Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-48164 State: PUBLISHED Published: 2025-08-20T08:03:28.341Z Last Updated: 2025-08-20T14:06:22.980Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Brainstorm Force Products: SureDash Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in Brainstorm Force SureDash allows Privilege Escalation. This issue affects SureDash: from n/a through 1.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/suredash/vulnerability/wordpress-suredash-1-0-3-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-48165 State: PUBLISHED Published: 2025-08-20T08:03:27.796Z Last Updated: 2025-08-20T15:21:20.342Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: DELUCKS Products: DELUCKS SEO Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in DELUCKS DELUCKS SEO allows Privilege Escalation. This issue affects DELUCKS SEO: from n/a through 2.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/delucks-seo/vulnerability/wordpress-delucks-seo-plugin-2-6-0-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-48166 State: PUBLISHED Published: 2025-07-16T10:36:55.741Z Last Updated: 2025-07-16T14:27:29.239Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Bill Minozzi Products: Stop and Block bots plugin Anti bots Problem Types: CWE-862 Description: Missing Authorization vulnerability in Bill Minozzi Stop and Block bots plugin Anti bots allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Stop and Block bots plugin Anti bots: from n/a through 1.48. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/antibots/vulnerability/wordpress-stop-and-block-bots-plugin
ferences: - https://patchstack.com/database/wordpress/plugin/antibots/vulnerability/wordpress-stop-and-block-bots-plugin-anti-bots-1-48-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-48167 State: PUBLISHED Published: 2025-07-16T10:36:55.259Z Last Updated: 2025-07-16T14:28:42.315Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: alexvtn Products: Chatbox Manager Problem Types: CWE-862 Description: Missing Authorization vulnerability in alexvtn Chatbox Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Chatbox Manager: from n/a through 1.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wa-chatbox-manager/vulnerability/wordpress-chatbox-manager-plugin-1-2-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-48168 State: PUBLISHED Published: 2025-08-20T08:03:27.240Z Last Updated: 2025-08-20T15:33:30.242Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: LambertGroup Products: Apollo - Sticky Full Width HTML5 Audio Player Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Apollo - Sticky Full Width HTML5 Audio Player allows Reflected XSS. This issue affects Apollo - Sticky Full Width HTML5 Audio Player: from n/a through 3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lbg-audio5-html5
Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lbg-audio5-html5-shoutcast-sticky/vulnerability/wordpress-apollo-sticky-full-width-html5-audio-player-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48169 State: PUBLISHED Published: 2025-08-20T08:03:26.706Z Last Updated: 2025-08-20T15:36:14.844Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Jordy Meow Products: Code Engine Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Jordy Meow Code Engine allows Remote Code Inclusion. This issue affects Code Engine: from n/a through 0.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/code-engine/vulnerability/wordpress-code-engine-plugin-0-3-3-remote-code-execution-rce-vulnerability?_s_id=cve
CVE ID: CVE-2025-48170 State: PUBLISHED Published: 2025-08-20T08:03:26.142Z Last Updated: 2025-08-20T13:27:07.209Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: LambertGroup Products: Universal Video Player - Addon for WPBakery Page Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player - Addon for WPBakery Page Builder allows Reflected XSS. This issue affects Universal Video Player - Addon for WPBakery Page Builder: from n/a through 3.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/databas
from n/a through 3.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lbg-universal-video-player-addon-visual-composer/vulnerability/wordpress-universal-video-player-addon-for-wpbakery-page-builder-3-2-1-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-48171 State: PUBLISHED Published: 2025-08-20T08:03:25.615Z Last Updated: 2025-08-20T17:42:37.365Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: thembay Products: Cena Store Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Cena Store allows PHP Local File Inclusion. This issue affects Cena Store: from n/a through 2.11.26. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/cena/vulnerability/wordpress-cena-store-2-11-26-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-48172 State: PUBLISHED Published: 2025-07-04T00:00:00.000Z Last Updated: 2025-07-08T14:29:58.784Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: CHMLib Products: CHMLib Problem Types: CWE-190 Description: CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c _chm_decompress_block integer overflow. There is a resultant heap-based buffer overflow in _chm_fetch_bytes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1XpulFyCGlq7Szzg5RsH-eRwZ6OyuSozl/view?usp=sharing - https://drive.google.com/file/d/1wq51px42eoJz2VQ1Qu9ObPVQVom9T9H_/view?usp=sharing - https://github.co
iew?usp=sharing - https://drive.google.com/file/d/1wq51px42eoJz2VQ1Qu9ObPVQVom9T9H_/view?usp=sharing - https://github.com/jedwing/CHMLib/blob/2bef8d063ec7d88a8de6fd9f0513ea42ac0fa21f/src/chm_lib.c#L1386 - https://github.com/sumatrapdfreader/sumatrapdf/commit/08179946a745cf1605e4b9670942ec1a6e1f4c5d
CVE ID: CVE-2025-48174 State: PUBLISHED Published: 2025-05-16T00:00:00.000Z Last Updated: 2025-11-03T20:04:42.428Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L) Vendors: aomedia Products: libavif Problem Types: CWE-190 Description: In libavif before 1.3.0, makeRoom in stream.c has an integer overflow and resultant buffer overflow in stream->offset+size. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/AOMediaCodec/libavif/pull/2768 - https://github.com/AOMediaCodec/libavif/commit/e5fdefe7d1776e6c4cf1703c163a8c0535599029 - https://github.com/AOMediaCodec/libavif/commit/50a743062938a3828581d725facc9c2b92a1d1
d1776e6c4cf1703c163a8c0535599029 - https://github.com/AOMediaCodec/libavif/commit/50a743062938a3828581d725facc9c2b92a1d109 - https://github.com/AOMediaCodec/libavif/commit/c9f1bea437f21cb78f9919c332922a3b0ba65e11
CVE ID: CVE-2025-48175 State: PUBLISHED Published: 2025-05-16T00:00:00.000Z Last Updated: 2025-11-03T20:04:43.833Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L) Vendors: aomedia Products: libavif Problem Types: CWE-190 Description: In libavif before 1.3.0, avifImageRGBToYUV in reformat.c has integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/AOMediaCodec/libavif/commit/64d956ed5a602f78cebf29da023280944ee92efd - https://github.com/AOMediaCodec/libavif/pull/2769 - https://github.com/AOMediaCodec/libavif/security/ad
3280944ee92efd - https://github.com/AOMediaCodec/libavif/pull/2769 - https://github.com/AOMediaCodec/libavif/security/advisories/GHSA-762c-2538-h844
CVE ID: CVE-2025-48187 State: PUBLISHED Published: 2025-05-17T00:00:00.000Z Last Updated: 2025-05-19T15:56:53.263Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: infiniflow Products: RAGFlow Problem Types: CWE-307 Description: RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset. Codes are six digits and there is no rate limiting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/infiniflow/ragflow/commits/main/ - https://www.cnblogs.com/qiushuo/p/18881084
CVE ID: CVE-2025-48188 State: PUBLISHED Published: 2025-05-16T00:00:00.000Z Last Updated: 2025-05-17T02:41:29.382Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: GNU Products: PSPP Problem Types: CWE-125 Description: libpspp-core.a in GNU PSPP through 2.0.1 has an incorrect call from fill_buffer (in data/encrypted-file.c) to the Gnulib rijndaelDecrypt function, leading to a heap-based buffer over-read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://savannah.gnu.org/bugs/?67079
CVE ID: CVE-2025-48200 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-22T19:51:42.739Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: TYPO3 Products: sr feuser register extension Problem Types: CWE-502 Description: The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-ext-sa-2025-008
CVE ID: CVE-2025-48201 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-21T19:37:17.005Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: TYPO3 Products: ns backup extension Problem Types: CWE-425 Description: The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-ext-sa-2025-007
CVE ID: CVE-2025-48202 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-21T19:58:11.276Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: TYPO3 Products: femanager extension Problem Types: CWE-425 Description: The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-ext-sa-2025-006
CVE ID: CVE-2025-48203 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-21T19:53:27.526Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: TYPO3 Products: cs seo extension Problem Types: CWE-79 Description: The cs_seo extension through 9.2.0 for TYPO3 allows XSS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-ext-sa-2025-005
CVE ID: CVE-2025-48204 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-21T19:57:49.537Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: TYPO3 Products: ns backup extension Problem Types: CWE-78 Description: The ns_backup extension through 13.0.0 for TYPO3 allows command injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-ext-sa-2025-007
CVE ID: CVE-2025-48205 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-21T19:36:52.226Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: TYPO3 Products: sr feuser register extension Problem Types: CWE-425 Description: The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-ext-sa-2025-008
CVE ID: CVE-2025-48206 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-21T19:57:33.370Z Vendors: TYPO3 Products: ns backup extension Problem Types: CWE-79 Description: The ns_backup extension through 13.0.0 for TYPO3 allows XSS. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-ext-sa-2025-007
CVE ID: CVE-2025-48207 State: PUBLISHED Published: 2025-05-21T00:00:00.000Z Last Updated: 2025-05-21T19:32:16.367Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: TYPO3 Products: reint downloadmanager extension Problem Types: CWE-425 Description: The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://typo3.org/security/advisory/typo3-ext-sa-2025-004
CVE ID: CVE-2025-48208 State: PUBLISHED Published: 2025-09-09T09:31:35.585Z Last Updated: 2025-11-04T21:10:58.747Z Vendors: Apache Software Foundation Products: Apache HertzBeat (incubating) Problem Types: CWE-90 Description: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache HertzBeat . The attacker needs to have an authenticated account with access, and the attack can only be triggered by crafting custom commands. A successful attack would result in arbitrary script execution. This issue affects Apache HertzBeat: through 1.7.2. Users are recommended to upgrade to version [1.7.3], which fixes the issue. Additional Analyst Notes: - CI
hrough 1.7.2. Users are recommended to upgrade to version [1.7.3], which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/3zrr3oo67pxxx7wgzj80kglltfshngn2
CVE ID: CVE-2025-48219 State: PUBLISHED Published: 2025-05-18T00:00:00.000Z Last Updated: 2025-05-19T20:06:21.326Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: O2 UK Products: O2 Problem Types: CWE-201 Description: O2 UK before 2025-05-19 allows subscribers to determine the Cell ID of other subscribers by initiating an IMS (IP Multimedia Subsystem) call and then reading the utran-cell-id-3gpp field of a Cellular-Network-Info SIP header, aka an ECI (E-UTRAN Cell Identity) leak. The Cell ID might be usable to identify a cell location via crowdsourced data, and might correspond to a small physical area (e.g., if the called party is in a city centre). Removal of
dsourced data, and might correspond to a small physical area (e.g., if the called party is in a city centre). Removal of the Cellular-Network-Info header is mentioned in section 4.4.19 of ETSI TS 124 229. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mastdatabase.co.uk/blog/2025/05/o2-expose-customer-location-call-4g/ - https://news.ycombinator.com/item?id=44014046 - https://www.etsi.org/deliver/etsi_ts/124200_124299/124229/15.10.00_60/ts_124229v151000p.pdf - https://www.ispreview.co.uk/index.php/2025/05/o2-uk-fixes-volte-flaw-that-exposed-user-mobile-location-data.html
CVE ID: CVE-2025-48231 State: PUBLISHED Published: 2025-07-04T11:18:02.980Z Last Updated: 2025-07-07T14:59:37.639Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: codepeople Products: Booking Calendar Contact Form Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form allows Stored XSS. This issue affects Booking Calendar Contact Form: from n/a through 1.2.58. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/booking-calendar-contact-form/vulnerability/wordpress-booking-cale
s: - https://patchstack.com/database/wordpress/plugin/booking-calendar-contact-form/vulnerability/wordpress-booking-calendar-contact-form-1-2-58-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48232 State: PUBLISHED Published: 2025-05-19T14:44:49.304Z Last Updated: 2025-05-19T15:21:27.586Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Xpro Products: Xpro Addons For Beaver Builder &#8211; Lite Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Addons For Beaver Builder &#8211; Lite allows Stored XSS. This issue affects Xpro Addons For Beaver Builder &#8211; Lite: from n/a through 1.5.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/xpro-addons-beaver-builder-elementor/
A ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/xpro-addons-beaver-builder-elementor/vulnerability/wordpress-xpro-addons-for-beaver-builder-lite-1-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48233 State: PUBLISHED Published: 2025-05-19T14:44:49.825Z Last Updated: 2025-05-19T15:20:52.019Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: affmngr Products: Affiliates Manager Google reCAPTCHA Integration Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in affmngr Affiliates Manager Google reCAPTCHA Integration allows Stored XSS. This issue affects Affiliates Manager Google reCAPTCHA Integration: from n/a through 1.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/affiliates-manager-google-recaptcha-integration/vulnerability/wordpress
https://patchstack.com/database/wordpress/plugin/affiliates-manager-google-recaptcha-integration/vulnerability/wordpress-affiliates-manager-google-recaptcha-integration-plugin-1-0-6-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48234 State: PUBLISHED Published: 2025-05-19T14:44:50.310Z Last Updated: 2025-05-19T15:20:45.915Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Ultimate Blocks Products: Ultimate Blocks Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Blocks Ultimate Blocks allows DOM-Based XSS. This issue affects Ultimate Blocks: from n/a through 3.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ultimate-blocks/vulnerability/wordpress-ultimate-blocks-3-3-0-cross-site-scripting-xss-vulnerabi
tabase/wordpress/plugin/ultimate-blocks/vulnerability/wordpress-ultimate-blocks-3-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48235 State: PUBLISHED Published: 2025-05-19T14:44:50.802Z Last Updated: 2025-05-19T15:20:37.222Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Bogdan Bendziukov Products: WP Image Mask Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bogdan Bendziukov WP Image Mask allows DOM-Based XSS. This issue affects WP Image Mask: from n/a through 3.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-image-mask/vulnerability/wordpress-wp-image-mask-3-1-2-cross-site-scripting-xss-vulnerability?_
base/wordpress/plugin/wp-image-mask/vulnerability/wordpress-wp-image-mask-3-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48236 State: PUBLISHED Published: 2025-05-19T14:44:51.265Z Last Updated: 2025-05-19T15:20:31.587Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: bunny.net Products: bunny.net Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bunny.net bunny.net allows Stored XSS. This issue affects bunny.net: from n/a through 2.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bunnycdn/vulnerability/wordpress-bunny-net-2-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48237 State: PUBLISHED Published: 2025-05-19T14:44:51.776Z Last Updated: 2025-05-19T15:20:25.568Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPFactory Products: Wishlist for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Wishlist for WooCommerce allows Stored XSS. This issue affects Wishlist for WooCommerce: from n/a through 3.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wish-list-for-woocommerce/vulnerability/wordpress-wishlist-for-woocommerce-3-2-2-cro
stack.com/database/wordpress/plugin/wish-list-for-woocommerce/vulnerability/wordpress-wishlist-for-woocommerce-3-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48238 State: PUBLISHED Published: 2025-05-19T14:44:52.236Z Last Updated: 2025-05-19T15:20:19.638Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: awcode Products: AWcode Toolkit Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in awcode AWcode Toolkit allows Stored XSS. This issue affects AWcode Toolkit: from n/a through 1.0.18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/awcode-toolkit/vulnerability/wordpress-awcode-toolkit-plugin-1-0-18-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48239 State: PUBLISHED Published: 2025-05-19T14:44:52.687Z Last Updated: 2025-05-19T15:20:13.792Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPFactory Products: Product Notes Tab & Private Admin Notes for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Product Notes Tab & Private Admin Notes for WooCommerce allows Stored XSS. This issue affects Product Notes Tab & Private Admin Notes for WooCommerce: from n/a through 3.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpres
through 3.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/product-notes-for-woocommerce/vulnerability/wordpress-product-notes-tab-private-admin-notes-for-woocommerce-3-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve