Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-49855 State: PUBLISHED Published: 2025-06-17T15:01:21.926Z Last Updated: 2025-06-18T13:37:06.016Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Meks Products: Meks Flexible Shortcodes Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks Flexible Shortcodes allows DOM-Based XSS. This issue affects Meks Flexible Shortcodes: from n/a through 1.3.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/meks-flexible-shortcodes/vulnerability/wordpress-meks-flexible-shortcodes-plugin-1-3-7-cros
om/database/wordpress/plugin/meks-flexible-shortcodes/vulnerability/wordpress-meks-flexible-shortcodes-plugin-1-3-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49856 State: PUBLISHED Published: 2025-06-17T15:01:21.476Z Last Updated: 2025-06-18T13:35:46.356Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: CyberChimps Products: Responsive Plus Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in CyberChimps Responsive Plus allows Cross Site Request Forgery. This issue affects Responsive Plus: from n/a through 3.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/responsive-add-ons/vulnerability/wordpress-responsive-plus-plugin-3-2-2-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_i
lnerability/wordpress-responsive-plus-plugin-3-2-2-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE ID: CVE-2025-49857 State: PUBLISHED Published: 2025-06-17T15:01:21.023Z Last Updated: 2025-06-18T13:29:36.615Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: WPExperts.io Products: myCred Problem Types: CWE-862 Description: Missing Authorization vulnerability in WPExperts.io myCred allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects myCred: from n/a through 2.9.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-2-9-4-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49858 State: PUBLISHED Published: 2025-06-17T15:01:20.486Z Last Updated: 2025-06-18T16:20:30.627Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: tychesoftwares Products: Arconix Shortcodes Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes allows Stored XSS. This issue affects Arconix Shortcodes: from n/a through 2.1.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/arconix-shortcodes/vulnerability/wordpress-arconix-shortcodes-plugin-2-1-17-cross-site-scri
om/database/wordpress/plugin/arconix-shortcodes/vulnerability/wordpress-arconix-shortcodes-plugin-2-1-17-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49859 State: PUBLISHED Published: 2025-06-17T15:01:19.971Z Last Updated: 2025-06-18T15:31:32.344Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: etruel Products: WP Views Counter Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in etruel WP Views Counter allows Stored XSS. This issue affects WP Views Counter: from n/a through 2.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpecounter/vulnerability/wordpress-wp-views-counter-plugin-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49860 State: PUBLISHED Published: 2025-09-09T16:25:24.391Z Last Updated: 2025-09-09T18:42:17.634Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Majestic Support Products: Majestic Support Problem Types: CWE-862 Description: Missing Authorization vulnerability in Majestic Support Majestic Support. This issue affects Majestic Support: from n/a through 1.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/majestic-support/vulnerability/wordpress-majestic-support-plugin-1-1-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49861 State: PUBLISHED Published: 2025-06-17T15:01:19.373Z Last Updated: 2025-06-18T16:24:32.055Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Timur Kamaev Products: Kama Click Counter Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timur Kamaev Kama Click Counter allows Stored XSS. This issue affects Kama Click Counter: from n/a through 4.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/kama-clic-counter/vulnerability/wordpress-kama-click-counter-plugin-4-0-3-cross-site-scripting-x
tabase/wordpress/plugin/kama-clic-counter/vulnerability/wordpress-kama-click-counter-plugin-4-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49862 State: PUBLISHED Published: 2025-06-17T15:01:18.902Z Last Updated: 2025-06-18T16:27:54.364Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: motov.net Products: Ebook Store Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in motov.net Ebook Store allows Stored XSS. This issue affects Ebook Store: from n/a through 5.8008. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ebook-store/vulnerability/wordpress-ebook-store-plugin-5-8008-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49863 State: PUBLISHED Published: 2025-06-17T15:01:18.412Z Last Updated: 2025-06-18T17:25:49.205Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WP Codeus Products: Advanced Sermons Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Codeus Advanced Sermons allows Stored XSS. This issue affects Advanced Sermons: from n/a through 3.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/advanced-sermons/vulnerability/wordpress-advanced-sermons-plugin-3-6-cross-site-scripting-xss-vulnerability?_s
ss/plugin/advanced-sermons/vulnerability/wordpress-advanced-sermons-plugin-3-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49864 State: PUBLISHED Published: 2025-06-17T15:01:17.962Z Last Updated: 2025-06-20T13:13:34.623Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: AFS Analytics Products: AFS Analytics Problem Types: CWE-862 Description: Missing Authorization vulnerability in AFS Analytics AFS Analytics allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AFS Analytics: from n/a through 4.21. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/addfreestats/vulnerability/wordpress-afs-analytics-plugin-4-21-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49865 State: PUBLISHED Published: 2025-06-17T15:01:17.471Z Last Updated: 2025-06-20T13:13:40.803Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Helmut Wandl Products: Advanced Settings Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Helmut Wandl Advanced Settings allows Cross Site Request Forgery. This issue affects Advanced Settings: from n/a through 3.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/advanced-settings/vulnerability/wordpress-advanced-settings-plugin-3-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-49866 State: PUBLISHED Published: 2025-07-04T11:17:59.523Z Last Updated: 2025-07-07T15:00:25.766Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Nikel Products: Beautiful Cookie Consent Banner Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikel Beautiful Cookie Consent Banner allows Reflected XSS. This issue affects Beautiful Cookie Consent Banner: from n/a through 4.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/beautiful-and-responsive-cookie-consent/vulnerability/wordpress-beauti
https://patchstack.com/database/wordpress/plugin/beautiful-and-responsive-cookie-consent/vulnerability/wordpress-beautiful-cookie-consent-banner-4-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49867 State: PUBLISHED Published: 2025-07-04T11:17:59.003Z Last Updated: 2025-07-07T15:00:31.898Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: InspiryThemes Products: RealHomes Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes allows Privilege Escalation. This issue affects RealHomes: from n/a through 4.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/realhomes/vulnerability/wordpress-realhomes-4-4-0-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-49868 State: PUBLISHED Published: 2025-06-17T15:01:17.009Z Last Updated: 2025-06-20T13:13:46.403Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: FunnelKit Products: Automation By Autonami Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FunnelKit Automation By Autonami allows Phishing. This issue affects Automation By Autonami: from n/a through 3.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-marketing-automations/vulnerability/wordpress-automation-by-autonami-plugin-3-6-0-open-redirection-vulnerability?_s_id=cv
arketing-automations/vulnerability/wordpress-automation-by-autonami-plugin-3-6-0-open-redirection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49869 State: PUBLISHED Published: 2025-08-14T10:34:07.565Z Last Updated: 2025-08-14T15:59:03.831Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Arraytics Products: Eventin Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Arraytics Eventin allows Object Injection. This issue affects Eventin: from n/a through 4.0.31. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-eventin-plugin-4-0-31-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49870 State: PUBLISHED Published: 2025-07-04T11:17:58.496Z Last Updated: 2025-07-07T15:00:38.356Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: Cozmoslabs Products: Paid Member Subscriptions Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Paid Member Subscriptions allows SQL Injection. This issue affects Paid Member Subscriptions: from n/a through 2.15.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/paid-member-subscriptions/vulnerability/wordpress-paid-member-subscriptions-2
//patchstack.com/database/wordpress/plugin/paid-member-subscriptions/vulnerability/wordpress-paid-member-subscriptions-2-15-1-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49871 State: PUBLISHED Published: 2025-06-17T15:01:16.540Z Last Updated: 2025-06-20T13:13:52.063Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Brian Mutende Products: Noptin Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Mutende Noptin allows Stored XSS. This issue affects Noptin: from n/a through 3.8.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/newsletter-optin-box/vulnerability/wordpress-noptin-plugin-3-8-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49872 State: PUBLISHED Published: 2025-06-17T15:01:16.048Z Last Updated: 2025-06-20T13:13:57.657Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: WPExperts.io Products: myCred Problem Types: CWE-862 Description: Missing Authorization vulnerability in WPExperts.io myCred allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects myCred: from n/a through 2.9.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-2-9-4-2-broken-access-control-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-49873 State: PUBLISHED Published: 2025-06-20T15:04:30.054Z Last Updated: 2025-06-20T16:03:36.894Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NasaTheme Products: Elessi Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Elessi allows Reflected XSS. This issue affects Elessi: from n/a through 6.3.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/elessi-theme/vulnerability/wordpress-elessi-6-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49874 State: PUBLISHED Published: 2025-06-17T15:01:15.593Z Last Updated: 2025-06-20T13:14:04.589Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: tychesoftwares Products: Arconix FAQ Problem Types: CWE-862 Description: Missing Authorization vulnerability in tychesoftwares Arconix FAQ allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Arconix FAQ: from n/a through 1.9.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/arconix-faq/vulnerability/wordpress-arconix-faq-plugin-1-9-6-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49875 State: PUBLISHED Published: 2025-06-17T15:01:15.065Z Last Updated: 2025-06-26T17:51:10.563Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: IfSo Dynamic Content Products: If-So Dynamic Content Personalization Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IfSo Dynamic Content If-So Dynamic Content Personalization allows Stored XSS. This issue affects If-So Dynamic Content Personalization: from n/a through 1.9.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/if-so/vulnerability/w
yst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/if-so/vulnerability/wordpress-if-so-dynamic-content-personalization-plugin-1-9-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49876 State: PUBLISHED Published: 2025-07-16T11:27:58.713Z Last Updated: 2025-07-16T20:24:28.286Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: Metagauss Products: ProfileGrid Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid allows SQL Injection. This issue affects ProfileGrid : from n/a through 5.9.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/profilegrid-user-profiles-groups-and-communities/vulnerability/wordpress-profilegrid-5-9-5-2-sql-injection-vulnerabilit
/profilegrid-user-profiles-groups-and-communities/vulnerability/wordpress-profilegrid-5-9-5-2-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49877 State: PUBLISHED Published: 2025-06-17T15:01:14.573Z Last Updated: 2025-06-26T17:51:48.151Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Metagauss Products: ProfileGrid Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Metagauss ProfileGrid allows Server Side Request Forgery. This issue affects ProfileGrid : from n/a through 5.9.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/profilegrid-user-profiles-groups-and-communities/vulnerability/wordpress-profilegrid-plugin-5-9-5-2-server-side-request-forgery-ssrf-vulnerability?_s_id
-and-communities/vulnerability/wordpress-profilegrid-plugin-5-9-5-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-49878 State: PUBLISHED Published: 2025-06-17T15:01:14.088Z Last Updated: 2025-06-26T17:52:20.794Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Greg Winiarski Products: WPAdverts Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts allows DOM-Based XSS. This issue affects WPAdverts: from n/a through 2.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpadverts/vulnerability/wordpress-wpadverts-plugin-2-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49879 State: PUBLISHED Published: 2025-06-17T15:01:13.627Z Last Updated: 2025-06-26T17:52:44.200Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: themezaa Products: Litho Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in themezaa Litho allows Path Traversal. This issue affects Litho: from n/a through 3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/litho/vulnerability/wordpress-litho-3-0-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2025-49880 State: PUBLISHED Published: 2025-06-17T15:01:13.153Z Last Updated: 2025-06-26T17:53:15.335Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Emraan Cheema Products: CubeWP Forms Problem Types: CWE-862 Description: Missing Authorization vulnerability in Emraan Cheema CubeWP Forms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CubeWP Forms: from n/a through 1.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cubewp-forms/vulnerability/wordpress-cubewp-forms-plugin-1-1-5-broken-access-control-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-49881 State: PUBLISHED Published: 2025-06-17T15:01:12.665Z Last Updated: 2025-06-26T17:53:38.763Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: CyberChimps Products: Responsive Blocks Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks allows Stored XSS. This issue affects Responsive Blocks: from n/a through 2.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/responsive-block-editor-addons/vulnerability/wordpress-responsive-blocks-plugin-2-0-5-cross-site-scri
e/wordpress/plugin/responsive-block-editor-addons/vulnerability/wordpress-responsive-blocks-plugin-2-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49882 State: PUBLISHED Published: 2025-06-17T15:01:12.192Z Last Updated: 2025-06-26T17:54:09.030Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Emraan Cheema Products: CubeWP Framework Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Emraan Cheema CubeWP Framework allows DOM-Based XSS. This issue affects CubeWP Framework: from n/a through 1.1.23. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cubewp-framework/vulnerability/wordpress-cubewp-framework-plugin-1-1-23-cross-site-scripting-xss
tabase/wordpress/plugin/cubewp-framework/vulnerability/wordpress-cubewp-framework-plugin-1-1-23-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49883 State: PUBLISHED Published: 2025-06-27T11:52:31.425Z Last Updated: 2025-06-27T14:07:31.986Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: thembay Products: Greenmart Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Greenmart allows PHP Local File Inclusion. This issue affects Greenmart: from n/a through 4.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/greenmart/vulnerability/wordpress-greenmart-4-2-3-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-49884 State: PUBLISHED Published: 2025-07-16T11:27:58.254Z Last Updated: 2025-07-16T20:23:51.971Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: alexvtn Products: Internal Linking of Related Contents Problem Types: CWE-862 Description: Missing Authorization vulnerability in alexvtn Internal Linking of Related Contents allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Internal Linking of Related Contents: from n/a through 1.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/internal-linking-of-related-contents/vulnerability/wordpress
erences: - https://patchstack.com/database/wordpress/plugin/internal-linking-of-related-contents/vulnerability/wordpress-internal-linking-of-related-contents-1-1-8-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49885 State: PUBLISHED Published: 2025-06-27T11:52:30.847Z Last Updated: 2025-06-27T13:42:41.874Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: HaruTheme Products: Drag and Drop Multiple File Upload (Pro) - WooCommerce Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCommerce allows Upload a Web Shell to a Web Server. This issue affects Drag and Drop Multiple File Upload (Pro) - WooCommerce: from n/a through 5.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/drag-
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/drag-and-drop-file-upload-wc-pro/vulnerability/wordpress-drag-and-drop-multiple-file-upload-pro-woocommerce-5-0-6-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-49886 State: PUBLISHED Published: 2025-06-27T11:52:30.232Z Last Updated: 2025-06-27T14:07:38.538Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WebGeniusLab Products: Zikzag Core Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebGeniusLab Zikzag Core allows PHP Local File Inclusion. This issue affects Zikzag Core: from n/a through 1.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/zikzag-core/vulnerability/wordpress-zikzag-core-1-4-5-local-file-inclusion-vulnerabili