-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: Weston Steimel <[email protected]>
- Loading branch information
1 parent
80086fc
commit 4899f4d
Showing
30 changed files
with
831 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| { | ||
| "additionalMetadata": { | ||
| "cna": "wordfence", | ||
| "cveId": "CVE-2024-10484", | ||
| "description": "The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Team' widget in all versions up to, and including, 2.16.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", | ||
| "reason": "Added CPE configurations because not yet analyzed by NVD.", | ||
| "references": [ | ||
| "https://plugins.trac.wordpress.org/changeset/3180325/", | ||
| "https://wordpress.org/plugins/ultimate-addons-for-gutenberg/#developers", | ||
| "https://www.wordfence.com/threat-intel/vulnerabilities/id/c218bf5e-b28b-4512-8bc7-7662b4a06f1e?source=cve" | ||
| ] | ||
| }, | ||
| "adp": { | ||
| "affected": [ | ||
| { | ||
| "collectionURL": "https://wordpress.org/plugins", | ||
| "cpes": [ | ||
| "cpe:2.3:a:brainstormforce:spectra:*:*:*:*:*:wordpress:*:*" | ||
| ], | ||
| "packageName": "ultimate-addons-for-gutenberg", | ||
| "packageType": "wordpress-plugin", | ||
| "product": "Spectra – WordPress Gutenberg Blocks", | ||
| "repo": "https://plugins.svn.wordpress.org/ultimate-addons-for-gutenberg", | ||
| "vendor": "brainstormforce", | ||
| "versions": [ | ||
| { | ||
| "lessThan": "2.16.3", | ||
| "status": "affected", | ||
| "version": "0", | ||
| "versionType": "semver" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "providerMetadata": { | ||
| "orgId": "00000000-0000-4000-8000-000000000000", | ||
| "shortName": "anchoreadp" | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| { | ||
| "additionalMetadata": { | ||
| "cna": "wpscan", | ||
| "cveId": "CVE-2024-10893", | ||
| "description": "The WP Booking Calendar WordPress plugin before 10.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", | ||
| "reason": "Added CPE configurations because not yet analyzed by NVD.", | ||
| "references": [ | ||
| "https://wpscan.com/vulnerability/a230a552-3fda-4145-810f-58af540107db/" | ||
| ] | ||
| }, | ||
| "adp": { | ||
| "affected": [ | ||
| { | ||
| "collectionURL": "https://wordpress.org/plugins", | ||
| "cpes": [ | ||
| "cpe:2.3:a:booking_calendar_project:booking_calendar:*:*:*:*:*:wordpress:*:*", | ||
| "cpe:2.3:a:wpbookingcalendar:booking_calendar:*:*:*:*:*:wordpress:*:*", | ||
| "cpe:2.3:a:wpbookingcalendar:wp_booking_calendar:*:*:*:*:*:wordpress:*:*" | ||
| ], | ||
| "packageName": "booking", | ||
| "packageType": "wordpress-plugin", | ||
| "product": "WP Booking Calendar", | ||
| "repo": "https://plugins.svn.wordpress.org/booking", | ||
| "vendor": "wpdevelop", | ||
| "versions": [ | ||
| { | ||
| "lessThan": "10.6.5", | ||
| "status": "affected", | ||
| "version": "0", | ||
| "versionType": "semver" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "providerMetadata": { | ||
| "orgId": "00000000-0000-4000-8000-000000000000", | ||
| "shortName": "anchoreadp" | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| { | ||
| "additionalMetadata": { | ||
| "cna": "wordfence", | ||
| "cveId": "CVE-2024-11326", | ||
| "description": "The Campaign Monitor Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.", | ||
| "reason": "Added CPE configurations because not yet analyzed by NVD.", | ||
| "references": [ | ||
| "https://plugins.trac.wordpress.org/browser/campaign-monitor-wp/trunk/includes/eoi-subscribers.php#L353", | ||
| "https://plugins.trac.wordpress.org/changeset/3198560/campaign-monitor-wp/trunk/includes/eoi-subscribers.php", | ||
| "https://www.wordfence.com/threat-intel/vulnerabilities/id/95ebb2ad-91a8-4a0d-ba91-f417943545b4?source=cve" | ||
| ] | ||
| }, | ||
| "adp": { | ||
| "affected": [ | ||
| { | ||
| "collectionURL": "https://wordpress.org/plugins", | ||
| "cpes": [ | ||
| "cpe:2.3:a:fatcatapps:campaign_monitor_optin_cat:*:*:*:*:*:wordpress:*:*" | ||
| ], | ||
| "packageName": "campaign-monitor-wp", | ||
| "packageType": "wordpress-plugin", | ||
| "product": "Campaign Monitor Forms by Optin Cat", | ||
| "repo": "https://plugins.svn.wordpress.org/campaign-monitor-wp", | ||
| "vendor": "fatcatapps", | ||
| "versions": [ | ||
| { | ||
| "lessThan": "2.5.8", | ||
| "status": "affected", | ||
| "version": "0", | ||
| "versionType": "semver" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "providerMetadata": { | ||
| "orgId": "00000000-0000-4000-8000-000000000000", | ||
| "shortName": "anchoreadp" | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| { | ||
| "additionalMetadata": { | ||
| "cna": "wordfence", | ||
| "cveId": "CVE-2024-11391", | ||
| "description": "The Advanced File Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'class_fma_connector.php' file in all versions up to, and including, 5.2.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible.", | ||
| "reason": "Added CPE configurations because not yet analyzed by NVD.", | ||
| "references": [ | ||
| "https://plugins.trac.wordpress.org/changeset/3199242/", | ||
| "https://www.wordfence.com/threat-intel/vulnerabilities/id/f14a658c-1517-4af4-8bd7-c379ac07ab35?source=cve" | ||
| ] | ||
| }, | ||
| "adp": { | ||
| "affected": [ | ||
| { | ||
| "collectionURL": "https://wordpress.org/plugins", | ||
| "cpes": [ | ||
| "cpe:2.3:a:advancedfilemanager:advanced_file_manager:*:*:*:*:*:wordpress:*:*" | ||
| ], | ||
| "packageName": "file-manager-advanced", | ||
| "packageType": "wordpress-plugin", | ||
| "product": "Advanced File Manager", | ||
| "repo": "https://plugins.svn.wordpress.org/file-manager-advanced", | ||
| "vendor": "modalweb", | ||
| "versions": [ | ||
| { | ||
| "lessThan": "5.2.11", | ||
| "status": "affected", | ||
| "version": "0", | ||
| "versionType": "semver" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "providerMetadata": { | ||
| "orgId": "00000000-0000-4000-8000-000000000000", | ||
| "shortName": "anchoreadp" | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| { | ||
| "additionalMetadata": { | ||
| "cna": "wordfence", | ||
| "cveId": "CVE-2024-11732", | ||
| "description": "The BP Profile Shortcodes Extra plugin for WordPress is vulnerable to time-based SQL Injection via the ‘tab’ parameter in all versions up to, and including, 2.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.", | ||
| "reason": "Added CPE configurations because not yet analyzed by NVD.", | ||
| "references": [ | ||
| "https://plugins.trac.wordpress.org/browser/bp-profile-shortcodes-extra/tags/2.6.0/inc/bppsc-shortcodes-extra.php#L1694", | ||
| "https://wordpress.org/plugins/bp-profile-shortcodes-extra/#developers", | ||
| "https://www.wordfence.com/threat-intel/vulnerabilities/id/d7324a4e-ff45-4908-bcaa-379b130f73c0?source=cve" | ||
| ] | ||
| }, | ||
| "adp": { | ||
| "affected": [ | ||
| { | ||
| "collectionURL": "https://wordpress.org/plugins", | ||
| "cpes": [ | ||
| "cpe:2.3:a:venutius:bp_profile_shortcodes_extra:*:*:*:*:*:wordpress:*:*" | ||
| ], | ||
| "packageName": "bp-profile-shortcodes-extra", | ||
| "packageType": "wordpress-plugin", | ||
| "product": "BP Profile Shortcodes Extra", | ||
| "repo": "https://plugins.svn.wordpress.org/bp-profile-shortcodes-extra", | ||
| "vendor": "venutius", | ||
| "versions": [ | ||
| { | ||
| "lessThanOrEqual": "2.6.0", | ||
| "status": "affected", | ||
| "version": "0", | ||
| "versionType": "semver" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "providerMetadata": { | ||
| "orgId": "00000000-0000-4000-8000-000000000000", | ||
| "shortName": "anchoreadp" | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| { | ||
| "additionalMetadata": { | ||
| "cna": "wordfence", | ||
| "cveId": "CVE-2024-11782", | ||
| "description": "The WP Mailster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mst_subscribe' shortcode in all versions up to, and including, 1.8.17.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", | ||
| "reason": "Added CPE configurations because not yet analyzed by NVD.", | ||
| "references": [ | ||
| "https://plugins.trac.wordpress.org/browser/wp-mailster/tags/1.8.17.0/mailster/subscr/SubscriberPlugin.php#L216", | ||
| "https://plugins.trac.wordpress.org/changeset/3198497/wp-mailster/trunk/mailster/subscr/SubscriberPlugin.php", | ||
| "https://www.wordfence.com/threat-intel/vulnerabilities/id/909beed4-06a9-4ec4-bf00-4072a38af82b?source=cve" | ||
| ] | ||
| }, | ||
| "adp": { | ||
| "affected": [ | ||
| { | ||
| "collectionURL": "https://wordpress.org/plugins", | ||
| "cpes": [ | ||
| "cpe:2.3:a:wpmailster:wp_mailster:*:*:*:*:*:wordpress:*:*" | ||
| ], | ||
| "packageName": "wp-mailster", | ||
| "packageType": "wordpress-plugin", | ||
| "product": "WP Mailster", | ||
| "repo": "https://plugins.svn.wordpress.org/wp-mailster", | ||
| "vendor": "brandtoss", | ||
| "versions": [ | ||
| { | ||
| "lessThan": "1.8.18.0", | ||
| "status": "affected", | ||
| "version": "0", | ||
| "versionType": "semver" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "providerMetadata": { | ||
| "orgId": "00000000-0000-4000-8000-000000000000", | ||
| "shortName": "anchoreadp" | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| { | ||
| "additionalMetadata": { | ||
| "cna": "wordfence", | ||
| "cveId": "CVE-2024-11844", | ||
| "description": "The IdeaPush plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the idea_push_taxonomy_save_routine function in all versions up to, and including, 8.71. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete terms for the \"boards\" taxonomy.", | ||
| "reason": "Added CPE configurations because not yet analyzed by NVD.", | ||
| "references": [ | ||
| "https://plugins.trac.wordpress.org/browser/ideapush/trunk/ideapush.php#L766", | ||
| "https://plugins.trac.wordpress.org/changeset/3198488/ideapush/trunk/ideapush.php", | ||
| "https://www.wordfence.com/threat-intel/vulnerabilities/id/34603c3f-834f-4a2a-9b9f-5213155d4317?source=cve" | ||
| ] | ||
| }, | ||
| "adp": { | ||
| "affected": [ | ||
| { | ||
| "collectionURL": "https://wordpress.org/plugins", | ||
| "cpes": [ | ||
| "cpe:2.3:a:northernbeacheswebsites:ideapush:*:*:*:*:*:wordpress:*:*" | ||
| ], | ||
| "packageName": "ideapush", | ||
| "packageType": "wordpress-plugin", | ||
| "product": "IdeaPush", | ||
| "repo": "https://plugins.svn.wordpress.org/ideapush", | ||
| "vendor": "northernbeacheswebsites", | ||
| "versions": [ | ||
| { | ||
| "lessThan": "8.72", | ||
| "status": "affected", | ||
| "version": "0", | ||
| "versionType": "semver" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "providerMetadata": { | ||
| "orgId": "00000000-0000-4000-8000-000000000000", | ||
| "shortName": "anchoreadp" | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| { | ||
| "additionalMetadata": { | ||
| "cna": "chrome", | ||
| "cveId": "CVE-2024-12053", | ||
| "description": "Type Confusion in V8 in Google Chrome prior to 131.0.6778.108 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)", | ||
| "reason": "Added CPE configurations because not yet analyzed by NVD.", | ||
| "references": [ | ||
| "https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop.html", | ||
| "https://issues.chromium.org/issues/379009132" | ||
| ] | ||
| }, | ||
| "adp": { | ||
| "affected": [ | ||
| { | ||
| "cpes": [ | ||
| "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*" | ||
| ], | ||
| "product": "Chrome", | ||
| "vendor": "Google", | ||
| "versions": [ | ||
| { | ||
| "lessThan": "131.0.6778.108", | ||
| "status": "affected", | ||
| "version": "0", | ||
| "versionType": "custom" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "providerMetadata": { | ||
| "orgId": "00000000-0000-4000-8000-000000000000", | ||
| "shortName": "anchoreadp" | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.