rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-10460 
The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.
Problem types: description: Confusing display of origin for external protocol handler prompt
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Shaheen Fazim
Published: 2024-10-29T12:19:10.679Z
CVE-2024-10461 
In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which could allow XSS attacks. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.
Problem types: description: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Masato Kinugawa
Published: 2024-10-29T12:19:11.706Z
CVE-2024-10462 
Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.
Problem types: description: Origin of permission prompt could be spoofed by long URL
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Hafiizh
Published: 2024-10-29T12:19:12.782Z
CVE-2024-10463 
Video frames could have been leaked between origins in some situations. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132.
Problem types: description: Cross origin video frame leak
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Karl Tomlinson
Published: 2024-10-29T12:19:13.795Z
CVE-2024-10464 
Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser. This was addressed by introducing rate-limiting to this API. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.
Problem types: description: History interface could have been used to cause a Denial of Service condition in the browser
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Andrei Enache
Published: 2024-10-29T12:19:14.864Z
CVE-2024-10465 
A clipboard "paste" button could persist across tabs which allowed a spoofing attack. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.
Problem types: description: Clipboard "paste" button persisted across tabs
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Kang Ali and Nur Fadhillah of Punggawa Cybersecurity
Published: 2024-10-29T12:19:15.936Z
CVE-2024-10466 
By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.
Problem types: description: DOM push subscription message could hang Thunderbird
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Kagami Rosylight
Published: 2024-10-29T12:19:17.005Z
CVE-2024-10467 
Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.
Problem types: description: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Andrew McCreight, the Mozilla Fuzzing Team
Published: 2024-10-29T12:19:18.057Z
CVE-2024-10468 
Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash. This vulnerability affects Firefox < 132 and Thunderbird < 132.
Problem types: description: Race conditions in IndexedDB
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Tyson Smith
Published: 2024-10-29T12:19:19.111Z
CVE-2024-10469 CERT/CC VINCE versions before 3.0.9 allows authenticated user to access User Management view.
VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users.
Problem types: cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: vendor: CERT/CC
product: VINCE
default_status: unaffected
Credits: lang: en
value: This issues was reported by an internal user of VINCE
Published: 2024-10-28T15:38:29.062Z
CVE-2024-10470 WPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and Deletion
The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation and permissions checks in the readfile and unlink functions in all versions up to, and including, 4.962. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The theme is vulnerable even when it is not activated.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: VibeThemes
product: WPLMS Learning Management System for WordPress, WordPress LMS
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: Friderika Baranyai
Published: 2024-11-09T05:40:22.357Z
CVE-2024-10471 Everest Forms < 3.0.4.2 - Admin+ Stored XSS
The Everest Forms  WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Everest Forms
default_status: unaffected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2024-11-26T06:00:06.615Z
CVE-2024-10472 Stylish Price List  < 7.1.12 - Contributor+ Stored XSS
The Stylish Price List  WordPress plugin before 7.1.12 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Stylish Price List
default_status: unaffected
Credits: lang: en
value: Krugov Artyom
lang: en
value: WPScan
Published: 2025-03-25T06:00:04.490Z
CVE-2024-10473 Logo Slider < 4.5.0 - Author+ Stored XSS
The Logo Slider  WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo Settings when outputing them in pages where the Logo Slider shortcode is embed, which could allow users with a role as low as Author to perform Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Logo Slider
default_status: unaffected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2024-11-28T06:00:05.185Z
CVE-2024-10474 
Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circumventing some URL safety checks This vulnerability affects Focus for iOS < 132.
Problem types: description: Don't allow web content to open firefox-focus URLs
Affected products: vendor: Mozilla
product: Focus for iOS
Credits: lang: en
value: James Lee
Published: 2024-10-29T12:19:20.120Z
CVE-2024-10475 Lead Form Builder < 1.9.8 - Admin+ Stored XSS
The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Responsive Contact Form Builder & Lead Generation Plugin
default_status: unaffected
Credits: lang: en
value: Krugov Artyom
lang: en
value: WPScan
Published: 2025-05-15T20:06:43.490Z
CVE-2024-10476 
Default credentials are used in the above listed BD Diagnostic Solutions products. If exploited, threat actors may be able to access, modify or delete data, including sensitive information such as protected health information (PHI) and personally identifiable information (PII). Exploitation of this vulnerability may allow an attacker to shut down or otherwise impact the availability of the system. Note: BD Synapsys™ Informatics
Solution is only in scope of
this vulnerability when
installed on a NUC server. BD Synapsys™
Informatics Solution installed
on a customer-provided virtual machine or on the BD Kiestra™ SCU hardware is
not in scope.
Problem types: cwe_id: CWE-1392
description: CWE-1392 USE OF DEFAULT CREDENTIALS
Affected products: vendor: Becton Dickinson & Co
product: BD BACTEC™ Blood Culture System
default_status: affected
vendor: Becton Dickinson & Co
product: BD COR™ System
default_status: affected
vendor: Becton Dickinson & Co
product: BD EpiCenter™ Microbiology Data Management System
default_status: affected
vendor: Becton Dickinson & Co
product: BD MAX™ System
default_status: affected
vendor: Becton Dickinson & Co
product: BD Phoenix™ M50 Automated Microbiology System
default_status: affected
vendor: Becton Dickinson & Co
product: BD Synapsys™ Informatics Solution
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-12-17T15:16:44.982Z
CVE-2024-10477 LinZhaoguan pb-cms Permission Management Page admin#permissions cross site scripting
A vulnerability classified as problematic was found in LinZhaoguan pb-cms up to 2.0.1. This vulnerability affects unknown code of the file /admin#permissions of the component Permission Management Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
Affected products: vendor: LinZhaoguan
product: pb-cms
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: VulDB Gitee Analyzer
Published: 2024-10-29T00:31:08.354Z
CVE-2024-10478 LinZhaoguan pb-cms Edit Article edit cross site scripting
A vulnerability, which was classified as problematic, has been found in LinZhaoguan pb-cms up to 2.0.1. This issue affects some unknown processing of the file /admin#article/edit?id=2 of the component Edit Article Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
Affected products: vendor: LinZhaoguan
product: pb-cms
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: VulDB Gitee Analyzer
Published: 2024-10-29T00:31:15.499Z
CVE-2024-10479 LinZhaoguan pb-cms Theme Management Module admin#themes cross site scripting
A vulnerability, which was classified as problematic, was found in LinZhaoguan pb-cms up to 2.0.1. Affected is an unknown function of the file /admin#themes of the component Theme Management Module. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
Affected products: vendor: LinZhaoguan
product: pb-cms
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
baseSeverity: LOW
Credits: lang: en
value: VulDB Gitee Analyzer
Published: 2024-10-29T01:00:14.763Z
CVE-2024-10480 3DPrint Lite < 2.1 - Settings Update via CSRF
The 3DPrint Lite WordPress plugin before 2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: 3DPrint Lite
default_status: unaffected
Credits: lang: en
value: Vuln Seeker Cybersecurity Team
lang: en
value: WPScan
Published: 2024-12-06T06:00:07.090Z
CVE-2024-10481 Cross-Site Request Forgery (CSRF) in comfyanonymous/comfyui
A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. This vulnerability allows attackers to host malicious websites that, when visited by authenticated ComfyUI users, can perform arbitrary API requests on behalf of the user. This can be exploited to perform actions such as uploading arbitrary files via the `/upload/image` endpoint. The lack of CSRF protections on API endpoints like `/upload/image`, `/prompt`, and `/history` leaves users vulnerable to unauthorized actions, which could be combined with other vulnerabilities such as stored-XSS to further compromise user sessions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: comfyanonymous
product: comfyanonymous/comfyui
Published: 2025-03-20T10:09:02.407Z
CVE-2024-10482 Media Library Tools < 1.5.0 - Author+ Stored XSS via SVG
The Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO  WordPress plugin before 1.5.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO
default_status: unaffected
Credits: lang: en
value: Bob Matyas
lang: en
value: WPScan
Published: 2024-11-21T06:00:02.180Z
CVE-2024-10483 SimplePress Forum < 6.10.11 - Reflected XSS
The Simple:Press Forum WordPress plugin before 6.10.11 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Simple:Press Forum
default_status: unaffected
Credits: lang: en
value: Ryoma Yamada
lang: en
value: WPScan
Published: 2025-02-26T06:00:05.748Z
CVE-2024-10484 Spectra – WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget
The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Team' widget in all versions up to, and including, 2.16.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: brainstormforce
product: Spectra Gutenberg Blocks – Website Builder for the Block Editor
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: D.Sim
Published: 2024-12-03T05:33:26.364Z
CVE-2024-10486 Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File
The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible print_php_information.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PHP configuration, which can be used to aid other attacks.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: woocommerce
product: Google for WooCommerce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Francesco Carlucci
Published: 2024-11-18T21:31:09.032Z
CVE-2024-10487 
Out of bounds write in Dawn in Google Chrome prior to 130.0.6723.92 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical)
Problem types: cwe_id: CWE-787
description: Out of bounds write
Affected products: vendor: Google
product: Chrome
Published: 2024-10-29T21:55:42.286Z
CVE-2024-10488 
Use after free in WebRTC in Google Chrome prior to 130.0.6723.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2024-10-29T21:55:42.729Z
CVE-2024-10490 Authentication bypass flaw in several mapp components
An “Authentication Bypass Using an Alternate Path or Channel” vulnerability in the OPC UA Server configuration required for B&R mapp Cockpit before 6.0, B&R mapp View before 6.0, B&R mapp Services before 6.0, B&R mapp Motion before 6.0 and B&R mapp Vision before 6.0 may be used by an unauthenticated network-based attacker to cause information disclosure, unintended change of data, or denial of service conditions.
B&R mapp Services is only affected, when mpUserX or mpCodeBox are used in the Automation Studio project.
Problem types: cwe_id: CWE-288
description: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: B&R Industrial Automation GmbH
product: B&R mapp Cockpit
default_status: unaffected
vendor: B&R Industrial Automation GmbH
product: B&R mapp View
default_status: unaffected
vendor: B&R Industrial Automation GmbH
product: B&R mapp Services
default_status: unaffected
vendor: B&R Industrial Automation GmbH
product: B&R mapp Motion
default_status: unaffected
vendor: B&R Industrial Automation GmbH
product: B&R mapp Vision
default_status: unaffected
Published: 2024-12-02T08:46:44.044Z
CVE-2024-10491 Preload arbitrary resources by injecting additional `Link` headers
A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.

The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources.

This vulnerability is especially relevant for dynamic parameters.
Problem types: cwe_id: CWE-74
description: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected products: vendor: express
product: express
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: abze
Published: 2024-10-29T16:23:21.219Z
CVE-2024-10492 Keycloak-quarkus-server: keycloak path trasversal
A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not.
Problem types: cwe_id: CWE-73
description: External Control of File Name or Path
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat build of Keycloak 24
cpes: cpe:/a:redhat:build_keycloak:24::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 24
cpes: cpe:/a:redhat:build_keycloak:24::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 24
cpes: cpe:/a:redhat:build_keycloak:24::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 24.0.9
cpes: cpe:/a:redhat:build_keycloak:24
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Keycloak 26.0
cpes: cpe:/a:redhat:build_keycloak:26.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.0
cpes: cpe:/a:redhat:build_keycloak:26.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.0
cpes: cpe:/a:redhat:build_keycloak:26.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.0.6
cpes: cpe:/a:redhat:build_keycloak:26
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform Expansion Pack
cpes: cpe:/a:redhat:jbosseapxp
default_status: unaffected
vendor: Red Hat
product: Red Hat Single Sign-On 7
cpes: cpe:/a:redhat:red_hat_single_sign_on:7
default_status: unknown
Credits: lang: en
value: Red Hat would like to thank Brahim Raddahi (is4u.be) for reporting this issue.
Published: 2024-11-25T07:37:30.572Z
CVE-2024-10493 Element Pack Elementor Addons < 5.10.3 - Contributor+ Stored XSS
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) WordPress plugin before 5.10.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)
default_status: unaffected
Credits: lang: en
value: Dmitrii Ignatyev
lang: en
value: WPScan
Published: 2024-11-28T06:00:07.715Z