{"vulnerability": "cve-2024-1357", "sightings": [{"uuid": "0ac772fe-24ec-45d9-a4f2-22aa21f64a07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13575", "type": "seen", "source": "https://t.me/cvedetector/18304", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13575 - WordPress Web Stories Enhancer Stored Cross-Site Scripting\", \n  \"Content\": \"CVE ID : CVE-2024-13575 \nPublished : Feb. 18, 2025, 8:15 a.m. | 1\u00a0hour, 17\u00a0minutes ago \nDescription : The Web Stories Enhancer \u2013 Level Up Your Web Stories plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'web_stories_enhancer' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. \nSeverity: 6.4 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"18 Feb 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-02-18T10:57:39.000000Z"}, {"uuid": "95697d8f-34b4-4e04-9e33-8684a8a76e43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13572", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/2896", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13572\n\ud83d\udd39 Description: The Precious Metals Charts and Widgets for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nfusion-widget' shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\n\ud83d\udccf Published: 2025-01-24T11:07:31.292Z\n\ud83d\udccf Modified: 2025-01-24T11:07:31.292Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/3f2c8c5f-2017-4b22-a864-dc142b3b1afb?source=cve\n2. https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3227123%40precious-metals-chart-and-widgets&new=3227123%40precious-metals-chart-and-widgets&sfp_email=&sfph_mail=", "creation_timestamp": "2025-01-24T12:04:52.000000Z"}, {"uuid": "e3e48887-36ad-422f-9e8b-712b2490d0ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13570", "type": "seen", "source": "Telegram/lx4wGdsY_gQLQuqVoslLB2K7y9SKVSeQioyVnDGaeQElwxGl", "content": "", "creation_timestamp": "2025-02-20T23:26:55.000000Z"}, {"uuid": "a72686bd-9d30-4f58-a07a-52464a72632e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13576", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/4743", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13576\n\ud83d\udd25 CVSS Score: 6.4 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)\n\ud83d\udd39 Description: The Gumlet Video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gumlet' shortcode in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\n\ud83d\udccf Published: 2025-02-18T04:21:16.825Z\n\ud83d\udccf Modified: 2025-02-18T04:21:16.825Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/6b8b94fc-9ae7-47f3-b804-92d0948b662e?source=cve\n2. https://plugins.trac.wordpress.org/browser/gumlet-video/tags/1.0.3/gumlet-video.php#L112", "creation_timestamp": "2025-02-18T07:56:55.000000Z"}, {"uuid": "4a4e2064-bba1-4f6e-b5e0-b2c57f986885", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13571", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/5468", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13571\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: The Post Timeline WordPress plugin before 2.3.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.\n\ud83d\udccf Published: 2025-02-26T06:00:08.361Z\n\ud83d\udccf Modified: 2025-02-26T06:00:08.361Z\n\ud83d\udd17 References:\n1. https://wpscan.com/vulnerability/ad6ad44d-fdc3-494c-a371-5d7959d1fd23/", "creation_timestamp": "2025-02-26T06:25:22.000000Z"}, {"uuid": "5c9f61f8-aac4-4cf9-b355-afcfaf575728", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13579", "type": "seen", "source": "Telegram/W6Vt72IcEKK_NIzBRivOs06x6l5E0rbVdXZ55EsXoKZ_9SVh", "content": "", "creation_timestamp": "2025-02-18T11:39:00.000000Z"}, {"uuid": "bfd16686-a713-415a-ad21-1a3d01952657", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13578", "type": "seen", "source": "Telegram/Z8lXXuR_XY2uE49CtR_fYdvxOnLAQcxAUnjWKsEG3YJrAh5N", "content": "", "creation_timestamp": "2025-02-18T11:39:00.000000Z"}, {"uuid": "14ba6c6a-8fca-4b54-8000-14d0c6307c4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13577", "type": "seen", "source": "Telegram/m6t5a5_T44EtOj8pcc111kPNfhm6SelY22bU-zbQ1JR_JiNU", "content": "", "creation_timestamp": "2025-02-18T11:39:00.000000Z"}, {"uuid": "51eb5fb9-3c24-4e5a-af2d-a4814c259ca3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13576", "type": "seen", "source": "Telegram/tNPYFPjzKUKYx5oXf2I-UfSqCuNLtvvlhq2Hyx1LsyCecyRD", "content": "", "creation_timestamp": "2025-02-18T11:39:00.000000Z"}, {"uuid": "2286ee9c-a586-4bdb-b5c0-3051af7cce27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13573", "type": "seen", "source": "Telegram/4A52AUYC8Vw08yCF3uVtixeO2MAtWcwf8ZY9Yr48T6dEtIoA", "content": "", "creation_timestamp": "2025-02-18T11:39:00.000000Z"}, {"uuid": "2003e728-976b-4c80-a80e-ae51f3643c28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13570", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113983764830958800", "content": "", "creation_timestamp": "2025-02-11T06:10:24.698831Z"}, {"uuid": "8a255621-e138-4419-8b5c-173e2a9c9fae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13570", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lhuz2lnozs23", "content": "", "creation_timestamp": "2025-02-11T06:15:41.853890Z"}, {"uuid": "67c4f7ad-b17b-45aa-bf9e-6761ba8416c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13570", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lhv7yfm53c2e", "content": "", "creation_timestamp": "2025-02-11T08:19:48.560365Z"}, {"uuid": "653d0c73-edb7-4c1e-83e6-aea138488b1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13573", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3ligiyuvz7n2t", "content": "", "creation_timestamp": "2025-02-18T05:16:20.042699Z"}, {"uuid": "49f66eb7-4aa5-455f-94dd-abe8370fe032", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13576", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3ligiyxyjkw2i", "content": "", "creation_timestamp": "2025-02-18T05:16:23.068975Z"}, {"uuid": "473e5405-4590-4d44-8925-5fb180714196", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13577", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3ligiz3c6fa2o", "content": "", "creation_timestamp": "2025-02-18T05:16:26.839802Z"}, {"uuid": "e2b3af56-8391-4492-83af-68255d34f78f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13578", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3ligiz5ladv2g", "content": "", "creation_timestamp": "2025-02-18T05:16:28.948263Z"}, {"uuid": "ef1720d0-de8f-4dd9-a5a2-515532d3ca91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13579", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3ligizaq3si23", "content": "", "creation_timestamp": "2025-02-18T05:16:32.382274Z"}, {"uuid": "2289c2b6-33ef-40b3-ad6e-7eceda8da57f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13575", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3ligszqr45d2y", "content": "", "creation_timestamp": "2025-02-18T08:15:47.216998Z"}, {"uuid": "24e11fe2-f179-40f4-8775-f42a9037f8a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13575", "type": "seen", "source": "Telegram/Ky5hP4m-lhVgCP6ty9hGJUt61hpUqW0YwnWxnQOPh1FlPKX9", "content": "", "creation_timestamp": "2025-02-21T22:10:24.000000Z"}, {"uuid": "09899293-6940-413f-8e5e-edf8db4c5457", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13574", "type": "seen", "source": "https://t.me/cvedetector/20050", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13574 - \"XV Random Quotes WordPress Reflected Cross-Site Scripting\"\", \n  \"Content\": \"CVE ID : CVE-2024-13574 \nPublished : March 11, 2025, 6:15 a.m. | 1\u00a0hour, 47\u00a0minutes ago \nDescription : The XV Random Quotes WordPress plugin through 1.40 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"11 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-11T09:16:01.000000Z"}, {"uuid": "c93e4728-e5b3-4881-a270-22245253398d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13572", "type": "seen", "source": "https://t.me/cvedetector/16273", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13572 - WordPress Precious Metals Charts and Widgets Stored Cross-Site Scripting\", \n  \"Content\": \"CVE ID : CVE-2024-13572 \nPublished : Jan. 24, 2025, 11:15 a.m. | 28\u00a0minutes ago \nDescription : The Precious Metals Charts and Widgets for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nfusion-widget' shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. \nSeverity: 6.4 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"24 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-24T12:44:08.000000Z"}, {"uuid": "b231cd59-6723-4469-bc98-f5c9d83398b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13575", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/4762", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13575\n\ud83d\udd25 CVSS Score: 6.4 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)\n\ud83d\udd39 Description: The Web Stories Enhancer \u2013 Level Up Your Web Stories plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'web_stories_enhancer' shortcode in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\n\ud83d\udccf Published: 2025-02-18T07:28:15.305Z\n\ud83d\udccf Modified: 2025-02-18T07:28:15.305Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc614f2-37a6-474a-828a-1f34f98715c5?source=cve\n2. https://plugins.trac.wordpress.org/browser/web-stories-enhancer/trunk/includes/shortcode.php#L99\n3. https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3238312%40web-stories-enhancer&new=3238312%40web-stories-enhancer&sfp_email=&sfph_mail=", "creation_timestamp": "2025-02-18T08:41:06.000000Z"}, {"uuid": "0fc212e7-2b54-43c4-9cb2-74c692ade107", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13572", "type": "seen", "source": "Telegram/2kFzb7ZNCW5gW7NiL1UIix6EpsL9Sb57B8XLi2CCM7JWY-vp", "content": "", "creation_timestamp": "2025-02-06T02:43:27.000000Z"}, {"uuid": "d65d9474-b63a-4cb4-bdad-03664fbd9256", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13570", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3meovcdy55s2q", "content": "", "creation_timestamp": "2026-02-12T21:03:22.796399Z"}, {"uuid": "648ad143-0e98-4a8f-baee-c901397df58c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13579", "type": "seen", "source": "https://t.me/cvedetector/18292", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13579 - WordPress WP-Asambleas Stored Cross-Site Scripting Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-13579 \nPublished : Feb. 18, 2025, 5:15 a.m. | 2\u00a0hours, 15\u00a0minutes ago \nDescription : The WP-Asambleas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'polls_popup' shortcode in all versions up to, and including, 2.85.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. \nSeverity: 6.4 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"18 Feb 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-02-18T09:17:06.000000Z"}, {"uuid": "37ccc253-7a52-4bb2-a21c-fd86900bb124", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13570", "type": "seen", "source": "https://t.me/cvedetector/17674", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13570 - WordPress Stray Random Quotes Reflected Cross-Site Scripting\", \n  \"Content\": \"CVE ID : CVE-2024-13570 \nPublished : Feb. 11, 2025, 6:15 a.m. | 1\u00a0hour, 50\u00a0minutes ago \nDescription : The Stray Random Quotes WordPress plugin through 1.9.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"11 Feb 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-02-11T09:49:34.000000Z"}, {"uuid": "03d036ed-63f6-4ed0-82b6-15e9b2d00575", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13573", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/4740", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13573\n\ud83d\udd25 CVSS Score: 6.4 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)\n\ud83d\udd39 Description: The Zigaform \u2013 Form Builder Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zgfm_rfvar' shortcode in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\n\ud83d\udccf Published: 2025-02-18T04:21:17.957Z\n\ud83d\udccf Modified: 2025-02-18T04:21:17.957Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/768d0ef5-5213-4283-b95e-ddfe0d2196bf?source=cve\n2. https://plugins.trac.wordpress.org/browser/zigaform-form-builder-lite/trunk/modules/formbuilder/controllers/uiform-fb-controller-frontend.php#L366", "creation_timestamp": "2025-02-18T07:56:49.000000Z"}, {"uuid": "80703ac4-e594-4e3a-bdda-1f4b9eda6ac3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13577", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/4748", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13577\n\ud83d\udd25 CVSS Score: 6.4 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)\n\ud83d\udd39 Description: The CATS Job Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catsone' shortcode in all versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\n\ud83d\udccf Published: 2025-02-18T04:21:14.965Z\n\ud83d\udccf Modified: 2025-02-18T04:21:14.965Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/4c0af593-2674-484a-a6a5-715f6fb488cf?source=cve\n2. https://plugins.trac.wordpress.org/browser/cats-job-listings/trunk/CATSJobListingUser.php#L57", "creation_timestamp": "2025-02-18T07:57:01.000000Z"}]}