From ff28c6c21d1d0a2262e11c5de8c4a30077491ed3 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 4 Oct 2024 06:32:27 +0000
Subject: [PATCH] Publish Advisories

GHSA-29hv-5386-jfwg
GHSA-2v79-c5jv-4gpr
GHSA-3879-q6vj-r6vq
GHSA-38jv-hg5q-hg9r
GHSA-57x5-fg6f-hxv2
GHSA-64fq-27g4-rw74
GHSA-72p3-695j-v465
GHSA-7722-9fw9-q66x
GHSA-7q4r-r4hp-357v
GHSA-8j37-24m2-5x5f
GHSA-8q9m-fx9g-p437
GHSA-ffgp-p9ff-m7wf
GHSA-gg28-j4wr-8f8f
GHSA-ggpp-fvmj-x8x4
GHSA-j77x-ch92-7jfr
GHSA-phc2-g348-384g
GHSA-qwc7-2536-jw6j
GHSA-r75g-vg6w-4m4h
GHSA-wwcp-26wc-3fxm
---
 .../GHSA-29hv-5386-jfwg.json                  | 50 +++++++++++++
 .../GHSA-2v79-c5jv-4gpr.json                  | 46 ++++++++++++
 .../GHSA-3879-q6vj-r6vq.json                  | 46 ++++++++++++
 .../GHSA-38jv-hg5q-hg9r.json                  | 54 ++++++++++++++
 .../GHSA-57x5-fg6f-hxv2.json                  | 42 +++++++++++
 .../GHSA-64fq-27g4-rw74.json                  | 46 ++++++++++++
 .../GHSA-72p3-695j-v465.json                  | 38 ++++++++++
 .../GHSA-7722-9fw9-q66x.json                  | 46 ++++++++++++
 .../GHSA-7q4r-r4hp-357v.json                  | 42 +++++++++++
 .../GHSA-8j37-24m2-5x5f.json                  | 54 ++++++++++++++
 .../GHSA-8q9m-fx9g-p437.json                  | 50 +++++++++++++
 .../GHSA-ffgp-p9ff-m7wf.json                  | 74 +++++++++++++++++++
 .../GHSA-gg28-j4wr-8f8f.json                  | 42 +++++++++++
 .../GHSA-ggpp-fvmj-x8x4.json                  | 42 +++++++++++
 .../GHSA-j77x-ch92-7jfr.json                  | 46 ++++++++++++
 .../GHSA-phc2-g348-384g.json                  | 39 ++++++++++
 .../GHSA-qwc7-2536-jw6j.json                  | 42 +++++++++++
 .../GHSA-r75g-vg6w-4m4h.json                  | 46 ++++++++++++
 .../GHSA-wwcp-26wc-3fxm.json                  | 39 ++++++++++
 19 files changed, 884 insertions(+)
 create mode 100644 advisories/unreviewed/2024/10/GHSA-29hv-5386-jfwg/GHSA-29hv-5386-jfwg.json
 create mode 100644 advisories/unreviewed/2024/10/GHSA-2v79-c5jv-4gpr/GHSA-2v79-c5jv-4gpr.json
 create mode 100644 advisories/unreviewed/2024/10/GHSA-3879-q6vj-r6vq/GHSA-3879-q6vj-r6vq.json
 create mode 100644 advisories/unreviewed/2024/10/GHSA-38jv-hg5q-hg9r/GHSA-38jv-hg5q-hg9r.json
 create mode 100644 advisories/unreviewed/2024/10/GHSA-57x5-fg6f-hxv2/GHSA-57x5-fg6f-hxv2.json
 create mode 100644 advisories/unreviewed/2024/10/GHSA-64fq-27g4-rw74/GHSA-64fq-27g4-rw74.json
 create mode 100644 advisories/unreviewed/2024/10/GHSA-72p3-695j-v465/GHSA-72p3-695j-v465.json
 create mode 100644 advisories/unreviewed/2024/10/GHSA-7722-9fw9-q66x/GHSA-7722-9fw9-q66x.json
 create mode 100644 advisories/unreviewed/2024/10/GHSA-7q4r-r4hp-357v/GHSA-7q4r-r4hp-357v.json
 create mode 100644 advisories/unreviewed/2024/10/GHSA-8j37-24m2-5x5f/GHSA-8j37-24m2-5x5f.json
 create mode 100644 advisories/unreviewed/2024/10/GHSA-8q9m-fx9g-p437/GHSA-8q9m-fx9g-p437.json
 create mode 100644 advisories/unreviewed/2024/10/GHSA-ffgp-p9ff-m7wf/GHSA-ffgp-p9ff-m7wf.json
 create mode 100644 advisories/unreviewed/2024/10/GHSA-gg28-j4wr-8f8f/GHSA-gg28-j4wr-8f8f.json
 create mode 100644 advisories/unreviewed/2024/10/GHSA-ggpp-fvmj-x8x4/GHSA-ggpp-fvmj-x8x4.json
 create mode 100644 advisories/unreviewed/2024/10/GHSA-j77x-ch92-7jfr/GHSA-j77x-ch92-7jfr.json
 create mode 100644 advisories/unreviewed/2024/10/GHSA-phc2-g348-384g/GHSA-phc2-g348-384g.json
 create mode 100644 advisories/unreviewed/2024/10/GHSA-qwc7-2536-jw6j/GHSA-qwc7-2536-jw6j.json
 create mode 100644 advisories/unreviewed/2024/10/GHSA-r75g-vg6w-4m4h/GHSA-r75g-vg6w-4m4h.json
 create mode 100644 advisories/unreviewed/2024/10/GHSA-wwcp-26wc-3fxm/GHSA-wwcp-26wc-3fxm.json

diff --git a/advisories/unreviewed/2024/10/GHSA-29hv-5386-jfwg/GHSA-29hv-5386-jfwg.json b/advisories/unreviewed/2024/10/GHSA-29hv-5386-jfwg/GHSA-29hv-5386-jfwg.json
new file mode 100644
index 00000000000..98782f39700
--- /dev/null
+++ b/advisories/unreviewed/2024/10/GHSA-29hv-5386-jfwg/GHSA-29hv-5386-jfwg.json
@@ -0,0 +1,50 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-29hv-5386-jfwg",
+  "modified": "2024-10-04T06:30:46Z",
+  "published": "2024-10-04T06:30:46Z",
+  "aliases": [
+    "CVE-2024-9242"
+  ],
+  "details": "The Memberful – Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'memberful_buy_subscription_link' and 'memberful_podcasts_link' shortcodes in all versions up to, and including, 1.73.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9242"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/memberful-wp/tags/1.73.7/src/shortcodes.php#L25"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/memberful-wp/tags/1.73.7/src/shortcodes.php#L59"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3161020%40memberful-wp&new=3161020%40memberful-wp&sfp_email=&sfph_mail="
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e9e30377-2b5a-4b2d-9f19-bae91608fb24?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-04T06:15:05Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/10/GHSA-2v79-c5jv-4gpr/GHSA-2v79-c5jv-4gpr.json b/advisories/unreviewed/2024/10/GHSA-2v79-c5jv-4gpr/GHSA-2v79-c5jv-4gpr.json
new file mode 100644
index 00000000000..0fc7460dcc8
--- /dev/null
+++ b/advisories/unreviewed/2024/10/GHSA-2v79-c5jv-4gpr/GHSA-2v79-c5jv-4gpr.json
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2v79-c5jv-4gpr",
+  "modified": "2024-10-04T06:30:45Z",
+  "published": "2024-10-04T06:30:45Z",
+  "aliases": [
+    "CVE-2024-9353"
+  ],
+  "details": "The Popularis Extra plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9353"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/popularis-extra/tags/1.2.6/includes/wizard/wizard.php#L305"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3161466%40popularis-extra&new=3161466%40popularis-extra&sfp_email=&sfph_mail="
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4fc82778-0493-456f-bc73-3d70e3a2b1bf?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-04T05:15:13Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/10/GHSA-3879-q6vj-r6vq/GHSA-3879-q6vj-r6vq.json b/advisories/unreviewed/2024/10/GHSA-3879-q6vj-r6vq/GHSA-3879-q6vj-r6vq.json
new file mode 100644
index 00000000000..e14451fa633
--- /dev/null
+++ b/advisories/unreviewed/2024/10/GHSA-3879-q6vj-r6vq/GHSA-3879-q6vj-r6vq.json
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3879-q6vj-r6vq",
+  "modified": "2024-10-04T06:30:45Z",
+  "published": "2024-10-04T06:30:45Z",
+  "aliases": [
+    "CVE-2024-9445"
+  ],
+  "details": "The Display Medium Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_medium_posts shortcode in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9445"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/display-medium-posts/trunk/display-medium-posts.php#L200"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wordpress.org/plugins/display-medium-posts"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/be1e0216-d9de-45e9-837c-0cccb78729a6?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-04T05:15:14Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/10/GHSA-38jv-hg5q-hg9r/GHSA-38jv-hg5q-hg9r.json b/advisories/unreviewed/2024/10/GHSA-38jv-hg5q-hg9r/GHSA-38jv-hg5q-hg9r.json
new file mode 100644
index 00000000000..86acd27a920
--- /dev/null
+++ b/advisories/unreviewed/2024/10/GHSA-38jv-hg5q-hg9r/GHSA-38jv-hg5q-hg9r.json
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-38jv-hg5q-hg9r",
+  "modified": "2024-10-04T06:30:45Z",
+  "published": "2024-10-04T06:30:45Z",
+  "aliases": [
+    "CVE-2024-9237"
+  ],
+  "details": "The Fish and Ships – Most flexible shipping table rate. A WooCommerce shipping rate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.5.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9237"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/fish-and-ships/tags/1.5.9/includes/wizard.php#L226"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/fish-and-ships/tags/1.5.9/includes/wizard.php#L369"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/fish-and-ships/tags/1.5.9/includes/wizard.php#L479"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3161229%40fish-and-ships&new=3161229%40fish-and-ships&sfp_email=&sfph_mail="
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ceaf64d6-9872-4572-807e-7fce76edee57?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-04T05:15:12Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/10/GHSA-57x5-fg6f-hxv2/GHSA-57x5-fg6f-hxv2.json b/advisories/unreviewed/2024/10/GHSA-57x5-fg6f-hxv2/GHSA-57x5-fg6f-hxv2.json
new file mode 100644
index 00000000000..7ee3ab81c70
--- /dev/null
+++ b/advisories/unreviewed/2024/10/GHSA-57x5-fg6f-hxv2/GHSA-57x5-fg6f-hxv2.json
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-57x5-fg6f-hxv2",
+  "modified": "2024-10-04T06:30:45Z",
+  "published": "2024-10-04T06:30:45Z",
+  "aliases": [
+    "CVE-2024-9372"
+  ],
+  "details": "The WP Blocks Hub plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9372"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wordpress.org/plugins/wp-blocks-hub/#developers"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7d32b2cc-9336-432e-9d2e-67db8b0e3f90?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-04T05:15:13Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/10/GHSA-64fq-27g4-rw74/GHSA-64fq-27g4-rw74.json b/advisories/unreviewed/2024/10/GHSA-64fq-27g4-rw74/GHSA-64fq-27g4-rw74.json
new file mode 100644
index 00000000000..21d0895c434
--- /dev/null
+++ b/advisories/unreviewed/2024/10/GHSA-64fq-27g4-rw74/GHSA-64fq-27g4-rw74.json
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-64fq-27g4-rw74",
+  "modified": "2024-10-04T06:30:45Z",
+  "published": "2024-10-04T06:30:45Z",
+  "aliases": [
+    "CVE-2024-9384"
+  ],
+  "details": "The Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9384"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/wholesale-pricing-woocommerce/tags/3.8.0/includes/settings/class-alg-wc-wholesale-pricing-settings-per-product.php#L126"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset/3161269/wholesale-pricing-woocommerce/tags/3.8.1/includes/settings/class-alg-wc-wholesale-pricing-settings-per-product.php"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e84ee2b5-96b5-427c-ac66-7f80418ae02f?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-04T05:15:13Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/10/GHSA-72p3-695j-v465/GHSA-72p3-695j-v465.json b/advisories/unreviewed/2024/10/GHSA-72p3-695j-v465/GHSA-72p3-695j-v465.json
new file mode 100644
index 00000000000..8e675d4c9de
--- /dev/null
+++ b/advisories/unreviewed/2024/10/GHSA-72p3-695j-v465/GHSA-72p3-695j-v465.json
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-72p3-695j-v465",
+  "modified": "2024-10-04T06:30:45Z",
+  "published": "2024-10-04T06:30:45Z",
+  "aliases": [
+    "CVE-2024-47854"
+  ],
+  "details": "A vulnerability was discovered in Veritas Data Insight before 7.1. It allows a remote attacker to inject an arbitrary web script into an HTTP request that could reflect back to an authenticated user without sanitization if executed by that user.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47854"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.veritas.com/content/support/en_US/security/VTS24-010"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-04T06:15:03Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/10/GHSA-7722-9fw9-q66x/GHSA-7722-9fw9-q66x.json b/advisories/unreviewed/2024/10/GHSA-7722-9fw9-q66x/GHSA-7722-9fw9-q66x.json
new file mode 100644
index 00000000000..fa21444e8eb
--- /dev/null
+++ b/advisories/unreviewed/2024/10/GHSA-7722-9fw9-q66x/GHSA-7722-9fw9-q66x.json
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7722-9fw9-q66x",
+  "modified": "2024-10-04T06:30:45Z",
+  "published": "2024-10-04T06:30:45Z",
+  "aliases": [
+    "CVE-2024-9345"
+  ],
+  "details": "The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable when notices are present.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9345"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/product-delivery-date-for-woocommerce-lite/tags/-2.7.3/includes/component/pro-notices-in-lite/ts-pro-notices.php#L102"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset/3161353/product-delivery-date-for-woocommerce-lite/tags/2.7.4/includes/component/pro-notices-in-lite/ts-pro-notices.php"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1127a5f3-1698-45e9-85bd-4eebfdbe56d4?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-04T05:15:12Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/10/GHSA-7q4r-r4hp-357v/GHSA-7q4r-r4hp-357v.json b/advisories/unreviewed/2024/10/GHSA-7q4r-r4hp-357v/GHSA-7q4r-r4hp-357v.json
new file mode 100644
index 00000000000..b91a299b09d
--- /dev/null
+++ b/advisories/unreviewed/2024/10/GHSA-7q4r-r4hp-357v/GHSA-7q4r-r4hp-357v.json
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7q4r-r4hp-357v",
+  "modified": "2024-10-04T06:30:45Z",
+  "published": "2024-10-04T06:30:45Z",
+  "aliases": [
+    "CVE-2024-9368"
+  ],
+  "details": "The Aggregator Advanced Settings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9368"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wordpress.org/plugins/aggregator-advanced-settings/#developers"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/838bfa4c-2eb7-4f76-a6c3-ab4684f3913c?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-04T05:15:13Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/10/GHSA-8j37-24m2-5x5f/GHSA-8j37-24m2-5x5f.json b/advisories/unreviewed/2024/10/GHSA-8j37-24m2-5x5f/GHSA-8j37-24m2-5x5f.json
new file mode 100644
index 00000000000..dd8e2a0920f
--- /dev/null
+++ b/advisories/unreviewed/2024/10/GHSA-8j37-24m2-5x5f/GHSA-8j37-24m2-5x5f.json
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8j37-24m2-5x5f",
+  "modified": "2024-10-04T06:30:45Z",
+  "published": "2024-10-04T06:30:45Z",
+  "aliases": [
+    "CVE-2024-8519"
+  ],
+  "details": "The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'um_loggedin' shortcode in all versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8519"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/ultimatemember/ultimatemember/pull/1545"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/core/class-shortcodes.php#L433"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset/3160947/ultimate-member/tags/2.8.7/includes/core/class-shortcodes.php"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wordpress.org/plugins/ultimate-member"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9e394bb2-d505-4bf1-b672-fea3504bf936?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-04T05:15:11Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/10/GHSA-8q9m-fx9g-p437/GHSA-8q9m-fx9g-p437.json b/advisories/unreviewed/2024/10/GHSA-8q9m-fx9g-p437/GHSA-8q9m-fx9g-p437.json
new file mode 100644
index 00000000000..75d16ab2a9a
--- /dev/null
+++ b/advisories/unreviewed/2024/10/GHSA-8q9m-fx9g-p437/GHSA-8q9m-fx9g-p437.json
@@ -0,0 +1,50 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8q9m-fx9g-p437",
+  "modified": "2024-10-04T06:30:45Z",
+  "published": "2024-10-04T06:30:45Z",
+  "aliases": [
+    "CVE-2024-9204"
+  ],
+  "details": "The Smart Custom 404 Error Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI'] in all versions up to, and including, 11.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9204"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/404page/tags/11.4.7/functions.php#L112"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/404page/tags/11.4.7/inc/class-404page.php#L1227"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset/3161639/#file2"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/93928123-c90d-4bbb-b51d-33e809867b79?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-04T05:15:12Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/10/GHSA-ffgp-p9ff-m7wf/GHSA-ffgp-p9ff-m7wf.json b/advisories/unreviewed/2024/10/GHSA-ffgp-p9ff-m7wf/GHSA-ffgp-p9ff-m7wf.json
new file mode 100644
index 00000000000..5fe1892c3d5
--- /dev/null
+++ b/advisories/unreviewed/2024/10/GHSA-ffgp-p9ff-m7wf/GHSA-ffgp-p9ff-m7wf.json
@@ -0,0 +1,74 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-ffgp-p9ff-m7wf",
+  "modified": "2024-10-04T06:30:45Z",
+  "published": "2024-10-04T06:30:45Z",
+  "aliases": [
+    "CVE-2024-8520"
+  ],
+  "details": "The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.6. This is due to missing or incorrect nonce validation on the admin_init or user_action_hook function. This makes it possible for unauthenticated attackers to modify a users membership status via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8520"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/ultimatemember/ultimatemember/pull/1549"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/class-admin.php#L1880"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/class-admin.php#L1945"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/class-admin.php#L1948C1-L1959C6"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/class-admin.php#L70C4-L70C84"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/core/class-admin-users.php#L146C1-L173C12"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/core/class-admin-users.php#L175C1-L178C7"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/ultimatemember/ultimatemember/blob/7b8a7a7c039bde4539c07e049b19036192f1c133/includes/admin/core/class-admin-users.php#L41C4-L41C90"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset/3160947/ultimate-member/trunk/includes/admin/class-admin.php"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7ffddc03-d4ae-460e-972a-98804d947d09?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-352"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-04T05:15:11Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/10/GHSA-gg28-j4wr-8f8f/GHSA-gg28-j4wr-8f8f.json b/advisories/unreviewed/2024/10/GHSA-gg28-j4wr-8f8f/GHSA-gg28-j4wr-8f8f.json
new file mode 100644
index 00000000000..d047b5f82a3
--- /dev/null
+++ b/advisories/unreviewed/2024/10/GHSA-gg28-j4wr-8f8f/GHSA-gg28-j4wr-8f8f.json
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-gg28-j4wr-8f8f",
+  "modified": "2024-10-04T06:30:45Z",
+  "published": "2024-10-04T06:30:45Z",
+  "aliases": [
+    "CVE-2024-9375"
+  ],
+  "details": "The WordPress Captcha Plugin by Captcha Bank plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.0.36. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9375"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/captcha-bank/trunk/captcha-bank.php#L1297"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ba796adc-db76-4b9d-a6f9-f0f51f070240?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-04T05:15:13Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/10/GHSA-ggpp-fvmj-x8x4/GHSA-ggpp-fvmj-x8x4.json b/advisories/unreviewed/2024/10/GHSA-ggpp-fvmj-x8x4/GHSA-ggpp-fvmj-x8x4.json
new file mode 100644
index 00000000000..3793fed9a18
--- /dev/null
+++ b/advisories/unreviewed/2024/10/GHSA-ggpp-fvmj-x8x4/GHSA-ggpp-fvmj-x8x4.json
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-ggpp-fvmj-x8x4",
+  "modified": "2024-10-04T06:30:45Z",
+  "published": "2024-10-04T06:30:45Z",
+  "aliases": [
+    "CVE-2024-8802"
+  ],
+  "details": "The Clio Grow plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8802"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/clio-grow-form/trunk/includes/class-grow-form-settings.php#L550"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/10fcfddf-0ed7-471d-86bf-c38e7021c6a4?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-04T05:15:11Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/10/GHSA-j77x-ch92-7jfr/GHSA-j77x-ch92-7jfr.json b/advisories/unreviewed/2024/10/GHSA-j77x-ch92-7jfr/GHSA-j77x-ch92-7jfr.json
new file mode 100644
index 00000000000..4d88bf6ceae
--- /dev/null
+++ b/advisories/unreviewed/2024/10/GHSA-j77x-ch92-7jfr/GHSA-j77x-ch92-7jfr.json
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-j77x-ch92-7jfr",
+  "modified": "2024-10-04T06:30:45Z",
+  "published": "2024-10-04T06:30:45Z",
+  "aliases": [
+    "CVE-2024-9421"
+  ],
+  "details": "The Login Logout Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9421"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/login-logout-shortcode/trunk/login-logout-shortcode.php#L39"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wordpress.org/plugins/login-logout-shortcode/#developers"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8f7ce513-45ba-427b-8ee0-1007e404c1a9?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-04T05:15:14Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/10/GHSA-phc2-g348-384g/GHSA-phc2-g348-384g.json b/advisories/unreviewed/2024/10/GHSA-phc2-g348-384g/GHSA-phc2-g348-384g.json
new file mode 100644
index 00000000000..14991c990fe
--- /dev/null
+++ b/advisories/unreviewed/2024/10/GHSA-phc2-g348-384g/GHSA-phc2-g348-384g.json
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-phc2-g348-384g",
+  "modified": "2024-10-04T06:30:45Z",
+  "published": "2024-10-04T06:30:44Z",
+  "aliases": [
+    "CVE-2024-47850"
+  ],
+  "details": "CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet requesting a printer to be added, a different vulnerability than CVE-2024-47176. (The request is meant to probe the new printer but can be used to create DDoS amplification attacks.)",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47850"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/OpenPrinting/cups"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.akamai.com/blog/security-research/october-cups-ddos-threat"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-04T05:15:11Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/10/GHSA-qwc7-2536-jw6j/GHSA-qwc7-2536-jw6j.json b/advisories/unreviewed/2024/10/GHSA-qwc7-2536-jw6j/GHSA-qwc7-2536-jw6j.json
new file mode 100644
index 00000000000..6faf4c5bb60
--- /dev/null
+++ b/advisories/unreviewed/2024/10/GHSA-qwc7-2536-jw6j/GHSA-qwc7-2536-jw6j.json
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-qwc7-2536-jw6j",
+  "modified": "2024-10-04T06:30:46Z",
+  "published": "2024-10-04T06:30:46Z",
+  "aliases": [
+    "CVE-2024-8804"
+  ],
+  "details": "The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's script embed functionality in all versions up to, and including, 2.4 due to insufficient restrictions on who can utilize the functionality. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8804"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3162219%40simple-embed-code&new=3162219%40simple-embed-code&sfp_email=&sfph_mail="
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ab4149e1-8378-4007-bbf2-1ac3c479e7ea?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-04T06:15:05Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/10/GHSA-r75g-vg6w-4m4h/GHSA-r75g-vg6w-4m4h.json b/advisories/unreviewed/2024/10/GHSA-r75g-vg6w-4m4h/GHSA-r75g-vg6w-4m4h.json
new file mode 100644
index 00000000000..5723e904f2e
--- /dev/null
+++ b/advisories/unreviewed/2024/10/GHSA-r75g-vg6w-4m4h/GHSA-r75g-vg6w-4m4h.json
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-r75g-vg6w-4m4h",
+  "modified": "2024-10-04T06:30:45Z",
+  "published": "2024-10-04T06:30:45Z",
+  "aliases": [
+    "CVE-2024-9349"
+  ],
+  "details": "The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.4.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9349"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/amazon-auto-links/tags/5.4.2/include/core/main/admin/report/http_request/AmazonAutoLinks_AdminPage_Tab_HTTPRequest.php#L133"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3161302%40amazon-auto-links&new=3161302%40amazon-auto-links&sfp_email=&sfph_mail=#file5"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7ebd4936-9d68-42cb-a427-a1db894b49ec?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-04T05:15:12Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/10/GHSA-wwcp-26wc-3fxm/GHSA-wwcp-26wc-3fxm.json b/advisories/unreviewed/2024/10/GHSA-wwcp-26wc-3fxm/GHSA-wwcp-26wc-3fxm.json
new file mode 100644
index 00000000000..fc76840765f
--- /dev/null
+++ b/advisories/unreviewed/2024/10/GHSA-wwcp-26wc-3fxm/GHSA-wwcp-26wc-3fxm.json
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wwcp-26wc-3fxm",
+  "modified": "2024-10-04T06:30:45Z",
+  "published": "2024-10-04T06:30:45Z",
+  "aliases": [
+    "CVE-2024-47855"
+  ],
+  "details": "util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47855"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/kordamp/json-lib/commit/a0c4a0eae277130e22979cf307c95dec4005a78e"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/kordamp/json-lib/compare/v3.0.3...v3.1.0"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-04T06:15:04Z"
+  }
+}
\ No newline at end of file