From 06103e0f967c09740ba58ed88f14803948e80145 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Sat, 15 Feb 2025 06:32:22 +0000
Subject: [PATCH] Publish Advisories

GHSA-67x3-pf53-7724
GHSA-hw8r-x6gr-5gjp
GHSA-j27x-pp9j-vhj8
---
 .../GHSA-67x3-pf53-7724.json                  | 29 +++++++++++
 .../GHSA-hw8r-x6gr-5gjp.json                  | 52 +++++++++++++++++++
 .../GHSA-j27x-pp9j-vhj8.json                  | 29 +++++++++++
 3 files changed, 110 insertions(+)
 create mode 100644 advisories/unreviewed/2025/02/GHSA-67x3-pf53-7724/GHSA-67x3-pf53-7724.json
 create mode 100644 advisories/unreviewed/2025/02/GHSA-hw8r-x6gr-5gjp/GHSA-hw8r-x6gr-5gjp.json
 create mode 100644 advisories/unreviewed/2025/02/GHSA-j27x-pp9j-vhj8/GHSA-j27x-pp9j-vhj8.json

diff --git a/advisories/unreviewed/2025/02/GHSA-67x3-pf53-7724/GHSA-67x3-pf53-7724.json b/advisories/unreviewed/2025/02/GHSA-67x3-pf53-7724/GHSA-67x3-pf53-7724.json
new file mode 100644
index 00000000000..53397a72daf
--- /dev/null
+++ b/advisories/unreviewed/2025/02/GHSA-67x3-pf53-7724/GHSA-67x3-pf53-7724.json
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-67x3-pf53-7724",
+  "modified": "2025-02-15T06:30:51Z",
+  "published": "2025-02-15T06:30:51Z",
+  "aliases": [
+    "CVE-2024-13208"
+  ],
+  "details": "The Maps Plugin using Google Maps for WordPress  WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13208"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/f86d4f64-208f-407f-8d2c-a89b5e0ac777"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-15T06:15:35Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/02/GHSA-hw8r-x6gr-5gjp/GHSA-hw8r-x6gr-5gjp.json b/advisories/unreviewed/2025/02/GHSA-hw8r-x6gr-5gjp/GHSA-hw8r-x6gr-5gjp.json
new file mode 100644
index 00000000000..90b9346fc3a
--- /dev/null
+++ b/advisories/unreviewed/2025/02/GHSA-hw8r-x6gr-5gjp/GHSA-hw8r-x6gr-5gjp.json
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-hw8r-x6gr-5gjp",
+  "modified": "2025-02-15T06:30:51Z",
+  "published": "2025-02-15T06:30:51Z",
+  "aliases": [
+    "CVE-2025-1302"
+  ],
+  "details": "Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.\n\n**Note:**\n\nThis is caused by an incomplete fix for [CVE-2024-21534](https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884).",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1302"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/JSONPath-Plus/JSONPath/commit/30942896d27cb8a806b965a5ca9ef9f686be24ee"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gist.github.com/nickcopi/11ba3cb4fdee6f89e02e6afae8db6456"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/JSONPath-Plus/JSONPath/blob/8e4acf8aff5f446aa66323e12394ac5615c3b260/src/Safe-Script.js%23L127"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-8719585"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-94"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-15T05:15:11Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/02/GHSA-j27x-pp9j-vhj8/GHSA-j27x-pp9j-vhj8.json b/advisories/unreviewed/2025/02/GHSA-j27x-pp9j-vhj8/GHSA-j27x-pp9j-vhj8.json
new file mode 100644
index 00000000000..04427d84278
--- /dev/null
+++ b/advisories/unreviewed/2025/02/GHSA-j27x-pp9j-vhj8/GHSA-j27x-pp9j-vhj8.json
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-j27x-pp9j-vhj8",
+  "modified": "2025-02-15T06:30:51Z",
+  "published": "2025-02-15T06:30:51Z",
+  "aliases": [
+    "CVE-2024-13306"
+  ],
+  "details": "The Maps Plugin using Google Maps for WordPress  WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13306"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/ec3096f2-60fd-4654-9e95-5cf4b20b2990"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-15T06:15:36Z"
+  }
+}
\ No newline at end of file