cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,poc,trended,trended_no_1,published,trended_score
CVE-2024-10437,https://securityvulnerability.io/vulnerability/CVE-2024-10437,Unauthorized Smart Message Activation/Deactivation Vulnerability,"The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to unauthorized Smar Message activation/deactivation due to a missing capability check on the ajax_enable function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate or deactivate smart messages.",Wordpress,WPc Smart Messages For WooCommerce,4.3,MEDIUM,0.0005300000193528831,false,,false,false,false,,false,false,2024-10-29T09:31:30.293Z,0
CVE-2024-10436,https://securityvulnerability.io/vulnerability/CVE-2024-10436,Arbitrary File Inclusion Vulnerability in WPC Smart Messages for WooCommerce,"The WPC Smart Messages for WooCommerce plugin experiences a Local File Inclusion vulnerability in all versions up to and including 4.2.1. This issue arises through the get_condition_value function, allowing authenticated attackers with Subscriber-level access or greater to include and execute arbitrary files on the server. This exploit can facilitate the execution of any PHP code within those files, enabling attackers to bypass access controls, access sensitive information, or execute undesirable commands, particularly when handling file uploads deemed 'safe' like images.",Wordpress,WPc Smart Messages For WooCommerce,8.8,HIGH,0.0006600000197067857,false,,false,false,false,,false,false,2024-10-29T09:31:29.768Z,0