{"error":0,"message":null,"data":{"name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories","plugin":"post-expirator","link":"https:\/\/wordpress.org\/plugins\/post-expirator\/","latest":"1788880800","closed":0,"closed_reason":null,"closed_date":null,"vulnerability":[{"uuid":"ba1a6c3e2d7a395d6ead9634854d7403714e633fab805bc90b95b2815f342122","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories [post-expirator] < 2.6.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.6.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2021-24783","name":"CVE-2021-24783","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2021-24783","description":"[en] The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts.","date":"2021-11-08"},{"id":"3a49bb1336a860b11f2c591c9edfcc4410effa0c","name":"WordPress Post Expirator plugin <= 2.5.1 - Arbitrary Post Schedule Deletion vulnerability","link":"https:\/\/patchstack.com\/database\/vulnerability\/post-expirator-\/wordpress-post-expirator-plugin-2-5-1-arbitrary-post-schedule-deletion-vulnerability","description":"Arbitrary Post Schedule Deletion vulnerability discovered by apple502j in WordPress Post Expirator plugin (versions <= 2.5.1).","date":"2021-10-11"},{"id":"e913ae8161f4b8ce497d0f469827cba1a3359423","name":"Post Expirator <= 2.5.1 - Contributor+ Arbitrary Post Schedule Deletion","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/post-expirator\/post-expirator-251-contributor-arbitrary-post-schedule-deletion","description":"The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts.","date":"2021-10-11"},{"id":"a814e1b2d4b0b41a8f73877c5ece44791e7de900","name":"WordPress  Post Expirator Plugin  <= 2.5.1 is vulnerable to Broken Access Control","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/post-expirator\/vulnerability\/wordpress-post-expirator-plugin-2-5-1-arbitrary-post-schedule-deletion-vulnerability","description":"Update the WordPress Post Expirator plugin to the latest available version (at least 2.6.0).\napple502j discovered and reported this Broken Access Control vulnerability in WordPress Post Expirator Plugin.  This vulnerability has been fixed in version 2.6.0.","date":"2023-10-11"},{"id":"de51b970-ab13-41a6-a479-a92cd0e70b71","name":"Post Expirator &lt; 2.6.0 - Contributor+ Arbitrary Post Schedule Deletion","link":"https:\/\/wpscan.com\/vulnerability\/de51b970-ab13-41a6-a479-a92cd0e70b71","description":"The plugin does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts.","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:H\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"n","i":"h","a":"n","score":"6.5","severity":"m","exploitable":"2.8","impact":"3.6"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:H\/A:N","score":"6.5","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"none","i":"high","a":"none","exploitable":"2.8","impact":"3.6"},"cwe":[{"cwe":"CWE-863","name":"Incorrect Authorization","description":"The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check."}]}},{"uuid":"19f39b01fb1d17913468b702f695530254bab80613840c2b621213cb8987c0db","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories [post-expirator] < 2.1.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.1.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"7884ae94717ea7a9bbc63ad348be3528baf1968c","name":"WordPress Post Expirator Plugin <= 2.1.1 - Cross Site Request Forgery","link":"https:\/\/patchstack.com\/database\/vulnerability\/post-expirator-\/wordpress-post-expirator-plugin-2-1-1-cross-site-request-forgery","description":"This plugin is prone to a cross site request forgery vulnerability.\nUpgrade this plugin.","date":"2014-08-01"}],"impact":[]},{"uuid":"a31cac9417038ddd8e44ee7e5908a80c815f5b70a411d22136046a6480efacbd","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories [post-expirator] < 2.1.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.1.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"f0451460c00f9e91e27d0c1112a82086b2fe48a8","name":"WordPress  Post Expirator Plugin  <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/post-expirator\/vulnerability\/wordpress-post-expirator-plugin-2-1-1-cross-site-request-forgery","description":"Upgrade this plugin.\nAn unknown person discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Post Expirator Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 2.1.2.","date":"2023-08-01"}],"impact":[]},{"uuid":"cb8d3a7d0a859092ee310fbbbe122568c8aafbbffdfb479542e7c53d6f08a0bc","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories [post-expirator] < 2.1.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.1.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"6ba526f4-de6c-47fb-8d77-28d5686aacb8","name":"Post Expirator &lt;= 2.1.1 - Cross-Site Request Forgery","link":"https:\/\/wpscan.com\/vulnerability\/6ba526f4-de6c-47fb-8d77-28d5686aacb8","description":"The Post Expirator WordPress plugin was affected by a Cross-Site Request Forgery  security vulnerability.","date":null}],"impact":[]},{"uuid":"938bda950c5e4112a2ee0a5644033a451a6eac0653e22dab5dca17b893de07f4","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories [post-expirator] < 4.9.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.9.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-13149","name":"CVE-2025-13149","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-13149","description":"[en] The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the \"saveFutureActionData\" function in all versions up to, and including, 4.9.1. This makes it possible for authenticated attackers, with author level access and above, to change the status of arbitrary posts and pages via the REST API endpoint.","date":"2025-11-21"},{"id":"22653cb01bb37c2d41f4eee55723f3feffcb38b5","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post\/Page Status Modification","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/post-expirator\/schedule-post-changes-with-publishpress-future-unpublish-delete-change-status-trash-change-categories-491-authenticated-author-missing-authorization-to-postpage-status-modification","description":"The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the \"saveFutureActionData\" function in all versions up to, and including, 4.9.1. This makes it possible for authenticated attackers, with author level access and above, to change the status of arbitrary posts and pages via the REST API endpoint.","date":"2025-11-20"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"n","i":"l","a":"n","score":"4.3","severity":"m","exploitable":"2.8","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"none","i":"low","a":"none","exploitable":"2.8","impact":"1.4"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"0326c317371f565347c33445255f945299a7085817b60b65eb2a7849a1cc3200","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories [post-expirator] < 4.9.3","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.9.3","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-13741","name":"CVE-2025-13741","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-13741","description":"[en] The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getAuthors function in all versions up to, and including, 4.9.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve emails for all users with edit_posts capability.","date":"2025-12-16"},{"id":"f60547e04b98b26d185beefce53bf2df51c5bf23","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) Authors' Emails Exposure","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/post-expirator\/schedule-post-changes-with-publishpress-future-unpublish-delete-change-status-trash-change-categories-492-missing-authorization-to-authenticated-contributor-authors-emails-exposure","description":"The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getAuthors function in all versions up to, and including, 4.9.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve emails for all users with edit_posts capability.","date":"2025-12-15"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:N\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"l","i":"n","a":"n","score":"4.3","severity":"m","exploitable":"2.8","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:N\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"low","i":"none","a":"none","exploitable":"2.8","impact":"1.4"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"6bd43b78a8d780b2d9c1a2d5e2e265ddfaced4101c67ba8dae28031f07845b12","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories [post-expirator] < 4.9.4","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.9.4","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-69361","name":"CVE-2025-69361","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-69361","description":"[en] Missing Authorization vulnerability in PublishPress Post Expirator post-expirator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Expirator: from n\/a through <= 4.9.3.","date":"2026-01-06"},{"id":"885345ebbf127c558a44c268a9508df0965bb5fc","name":"Post Expirator <= 4.9.3 - Missing Authorization","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/post-expirator\/post-expirator-493-missing-authorization","description":"The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.9.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.","date":"2026-01-11"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:N\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"l","i":"n","a":"n","score":"4.3","severity":"m","exploitable":"2.8","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:N\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"low","i":"none","a":"none","exploitable":"2.8","impact":"1.4"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"23c48ce08ee811d849520300a062be5b215d420b89d0e3f88eaa250bdd1ff7ca","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories [post-expirator] < 4.9.4","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.9.4","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-14718","name":"CVE-2025-14718","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-14718","description":"[en] The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to create, update, delete, and publish malicious workflows that may automatically delete any post upon publication or update, including posts created by administrators.","date":"2026-01-09"},{"id":"df2a17f25e36e5521b9f705e035997e119555b4e","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.3 - Missing Authorization to Authenticated (Contributor+) Workflow Manipulation","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/post-expirator\/schedule-post-changes-with-publishpress-future-unpublish-delete-change-status-trash-change-categories-493-missing-authorization-to-authenticated-contributor-workflow-manipulation","description":"The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to create, update, delete, and publish malicious workflows that may automatically delete any post upon publication or update, including posts created by administrators.","date":"2026-01-08"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:L","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"n","i":"l","a":"l","score":"5.4","severity":"m","exploitable":"2.8","impact":"2.5"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:L","score":"5.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"none","i":"low","a":"low","exploitable":"2.8","impact":"2.5"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"254b0f312197303a4e628617780c3a55afa978ade51b4a4db797fd3dbd32629b","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories [post-expirator] < 4.10.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.10.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-39482","name":"CVE-2026-39482","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-39482","description":"[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Post Expirator post-expirator allows DOM-Based XSS.This issue affects Post Expirator: from n\/a through <= 4.9.4.","date":"2026-04-08"},{"id":"4dbf903b95528600482d55f1aeea6b75c8c5248f","name":"Post Expirator <= 4.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/post-expirator\/post-expirator-494-authenticated-contributor-stored-cross-site-scripting","description":"The Post Expirator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2026-03-22"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"l","ui":"r","s":"c","c":"l","i":"l","a":"l","score":"6.5","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:L","score":"6.5","severity":"medium","av":"network","ac":"low","pr":"low","ui":"required","s":"changed","c":"low","i":"low","a":"low","exploitable":"0.0","impact":"0.0"},"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"ca4f8802f882985c64c532d5ff4f39a0d04f7ed792c7f796fdacf6da826d7df1","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories [post-expirator] < 4.10.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.10.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-5247","name":"CVE-2026-5247","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-5247","description":"[en] The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wrapper' attribute of the [futureaction] shortcode in all versions up to, and including, 4.10.0. This is due to insufficient input sanitization on the wrapper attribute. The plugin uses esc_html() to escape the value, but esc_html() only encodes HTML entities and does not prevent attribute injection when the value is used as an HTML tag name in a sprintf() call. An attacker can inject event handler attributes via spaces in the wrapper value. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Since it is also possible for administrators to make this functionality available to lower-privileged users, this introduces the possibility of abuse by contributors.","date":"2026-05-05"},{"id":"38494624da0ca709831fd2c6033144abcd775ee0","name":"Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/post-expirator\/schedule-post-changes-with-publishpress-future-unpublish-delete-change-status-trash-change-categories-4100-authenticated-administrator-stored-cross-site-scripting-via-wrapper-shortcode-attribute","description":"The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wrapper' attribute of the [futureaction] shortcode in all versions up to, and including, 4.10.0. This is due to insufficient input sanitization on the wrapper attribute. The plugin uses esc_html() to escape the value, but esc_html() only encodes HTML entities and does not prevent attribute injection when the value is used as an HTML tag name in a sprintf() call. An attacker can inject event handler attributes via spaces in the wrapper value. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Since it is also possible for administrators to make this functionality available to lower-privileged users, this introduces the possibility of abuse by contributors.","date":"2026-05-04"},{"id":"d2f254f6be1c257152b2115e191618a0e5d9dc6a","name":"WordPress Post Expirator Plugin <= 4.10.0 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/post-expirator\/vulnerability\/wordpress-schedule-post-changes-with-publishpress-future-unpublish-delete-change-status-trash-change-categories-plugin-4-10-0-authenticated-administrator-stored-cross-site-scripting-vulnerability","description":"<p>WordPress Post Expirator Plugin <= 4.10.0 is vulnerable to Cross Site Scripting (XSS)<\/p><p>Software: Post Expirator<\/p><p>Fixed in version 4.10.1 <\/p><p>Affected Version <= 4.10.0<\/p><p>CVE: CVE-2026-5247<\/p>","date":"2026-05-04"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"5.5","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:L\/I:L\/A:N","score":"5.5","severity":"medium","av":"network","ac":"low","pr":"high","ui":"none","s":"changed","c":"low","i":"low","a":"none","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}}]},"updated":"1777956745"}