deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-2920
Published: 2024-04-26
Description: The WP-Members Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.4.9.3 due to the plugin uploading user supplied files to a publicly accessible directory in wp-content without any restrictions. This makes it possible for unauthenticated attackers to view files uploaded by other users which may contain sensitive information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3074215%40wp-members&new=3074215%40wp-members&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/4319fa2e-8826-4100-9156-cbe80582367e?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3074215%40wp-members&new=3074215%40wp-members&sfp_email=&sfph_mail=
CVE: CVE-2024-33598
Published: 2024-04-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twinpictures Annual Archive allows Stored XSS.This issue affects Annual Archive: from n/a through 1.6.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/anual-archive/wordpress-annual-archive-plugin-1-6-0-cross-site-scripting-xss-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/anual-archive/wordpress-annual-archive-plugin-1-6-0-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2024-33638
Published: 2024-04-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Brijesh Kothari Smart Maintenance Mode.This issue affects Smart Maintenance Mode: from n/a through 1.4.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/smart-maintenance-mode/wordpress-smart-maintenance-mode-plugin-1-4-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/smart-maintenance-mode/wordpress-smart-maintenance-mode-plugin-1-4-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-33639
Published: 2024-04-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AccessAlly PopupAlly allows Stored XSS.This issue affects PopupAlly: from n/a through 2.1.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/popupally/wordpress-popupally-plugin-2-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/popupally/wordpress-popupally-plugin-2-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33642
Published: 2024-04-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EkoJR Advanced Post List allows Stored XSS.This issue affects Advanced Post List: from n/a through 0.5.6.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/advanced-post-list/wordpress-advanced-post-list-plugin-0-5-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/advanced-post-list/wordpress-advanced-post-list-plugin-0-5-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33650
Published: 2024-04-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Cryout Creations Serious Slider.This issue affects Serious Slider: from n/a through 1.2.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/cryout-serious-slider/wordpress-serious-slider-plugin-1-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/cryout-serious-slider/wordpress-serious-slider-plugin-1-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-33651
Published: 2024-04-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Matthew Fries MF Gig Calendar.This issue affects MF Gig Calendar : from n/a through 1.2.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/mf-gig-calendar/wordpress-mf-gig-calendar-plugin-1-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mf-gig-calendar/wordpress-mf-gig-calendar-plugin-1-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-3678
Published: 2024-04-26
Description: The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2. This makes it possible for unauthenticated attackers to view limited information from password protected posts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-922
References: https://plugins.trac.wordpress.org/changeset/3069574/blog2social/trunk/includes/Meta.php; https://plugins.trac.wordpress.org/changeset/3074883/blog2social/trunk/includes/Meta.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/2dea1bcb-14c2-4ec9-8a4d-087bac2db486?source=cve
CVE: CVE-2024-3890
Published: 2024-04-26
Description: The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Calendly widget in all versions up to, and including, 3.10.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3076871/happy-elementor-addons/trunk/widgets/calendly/widget.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/22e4eb2a-2c2b-4f4f-821e-8d2d7e558364?source=cve; https://plugins.trac.wordpress.org/changeset/3076871/happy-elementor-addons/trunk/widgets/calendly/widget.php
CVE: CVE-2024-1789
Published: 2024-04-26
Description: The WP SMTP plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in versions 1.2 to 1.2.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.2 (HIGH)
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3076663%40wp-smtp&new=3076663%40wp-smtp&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ee269bc7-2822-4a07-be91-6763c1cf6cf2?source=cve; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3076663%40wp-smtp&new=3076663%40wp-smtp&sfp_email=&sfph_mail=
CVE: CVE-2024-22091
Published: 2024-04-26
Description: Mattermost versions 8.1.x <= 8.1.10, 9.6.x <= 9.6.0, 9.5.x <= 9.5.2 and 8.1.x <= 8.1.11 fail to limit the size of a request path that includes user inputs which allows an attacker to cause excessive resource consumption, possibly leading to a DoS via sending large request paths


CVSS Score: 3.1 (LOW)
CWE: CWE-400, CWE-770
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-32046
Published: 2024-04-26
Description: Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requests even if the developer mode is off which allows an attacker to get information about the server such as the full path were files are stored


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-209
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-3962
Published: 2024-04-26
Description: The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppom_upload_file function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Successful exploitation requires the PPOM Pro plugin to be installed along with a WooCommerce product that contains a file upload field to retrieve the correct nonce.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://plugins.trac.wordpress.org/changeset/3075669/woocommerce-product-addon; https://themeisle.com/plugins/ppom-pro/; https://www.wordfence.com/threat-intel/vulnerabilities/id/4f95bcc3-354e-4016-9a17-945569b076b6?source=cve
CVE: CVE-2024-4182
Published: 2024-04-26
Description: Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-4183
Published: 2024-04-26
Description: Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessions, which allows an authenticated attacker to crash the server via repeated requests to the getSessions API after flooding the sessions table.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-770
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-4195
Published: 2024-04-26
Description: Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authenticated as a team admin to promote guests to team admins via crafted HTTP requests.


CVSS Score: 2.7 (LOW)
CWE: CWE-284
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-4198
Published: 2024-04-26
Description: Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authenticated as team admin to demote users to guest via crafted HTTP requests.


CVSS Score: 2.7 (LOW)
CWE: CWE-284
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-0740
Published: 2024-04-26
Description: Eclipse Target Management: Terminal and Remote System Explorer (RSE) version <= 4.5.400 has a remote code execution vulnerability that does not require authentication. 





The fixed version is included in Eclipse IDE 2024-03



CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-77
References: https://git.eclipse.org/r/c/tm/org.eclipse.tm/+/202145; https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/171; https://git.eclipse.org/r/c/tm/org.eclipse.tm/+/202145
CVE: CVE-2024-3682
Published: 2024-04-26
Description: The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions up to, and including, 5.4.3, respectively, via the ajaxSendReport function. This makes it possible for unauthenticated attackers to extract sensitive data from a log file, including system information and (in the Pro version) license keys. Successful exploitation requires an administrator to have used the 'Contact Us' functionality along with the "Enable this option to automatically submit the log files." option.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3076275/wp-staging; https://wp-staging.com/wp-staging-changelog/; https://wp-staging.com/wp-staging-pro-changelog/
CVE: CVE-2024-32826
Published: 2024-04-26
Description: Missing Authorization vulnerability in Vektor,Inc. VK Block Patterns.This issue affects VK Block Patterns: from n/a through 1.31.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/vk-block-patterns/wordpress-vk-block-patterns-plugin-1-31-0-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/vk-block-patterns/wordpress-vk-block-patterns-plugin-1-31-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32828
Published: 2024-04-26
Description: Missing Authorization vulnerability in Octolize Flexible Shipping.This issue affects Flexible Shipping: from n/a through 4.24.15.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/flexible-shipping/wordpress-table-rate-shipping-method-for-woocommerce-by-flexible-shipping-plugin-4-24-15-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/flexible-shipping/wordpress-table-rate-shipping-method-for-woocommerce-by-flexible-shipping-plugin-4-24-15-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32829
Published: 2024-04-26
Description: Missing Authorization vulnerability in Supsystic Data Tables Generator by Supsystic.This issue affects Data Tables Generator by Supsystic: from n/a through 1.10.31.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/data-tables-generator-by-supsystic/wordpress-data-tables-generator-by-supsystic-plugin-1-10-31-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/data-tables-generator-by-supsystic/wordpress-data-tables-generator-by-supsystic-plugin-1-10-31-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-32957
Published: 2024-04-26
Description: Missing Authorization vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a through 1.5.38.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/live-composer-page-builder/wordpress-page-builder-live-composer-plugin-1-5-38-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/live-composer-page-builder/wordpress-page-builder-live-composer-plugin-1-5-38-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2024-33677
Published: 2024-04-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Renzo Johnson Contact Form 7 Extension For Mailchimp.This issue affects Contact Form 7 Extension For Mailchimp: from n/a through 0.5.70.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/contact-form-7-mailchimp-extension/wordpress-contact-form-7-extension-for-mailchimp-plugin-0-5-70-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contact-form-7-mailchimp-extension/wordpress-contact-form-7-extension-for-mailchimp-plugin-0-5-70-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-33678
Published: 2024-04-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection.This issue affects ClickCease Click Fraud Protection: from n/a through <= 3.2.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/clickcease-click-fraud-protection/vulnerability/wordpress-clickcease-click-fraud-protection-plugin-3-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/clickcease-click-fraud-protection/wordpress-clickcease-click-fraud-protection-plugin-3-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-33679
Published: 2024-04-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in FameThemes FameTheme Demo Importer.This issue affects FameTheme Demo Importer: from n/a through 1.1.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/famethemes-demo-importer/wordpress-fametheme-demo-importer-plugin-1-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/famethemes-demo-importer/wordpress-fametheme-demo-importer-plugin-1-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-33680
Published: 2024-04-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in MainWP MainWP Child Reports.This issue affects MainWP Child Reports: from n/a through 2.1.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/mainwp-child-reports/wordpress-mainwp-child-reports-plugin-2-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mainwp-child-reports/wordpress-mainwp-child-reports-plugin-2-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-33682
Published: 2024-04-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Cookie Information A/S WP GDPR Compliance.This issue affects WP GDPR Compliance: from n/a through 2.0.23.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-gdpr-compliance/wordpress-wp-gdpr-compliance-plugin-2-0-23-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-gdpr-compliance/wordpress-wp-gdpr-compliance-plugin-2-0-23-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-33683
Published: 2024-04-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Republic Hide Dashboard Notifications.This issue affects Hide Dashboard Notifications: from n/a through 1.2.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/wp-hide-backed-notices/wordpress-hide-dashboard-notifications-plugin-1-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-hide-backed-notices/wordpress-hide-dashboard-notifications-plugin-1-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-32822
Published: 2024-04-26
Description: Missing Authorization vulnerability in impleCode Reviews Plus.This issue affects Reviews Plus: from n/a through 1.3.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/reviews-plus/wordpress-reviews-plus-plugin-1-3-4-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/reviews-plus/wordpress-reviews-plus-plugin-1-3-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-52646
Published: 2024-04-26
Description: In the Linux kernel, the following vulnerability has been resolved:

aio: fix mremap after fork null-deref

Commit e4a0d3e720e7 ("aio: Make it possible to remap aio ring") introduced
a null-deref if mremap is called on an old aio mapping after fork as
mm->ioctx_table will be set to NULL.

[jmoyer@redhat.com: fix 80 column issue]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/178993157e8c50aef7f35d7d6d3b44bb428199e1; https://git.kernel.org/stable/c/4326d0080f7e84fba775da41d158f46cf9d3f1c2; https://git.kernel.org/stable/c/808f1e4b5723ae4eda724d2ad6f6638905eefd95
CVE: CVE-2024-33688
Published: 2024-04-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Extend Themes Teluro.This issue affects Teluro: from n/a through 1.0.31.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/teluro/wordpress-teluro-theme-1-0-31-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/teluro/wordpress-teluro-theme-1-0-31-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-33689
Published: 2024-04-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Tony Zeoli Radio Station radio-station.This issue affects Radio Station: from n/a through <= 2.5.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/radio-station/vulnerability/wordpress-radio-station-plugin-2-5-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/radio-station/wordpress-radio-station-plugin-2-5-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-33690
Published: 2024-04-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Jegstudio Financio.This issue affects Financio: from n/a through 1.1.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/financio/wordpress-financio-theme-1-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/financio/wordpress-financio-theme-1-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2024-33691
Published: 2024-04-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in OptinMonster Popup Builder Team OptinMonster.This issue affects OptinMonster: from n/a through 2.15.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/optinmonster/wordpress-popup-builder-by-optinmonster-plugin-2-15-3-cross-site-request-forgery-csrf-notice-dismissal-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/optinmonster/wordpress-popup-builder-by-optinmonster-plugin-2-15-3-cross-site-request-forgery-csrf-notice-dismissal-vulnerability?_s_id=cve
CVE: CVE-2024-33692
Published: 2024-04-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Satrya Smart Recent Posts Widget allows Stored XSS.This issue affects Smart Recent Posts Widget: from n/a through 1.0.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/smart-recent-posts-widget/wordpress-smart-recent-posts-widget-plugin-1-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/smart-recent-posts-widget/wordpress-smart-recent-posts-widget-plugin-1-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33693
Published: 2024-04-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks Smart Social Widget allows Stored XSS.This issue affects Meks Smart Social Widget: from n/a through 1.6.4.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/meks-smart-social-widget/wordpress-meks-smart-social-widget-plugin-1-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/meks-smart-social-widget/wordpress-meks-smart-social-widget-plugin-1-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33694
Published: 2024-04-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks ThemeForest Smart Widget allows Stored XSS.This issue affects Meks ThemeForest Smart Widget: from n/a through 1.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/meks-themeforest-smart-widget/wordpress-meks-themeforest-smart-widget-plugin-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/meks-themeforest-smart-widget/wordpress-meks-themeforest-smart-widget-plugin-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-33695
Published: 2024-04-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode Fan Page Widget by ThemeNcode allows Stored XSS.This issue affects Fan Page Widget by ThemeNcode: from n/a through 2.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/facebook-fan-page-widget/wordpress-fan-page-widget-by-themencode-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/facebook-fan-page-widget/wordpress-fan-page-widget-by-themencode-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve