Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
References: - https://patchstack.com/database/wordpress/plugin/try-on-for-woocommerce/vulnerability/wordpress-specfit-virtual-try-on-woocommerce-7-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23974 State: PUBLISHED Published: 2025-06-09T15:56:57.317Z Last Updated: 2025-06-10T13:31:20.056Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ifkooo Products: One-Login Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in ifkooo One-Login allows Privilege Escalation. This issue affects One-Login: from n/a through 1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/one-login/vulnerability/wordpress-one-login-1-4-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-23975 State: PUBLISHED Published: 2025-02-16T22:17:17.698Z Last Updated: 2025-02-18T19:35:00.276Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Botnet Attack Blocker Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Botnet Attack Blocker allows Stored XSS. This issue affects Botnet Attack Blocker: from n/a through 2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/botnet-attack-blocker/vulnerability/wordpress-botnet-attack-blocker-plugin-2-0-0-cross-site-scr
atabase/wordpress/plugin/botnet-attack-blocker/vulnerability/wordpress-botnet-attack-blocker-plugin-2-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23976 State: PUBLISHED Published: 2025-01-31T08:23:55.649Z Last Updated: 2025-01-31T16:00:39.717Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Pedro Marcelo Products: Issuu Panel Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Pedro Marcelo Issuu Panel allows Stored XSS. This issue affects Issuu Panel: from n/a through 2.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/issuu-panel/vulnerability/wordpress-issuu-panel-plugin-2-1-1-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23977 State: PUBLISHED Published: 2025-01-31T08:23:55.857Z Last Updated: 2025-01-31T19:32:06.607Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Bhaskar Dhote Products: Post Carousel Slider Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Bhaskar Dhote Post Carousel Slider allows Stored XSS. This issue affects Post Carousel Slider: from n/a through 2.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/post-carousel-slider/vulnerability/wordpress-post-carousel-slider-plugin-2-0-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23978 State: PUBLISHED Published: 2025-01-31T08:23:56.021Z Last Updated: 2025-01-31T19:31:54.784Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Ninos Ego Products: FlashCounter Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Ninos Ego FlashCounter allows Stored XSS. This issue affects FlashCounter: from n/a through 1.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/flashcounter/vulnerability/wordpress-flashcounter-plugin-1-1-8-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23979 State: PUBLISHED Published: 2025-05-19T16:01:21.666Z Last Updated: 2025-05-19T18:02:51.584Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: duwasai Products: Flashy Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in duwasai Flashy allows Reflected XSS.This issue affects Flashy: from n/a through 1.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/flashy/vulnerability/wordpress-flashy-theme-1-2-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23980 State: PUBLISHED Published: 2025-01-31T08:23:56.180Z Last Updated: 2025-01-31T19:31:44.392Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: James Andrews Products: Full Circle Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in James Andrews Full Circle allows Stored XSS. This issue affects Full Circle: from n/a through 0.5.7.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/full-circle/vulnerability/wordpress-full-circle-plugin-0-5-7-8-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23981 State: PUBLISHED Published: 2025-05-19T16:01:43.405Z Last Updated: 2025-05-19T18:02:05.864Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Takimi Themes Products: CarZine Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takimi Themes CarZine allows Reflected XSS.This issue affects CarZine: from n/a through 1.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/carzine/vulnerability/wordpress-carzine-theme-1-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23982 State: PUBLISHED Published: 2025-01-27T14:22:19.654Z Last Updated: 2025-02-12T20:41:32.995Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Marian Kanev Products: Cab fare calculator Problem Types: CWE-862 Description: Missing Authorization vulnerability in Marian Kanev Cab fare calculator allows Stored XSS. This issue affects Cab fare calculator: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cab-fare-calculator/vulnerability/wordpress-fare-calculator-plugin-1-1-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve
CVE ID: CVE-2025-23983 State: PUBLISHED Published: 2025-05-19T16:02:03.541Z Last Updated: 2025-05-19T17:49:38.226Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Tijaji Products: Tijaji Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tijaji allows Reflected XSS.This issue affects Tijaji: from n/a through 1.43. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/tijaji/vulnerability/wordpress-tijaji-theme-1-43-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23984 State: PUBLISHED Published: 2025-02-03T14:23:53.589Z Last Updated: 2025-02-03T15:01:26.103Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Brainvireinfo Products: Dynamic URL SEO Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainvireinfo Dynamic URL SEO allows Reflected XSS. This issue affects Dynamic URL SEO: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/dynamic-url-seo/vulnerability/wordpress-dynamic-url-seo-plugin-1-0-reflected-cross-site-scripting-xss-vu
ordpress/plugin/dynamic-url-seo/vulnerability/wordpress-dynamic-url-seo-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23985 State: PUBLISHED Published: 2025-01-31T08:23:56.375Z Last Updated: 2025-02-10T22:07:36.000Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Brainvireinfo Products: Dynamic URL SEO Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Brainvireinfo Dynamic URL SEO allows Cross Site Request Forgery. This issue affects Dynamic URL SEO: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/dynamic-url-seo/vulnerability/wordpress-dynamic-url-seo-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-23986 State: PUBLISHED Published: 2025-05-19T16:02:34.983Z Last Updated: 2025-05-19T17:42:05.438Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: fyrewurks Products: Tiki Time Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fyrewurks Tiki Time allows Reflected XSS.This issue affects Tiki Time: from n/a through 1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/tiki-time/vulnerability/wordpress-tiki-time-theme-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23987 State: PUBLISHED Published: 2025-01-31T08:23:56.544Z Last Updated: 2025-02-10T22:07:29.229Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: CodegearThemes Products: Designer Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodegearThemes Designer allows DOM-Based XSS. This issue affects Designer: from n/a through 1.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/designer/vulnerability/wordpress-designer-plugin-1-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23988 State: PUBLISHED Published: 2025-05-19T16:03:07.415Z Last Updated: 2025-05-19T17:35:19.988Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Bruno Cavalcante Products: Ghostwriter Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruno Cavalcante Ghostwriter allows Reflected XSS.This issue affects Ghostwriter: from n/a through 1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/ghostwriter/vulnerability/wordpress-ghostwriter-theme-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id
s/theme/ghostwriter/vulnerability/wordpress-ghostwriter-theme-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23989 State: PUBLISHED Published: 2025-01-31T08:23:56.704Z Last Updated: 2025-02-10T22:07:22.745Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Alessandro Piconi - SabLab Products: Internal Link Builder Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Alessandro Piconi - SabLab Internal Link Builder allows Cross Site Request Forgery. This issue affects Internal Link Builder: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/internal-link-builder/vulnerability/wordpress-internal-link-builder-plugin-1-0-csrf-to-stored-xss
abase/wordpress/plugin/internal-link-builder/vulnerability/wordpress-internal-link-builder-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23990 State: PUBLISHED Published: 2025-01-31T08:23:56.877Z Last Updated: 2025-02-10T22:07:17.216Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: jablonczay Products: Scroll Styler Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in jablonczay Scroll Styler. This issue affects Scroll Styler: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/scroll-styler/vulnerability/wordpress-scroll-styler-plugin-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23991 State: PUBLISHED Published: 2025-01-24T15:31:40.985Z Last Updated: 2025-01-24T16:02:27.807Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: theDotstore Products: Product Size Charts Plugin for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in theDotstore Product Size Charts Plugin for WooCommerce.This issue affects Product Size Charts Plugin for WooCommerce: from n/a through 2.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woo-advanced-product-size-chart/vulnerability/wordpress-product-size-charts-plugin-for-woocommerce-plugin-2
press/plugin/woo-advanced-product-size-chart/vulnerability/wordpress-product-size-charts-plugin-for-woocommerce-plugin-2-4-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-23992 State: PUBLISHED Published: 2025-01-22T15:42:31.214Z Last Updated: 2025-01-22T19:44:52.326Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Leetoo Products: Toocheke Companion Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leetoo Toocheke Companion allows Stored XSS. This issue affects Toocheke Companion: from n/a through 1.166. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/toocheke-companion/vulnerability/wordpress-toocheke-companion-plugin-1-166-stored-cross-site-scripting-xss-v
ress/plugin/toocheke-companion/vulnerability/wordpress-toocheke-companion-plugin-1-166-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23994 State: PUBLISHED Published: 2025-01-21T17:21:52.174Z Last Updated: 2025-01-21T18:42:18.792Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Estatebud Products: Estatebud – Properties & Listings Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatebud Estatebud – Properties & Listings allows Stored XSS. This issue affects Estatebud – Properties & Listings: from n/a through 5.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/estatebud-properties-listings/vulnerability/wordpress-estat
ferences: - https://patchstack.com/database/wordpress/plugin/estatebud-properties-listings/vulnerability/wordpress-estatebud-properties-listings-plugin-5-5-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23995 State: PUBLISHED Published: 2025-03-31T10:55:20.176Z Last Updated: 2025-03-31T12:09:52.867Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: ta2g Products: Tantyyellow Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ta2g Tantyyellow allows Reflected XSS.This issue affects Tantyyellow: from n/a through 1.0.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/tantyyellow/vulnerability/wordpress-tantyyellow-theme-1-0-0-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23996 State: PUBLISHED Published: 2025-01-21T17:21:52.454Z Last Updated: 2025-01-21T18:42:11.190Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: anyroad.com Products: AnyRoad Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in anyroad.com AnyRoad allows Cross Site Request Forgery. This issue affects AnyRoad: from n/a through 1.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/anyguide/vulnerability/wordpress-anyroad-plugin-1-3-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-23997 State: PUBLISHED Published: 2025-01-21T13:57:36.429Z Last Updated: 2025-02-12T20:31:26.178Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: dev@tamara.co Products: Tamara Checkout Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dev@tamara.co Tamara Checkout allows Stored XSS. This issue affects Tamara Checkout: from n/a through 1.9.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/tamara-checkout/vulnerability/wordpress-tamara-checkout-plugin-1-9-8-cross-site-scripting-xss-vulnerabi
wordpress/plugin/tamara-checkout/vulnerability/wordpress-tamara-checkout-plugin-1-9-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23998 State: PUBLISHED Published: 2025-01-21T13:57:36.578Z Last Updated: 2025-02-12T20:31:26.012Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Rara Theme Products: UltraLight Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rara Theme UltraLight allows Reflected XSS. This issue affects UltraLight: from n/a through 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/the-ultralight/vulnerability/wordpress-ultralight-theme-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23999 State: PUBLISHED Published: 2025-06-18T09:26:29.875Z Last Updated: 2025-06-18T13:38:27.815Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Cloudways Products: Breeze Problem Types: CWE-862 Description: Missing Authorization vulnerability in Cloudways Breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through 2.2.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/breeze/vulnerability/wordpress-breeze-plugin-2-2-13-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-24000 State: PUBLISHED Published: 2025-08-07T16:58:28.884Z Last Updated: 2025-08-29T03:10:26.506Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: WPExperts Products: Post SMTP Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in WPExperts Post SMTP allows Authentication Bypass.This issue affects Post SMTP: from n/a through 3.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/post-smtp/vulnerability/wordpress-post-smtp-3-2-0-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-24001 State: PUBLISHED Published: 2025-01-21T13:57:36.752Z Last Updated: 2025-02-12T20:31:25.864Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: PPO Việt Nam (ppo.vn) Products: PPO Call To Actions Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in PPO Việt Nam (ppo.vn) PPO Call To Actions allows Cross Site Request Forgery. This issue affects PPO Call To Actions: from n/a through 0.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ppo-call-to-actions/vulnerability/wordpress-ppo-call-to-actions-plugin-0-1-3-csrf-to-stored-xss-vulnerability?_
s/plugin/ppo-call-to-actions/vulnerability/wordpress-ppo-call-to-actions-plugin-0-1-3-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24002 State: PUBLISHED Published: 2025-07-08T06:58:58.916Z Last Updated: 2025-07-08T13:39:35.059Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Phoenix Contact Products: CHARX SEC-3150, CHARX SEC-3100, CHARX SEC-3050, CHARX SEC-3000 Problem Types: CWE-20 Description: An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporary denial-of-service for these stations until they got restarted by the watchdog. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-014
CVE ID: CVE-2025-24003 State: PUBLISHED Published: 2025-07-08T06:59:17.316Z Last Updated: 2025-07-08T13:38:55.893Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Phoenix Contact Products: CHARX SEC-3150, CHARX SEC-3100, CHARX SEC-3050, CHARX SEC-3000 Problem Types: CWE-120 Description: An unauthenticated remote attacker can use MQTT messages to trigger out-of-bounds writes in charging stations complying with German Calibration Law, resulting in a loss of integrity for only EichrechtAgents and potential denial-of-service for these stations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-014
CVE ID: CVE-2025-24004 State: PUBLISHED Published: 2025-07-08T06:59:32.300Z Last Updated: 2025-07-08T13:37:47.979Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) Vendors: Phoenix Contact Products: CHARX SEC-3150, CHARX SEC-3100, CHARX SEC-3050, CHARX SEC-3000 Problem Types: CWE-120 Description: A physical attacker with access to the device display via USB-C can send a message to the device which triggers an unsecure copy to a buffer resulting in loss of integrity and a temporary denial-of-service for the stations until they got restarted by the watchdog. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-014
CVE ID: CVE-2025-24005 State: PUBLISHED Published: 2025-07-08T06:59:45.822Z Last Updated: 2025-07-08T14:29:26.932Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Phoenix Contact Products: CHARX SEC-3150, CHARX SEC-3100, CHARX SEC-3050, CHARX SEC-3000 Problem Types: CWE-20 Description: A local attacker with a local user account can leverage a vulnerable script via SSH to escalate privileges to root due to improper input validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-014
CVE ID: CVE-2025-24006 State: PUBLISHED Published: 2025-07-08T07:00:03.724Z Last Updated: 2025-07-08T14:29:19.578Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Phoenix Contact Products: CHARX SEC-3150, CHARX SEC-3100, CHARX SEC-3050, CHARX SEC-3000 Problem Types: CWE-269 Description: A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-014
CVE ID: CVE-2025-24007 State: PUBLISHED Published: 2025-05-13T09:38:29.176Z Last Updated: 2025-05-13T15:42:59.816Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Siemens Products: SIRIUS 3RK3 Modular Safety System (MSS), SIRIUS Safety Relays 3SK2 Problem Types: CWE-327 Description: A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK2 (All versions). Affected devices only provide weak password obfuscation. An attacker with network access could retrieve and de-obfuscate the safety password used for protection against inadvertent operating errors. Additional Analyst Notes: - CISA ADP Vulnrichmen
fety password used for protection against inadvertent operating errors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-222768.html