Publish Advisories

GHSA-67x3-pf53-7724
GHSA-hw8r-x6gr-5gjp
GHSA-j27x-pp9j-vhj8

advisories/unreviewed/2025/02/GHSA-67x3-pf53-7724/GHSA-67x3-pf53-7724.json

@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-67x3-pf53-7724",
+  "modified": "2025-02-15T06:30:51Z",
+  "published": "2025-02-15T06:30:51Z",
+  "aliases": [
+    "CVE-2024-13208"
+  ],
+  "details": "The Maps Plugin using Google Maps for WordPress  WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13208"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/f86d4f64-208f-407f-8d2c-a89b5e0ac777"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-15T06:15:35Z"
+  }
+}

advisories/unreviewed/2025/02/GHSA-hw8r-x6gr-5gjp/GHSA-hw8r-x6gr-5gjp.json

@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-hw8r-x6gr-5gjp",
+  "modified": "2025-02-15T06:30:51Z",
+  "published": "2025-02-15T06:30:51Z",
+  "aliases": [
+    "CVE-2025-1302"
+  ],
+  "details": "Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.\n\n**Note:**\n\nThis is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1302"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/JSONPath-Plus/JSONPath/commit/30942896d27cb8a806b965a5ca9ef9f686be24ee"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gist.github.com/nickcopi/11ba3cb4fdee6f89e02e6afae8db6456"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/JSONPath-Plus/JSONPath/blob/8e4acf8aff5f446aa66323e12394ac5615c3b260/src/Safe-Script.js%23L127"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-8719585"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-94"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-15T05:15:11Z"
+  }
+}

advisories/unreviewed/2025/02/GHSA-j27x-pp9j-vhj8/GHSA-j27x-pp9j-vhj8.json

@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-j27x-pp9j-vhj8",
+  "modified": "2025-02-15T06:30:51Z",
+  "published": "2025-02-15T06:30:51Z",
+  "aliases": [
+    "CVE-2024-13306"
+  ],
+  "details": "The Maps Plugin using Google Maps for WordPress  WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13306"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/ec3096f2-60fd-4654-9e95-5cf4b20b2990"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-15T06:15:36Z"
+  }
+}