cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,poc,trended,trended_no_1,published,trended_score
CVE-2024-12636,https://securityvulnerability.io/vulnerability/CVE-2024-12636,Cross-Site Request Forgery Vulnerability in WP Legal Pages Plugin for WordPress,"The WP Legal Pages plugin for WordPress is affected by a Cross-Site Request Forgery vulnerability that impacts all versions up to and including 3.2.6. The issue arises from a lack of adequate nonce validation in the 'create_popup_delete_process' function. This flaw allows unauthenticated attackers to exploit this vulnerability by deceiving site administrators into triggering a malicious link, thereby facilitating the unauthorized deletion of popups. Website administrators using this plugin should implement necessary updates and apply security best practices to safeguard their sites from potential exploitations.",Wordpress,"Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages",4.3,MEDIUM,0.0004600000102072954,false,,false,false,false,,false,false,2024-12-25T04:22:03.605Z,0
CVE-2023-4968,https://securityvulnerability.io/vulnerability/CVE-2023-4968,Stored Cross-Site Scripting Vulnerability in WPLegalPages Plugin for WordPress,"The WPLegalPages plugin for WordPress contains a vulnerability that allows authenticated users with author-level permissions or higher to perform stored cross-site scripting. This issue arises from insufficient input sanitization and output escaping of user-supplied attributes within the 'wplegalpage' shortcode. As a result, attackers can inject malicious web scripts into pages, which will execute when a user accesses the compromised content, potentially leading to unauthorized actions and data exposure.",Wordpress,"Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages",4.8,MEDIUM,0.0005799999926239252,false,,false,false,false,,false,false,2023-10-20T07:15:00.000Z,0
CVE-2021-25106,https://securityvulnerability.io/vulnerability/CVE-2021-25106,WPLegalPages < 2.7.1 - Subscriber+ Arbitrary Settings Update to Stored XSS,"The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1 does not check for authorisation and has a flawed CSRF logic when saving its settings, allowing any authenticated users, such as subscriber, to update them. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored Cross-Site Scripting",Wordpress,"Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPlegalpages",5.4,MEDIUM,0.000539999979082495,false,,false,false,false,,false,false,2022-02-07T15:47:23.000Z,0