-a26d-ba1c702fbe11?source=cve
CVE: CVE-2024-11293
Published: 2024-12-04
Description: The  Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Social Sites Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.9. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://pieregister.com/; https://www.wordfence.com/threat-intel/vulnerabilities/id/466ff226-a47e-46f1-a46c-6260208ffd42?source=cve
CVE: CVE-2024-11466
Published: 2024-12-04
Description: The Intro Tour Tutorial DeepPresentation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2025-24566 may be a duplicate of this issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/dp-intro-tours/tags/6.5.2/admin/class-dp-intro-tours-admin-settings.php#L125; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3198780%40dp-intro-tours&new=3198780%40dp-intro-tours&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe082a7-3d36-48b4-b81f-1e65e5ea430d?source=cve
CVE: CVE-2024-11769
Published: 2024-12-04
Description: The Flower Delivery by Florist One plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'flower-delivery' shortcode in all versions up to, and including, 3.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3201180%40flower-delivery-by-florist-one&new=3201180%40flower-delivery-by-florist-one&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/93efae1f-1e4a-48ee-8a69-558c38925250?source=cve
CVE: CVE-2024-11903
Published: 2024-12-04
Description: The WP eCards plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ecard' shortcode in all versions up to, and including, 1.3.904 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3199511%40wp-ecards-invites&new=3199511%40wp-ecards-invites&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/fa8e1df5-2e8a-4c84-83f8-6f6d53d00356?source=cve
CVE: CVE-2024-10567
Published: 2024-12-04
Description: The TI WooCommerce Wishlist plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wizard' function in all versions up to, and including, 2.9.1. This makes it possible for unauthenticated attackers to create new pages, modify plugin settings, and perform limited options updates.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset/3199516/ti-woocommerce-wishlist; https://www.wordfence.com/threat-intel/vulnerabilities/id/0a5f2e1a-2216-4885-9b74-a08142816f2b?source=cve
CVE: CVE-2024-10787
Published: 2024-12-04
Description: The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.4 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private and draft posts created by Elementor that they should not have access to.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3198563%40lastudio-element-kit&new=3198563%40lastudio-element-kit&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/2e63c0fb-7fe7-42f7-8fa9-ec159d3c8117?source=cve
CVE: CVE-2024-11880
Published: 2024-12-04
Description: The B Testimonial – testimonial plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'b_testimonial' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/b-testimonial/tags/1.2.2/inc/theme/one.php#L18; https://plugins.trac.wordpress.org/changeset/3200155/b-testimonial/trunk/inc/theme/one.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3200155%40b-testimonial&new=3200155%40b-testimonial&sfp_email=&sfph_mail=
CVE: CVE-2024-11952
Published: 2024-12-04
Description: The Classic Addons – WPBakery Page Builder plugin for WordPress is vulnerable to Limited Local PHP File Inclusion in all versions up to, and including, 3.0 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, and permissions granted by an Administrator, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The vulnerability is limited to PHP files in a Windows environment.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/classic-addons-wpbakery-page-builder-addons/tags/3.1/addons/testimonial-slider-item/testimonial-slider-item.php#L28; https://www.wordfence.com/threat-intel/vulnerabilities/id/9645b17e-6a7c-4cdd-ae43-7d2c84b624cc?source=cve
CVE: CVE-2024-5020
Published: 2024-12-04
Description: Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3150376/woo-smart-quick-view; https://plugins.trac.wordpress.org/changeset/3153081/colibri-page-builder; https://plugins.trac.wordpress.org/changeset/3156791/form-maker
CVE: CVE-2024-11814
Published: 2024-12-04
Description: The Additional Custom Order Status for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the wfwp_wcos_delete_finished, wfwp_wcos_delete_fallback_finished, wfwp_wcos_delete_fallback_orders_updated, and wfwp_wcos_delete_fallback_status parameters in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3198852%40order-status-for-woocommerce%2Ftrunk&old=3179390%40order-status-for-woocommerce%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/28267144-a709-4631-8925-69c6e0aca77c?source=cve
CVE: CVE-2024-12107
Published: 2024-12-04
Description: Double-Free Vulnerability in uD3TN BPv7 Caused by Malformed Endpoint Identifier allows remote attacker to reliably cause DoS
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://gitlab.com/d3tn/ud3tn/-/issues/233
CVE: CVE-2024-52272
Published: 2024-12-04
Description: Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (fromAdvSetLanip(overflow arg:lanMask) modules) allows Overflow Buffers.This issue affects Tenda AC6V2: through 15.03.06.50
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.vulsec.org/advisories
CVE: CVE-2024-52273
Published: 2024-12-04
Description: Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (setDoublePppoeConfig->guest_ip_check(overflow arg: mask) modules) allows Overflow Buffers.This issue affects Tenda AC6V2: through 15.03.06.50
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.vulsec.org/advisories
CVE: CVE-2024-52274
Published: 2024-12-04
Description: Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (setDoubleL2tpConfig->guest_ip_check(overflow arg: mask) modules) allows Overflow Buffers.This issue affects Tenda AC6V2: through 15.03.06.50
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.vulsec.org/advisories
CVE: CVE-2024-52275
Published: 2024-12-04
Description: Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (fromWizardHandle modules) allows Overflow Buffers.This issue affects Tenda AC6V2: through 15.03.06.50.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.tendacn.com/download/detail-3316.html; https://www.tendacn.com/download/detail-3794.html; https://www.vulsec.org/advisories
CVE: CVE-2024-52276
Published: 2024-12-04
Description: User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing.
1. Displayed version does not show the layer flattened version, which is provided when the "Print" option is used.
2. Displayed version does not show the layer flattened version, which is provided when the combined download option is used.
3. Displayed version does not show the layer flattened version, which is also the provided version when downloading the result in the uncombined option.
Once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened.
This issue affects DocuSign: through 2024-12-04.
CVSS Score: 7.5 (HIGH)
CWE: CWE-451
References: https://drive.proton.me/urls/QD7Z493XX4#Yn3eKAjuZA5m; https://new.space/s/3SG3wQxTSg7lq-vLzUjy-Q#mmrg4t0wMThwTqs9nogVHdLAjMFlkgFnKHn_Q8u9cCs; https://www.loom.com/share/65ce5423d2a04e0bbd2688a178d5427f
CVE: CVE-2024-52277
Published: 2024-12-04
Description: User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSeal allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened.


This issue affects DocuSeal: through 1.8.1, >1.8.1.
CWE: CWE-451
References: https://docuseal.com/; https://docuseal.eu/; https://github.com/docusealco/docuseal
CVE: CVE-2024-10576
Published: 2024-12-04
Description: Infinix devices contain a pre-loaded "com.transsion.agingfunction" application, that exposes an unsecured broadcast receiver. An attacker can communicate with the receiver and force the device to perform a factory reset without any Android system permissions. 

After multiple attempts to contact the vendor we did not receive any answer. We suppose this issue affects all Infinix Mobile devices.
CWE: CWE-925
References: https://cert.pl/en/posts/2024/12/CVE-2024-10576/; https://cert.pl/posts/2024/12/CVE-2024-10576/
CVE: CVE-2024-11854
Published: 2024-12-04
Description: The Listdom – Business Directory and Classified Ads Listings WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/listdom/tags/3.6.0/templates/search/tpl.php#L22; https://plugins.trac.wordpress.org/changeset/3200502/; https://wordpress.org/plugins/listdom/#developers
CVE: CVE-2024-52269
Published: 2024-12-04
Description: User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing.
The SaaS AI assistant ignores hidden content that is rendered after signing, misleading the user.
For reference see: CVE-2024-52276
This issue affects DocuSign: through 2024-12-04.
CVSS Score: 8.1 (HIGH)
CWE: CWE-451
References: https://www.loom.com/share/65ce5423d2a04e0bbd2688a178d5427f; https://www.vulsec.org/advisories
CVE: CVE-2024-52278
Published: 2024-12-04
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-54153
Published: 2024-12-04
Description: In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter
CVSS Score: 3.1 (LOW)
CWE: CWE-862, CWE-306
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-54154
Published: 2024-12-04
Description: In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox
CVSS Score: 8.0 (HIGH)
CWE: CWE-23, CWE-22
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-54155
Published: 2024-12-04
Description: In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication
CVSS Score: 3.7 (LOW)
CWE: CWE-862, CWE-306
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-54156
Published: 2024-12-04
Description: In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-1321
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-54157
Published: 2024-12-04
Description: In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1333
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-54158
Published: 2024-12-04
Description: In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding
CVSS Score: 3.5 (LOW)
CWE: CWE-173, CWE-290
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-8894
Published: 2024-12-04
Description: Out-of-bounds Write vulnerability was discovered in Open Design Alliance Drawings SDK before 2025.10. Reading crafted DWF file and missing proper checks on received SectionIterator data can trigger an unhandled exception. This can allow attackers to cause a crash, potentially enabling a denial-of-service attack (Crash, Exit, or Restart) or possible code execution.
CWE: CWE-787
References: https://www.opendesign.com/security-advisories
CVE: CVE-2024-8962
Published: 2024-12-04
Description: The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wpbits-addons-for-elementor/trunk/includes/elementor-config.php#L721; https://plugins.trac.wordpress.org/changeset/3200392/; https://wordpress.org/plugins/wpbits-addons-for-elementor/#developers
CVE: CVE-2024-11935
Published: 2024-12-04
Description: The Email Address Obfuscation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/email-address-obfuscation/trunk/email-address-obfuscation.php#L38; https://plugins.trac.wordpress.org/changeset/3201993/; https://wordpress.org/plugins/email-address-obfuscation/#developers