Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-26945 State: PUBLISHED Published: 2025-02-25T14:17:55.883Z Last Updated: 2025-02-25T17:23:22.784Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: bPlugins Products: Info Cards – Gutenberg block for creating Beautiful Cards Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Info Cards – Gutenberg block for creating Beautiful Cards allows Stored XSS. This issue affects Info Cards – Gutenberg block for creating Beautiful Cards: from n/a through 1.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/word
n/a through 1.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/info-cards/vulnerability/wordpress-info-cards-plugin-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26946 State: PUBLISHED Published: 2025-02-25T14:17:56.024Z Last Updated: 2025-02-25T17:20:31.518Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: jgwhite33 Products: WP Yelp Review Slider Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Yelp Review Slider allows Blind SQL Injection. This issue affects WP Yelp Review Slider: from n/a through 8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-yelp-review-slider/vulnerability/wordpress-wp-yelp-review-slider-plugin-8-1-sql-injec
k.com/database/wordpress/plugin/wp-yelp-review-slider/vulnerability/wordpress-wp-yelp-review-slider-plugin-8-1-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-26947 State: PUBLISHED Published: 2025-02-25T14:17:56.160Z Last Updated: 2025-02-25T17:16:48.123Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: bPlugins Products: Services Section block Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Services Section block allows Stored XSS. This issue affects Services Section block: from n/a through 1.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/services-section/vulnerability/wordpress-services-section-block-plugin-1-3-4-cross-site-scri
m/database/wordpress/plugin/services-section/vulnerability/wordpress-services-section-block-plugin-1-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26948 State: PUBLISHED Published: 2025-02-25T14:17:56.308Z Last Updated: 2025-02-25T17:16:13.393Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: NotFound Products: Pie Register Premium Problem Types: CWE-862 Description: Missing Authorization vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/pie-register-premium/vulnerability/wordpress-pie-register-premium-plugin-3-8-3-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-26949 State: PUBLISHED Published: 2025-02-25T14:17:56.463Z Last Updated: 2025-02-25T17:15:25.162Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: bPlugins Products: Team Section Block Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Team Section Block allows Stored XSS. This issue affects Team Section Block: from n/a through 1.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/team-section/vulnerability/wordpress-team-section-block-plugin-1-0-9-cross-site-scripting-xss-vulnerabil
ordpress/plugin/team-section/vulnerability/wordpress-team-section-block-plugin-1-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26950 State: PUBLISHED Published: 2025-04-15T21:53:12.788Z Last Updated: 2025-04-16T13:37:18.402Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: AddonsPress Products: Nepali Date Converter Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddonsPress Nepali Date Converter allows Stored XSS. This issue affects Nepali Date Converter: from n/a through 2.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/nepali-date-converter/vulnerability/wordpress-nepali-date-converter-plugin-2-0-8-cross-si
.com/database/wordpress/plugin/nepali-date-converter/vulnerability/wordpress-nepali-date-converter-plugin-2-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26951 State: PUBLISHED Published: 2025-04-15T21:53:13.040Z Last Updated: 2025-04-16T13:36:15.239Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: covertnine Products: C9 Blocks Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in covertnine C9 Blocks allows DOM-Based XSS. This issue affects C9 Blocks: from n/a through 1.7.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/c9-blocks/vulnerability/wordpress-c9-blocks-plugin-1-7-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26952 State: PUBLISHED Published: 2025-02-25T14:17:56.674Z Last Updated: 2025-02-25T17:14:51.099Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: bPlugins Products: Business Card Block Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Business Card Block allows Stored XSS. This issue affects Business Card Block: from n/a through 1.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/business-card-block/vulnerability/wordpress-business-card-block-plugin-1-0-5-cross-site-scripting-xss
e/wordpress/plugin/business-card-block/vulnerability/wordpress-business-card-block-plugin-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26953 State: PUBLISHED Published: 2025-04-15T21:53:13.200Z Last Updated: 2025-04-16T13:34:46.087Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: NotFound Products: JetMenu Problem Types: CWE-862 Description: Missing Authorization vulnerability in NotFound JetMenu allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects JetMenu: from n/a through 2.4.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-menu/vulnerability/wordpress-jetmenu-2-4-9-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-26954 State: PUBLISHED Published: 2025-04-15T11:59:06.374Z Last Updated: 2025-04-15T13:20:34.130Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: 1pluginjquery Products: ZooEffect Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 1pluginjquery ZooEffect allows Reflected XSS. This issue affects ZooEffect: from n/a through 1.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/1-jquery-photo-gallery-slideshow-flash/vulnerability/wordpress-zooeffect-plugin-1-11-reflected-cross-site-scripting-xss-v
-jquery-photo-gallery-slideshow-flash/vulnerability/wordpress-zooeffect-plugin-1-11-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26955 State: PUBLISHED Published: 2025-04-15T11:59:06.566Z Last Updated: 2025-04-15T14:51:22.528Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: VW Themes Products: Industrial Lite Problem Types: CWE-862 Description: Missing Authorization vulnerability in VW Themes Industrial Lite allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Industrial Lite: from n/a through 1.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/industrial-lite/vulnerability/wordpress-industrial-lite-theme-1-0-8-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-26956 State: PUBLISHED Published: 2025-03-27T21:49:24.874Z Last Updated: 2025-03-28T15:51:33.158Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Shinetheme Products: Traveler Problem Types: CWE-862 Description: Missing Authorization vulnerability in Shinetheme Traveler.This issue affects Traveler: from n/a through 3.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/traveler/vulnerability/wordpress-traveler-theme-3-1-8-broken-access-control-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-26957 State: PUBLISHED Published: 2025-02-25T14:17:56.831Z Last Updated: 2025-02-25T17:14:16.843Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Deetronix Products: Affiliate Coupons Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Deetronix Affiliate Coupons allows PHP Local File Inclusion. This issue affects Affiliate Coupons: from n/a through 1.7.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/affiliate-coupons/vulnerability/wordpress-affiliate-coupons-plugin-1-7-3-l
ps://patchstack.com/database/wordpress/plugin/affiliate-coupons/vulnerability/wordpress-affiliate-coupons-plugin-1-7-3-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-26958 State: PUBLISHED Published: 2025-04-15T11:59:06.703Z Last Updated: 2025-04-15T14:31:21.702Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: NotFound Products: JetBlog Problem Types: CWE-862 Description: Missing Authorization vulnerability in NotFound JetBlog allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects JetBlog: from n/a through 2.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-blog/vulnerability/wordpress-jetblog-2-4-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-26959 State: PUBLISHED Published: 2025-04-15T11:59:06.838Z Last Updated: 2025-04-15T14:20:50.947Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Quý Lê 91 Products: Administrator Z Problem Types: CWE-862 Description: Missing Authorization vulnerability in Quý Lê 91 Administrator Z allows Privilege Escalation. This issue affects Administrator Z: from n/a through 2025.03.24. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/administrator-z/vulnerability/wordpress-administrator-z-2025-03-24-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-26960 State: PUBLISHED Published: 2025-02-25T14:17:57.002Z Last Updated: 2025-02-25T17:13:43.880Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: enituretechnology Products: Small Package Quotes – Unishippers Edition Problem Types: CWE-862 Description: Missing Authorization vulnerability in enituretechnology Small Package Quotes – Unishippers Edition allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Small Package Quotes – Unishippers Edition: from n/a through 2.4.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/small-package-quotes-u
st Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/small-package-quotes-unishippers-edition/vulnerability/wordpress-small-package-quotes-unishippers-edition-plugin-2-4-9-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-26961 State: PUBLISHED Published: 2025-03-15T21:57:03.156Z Last Updated: 2025-03-18T16:14:45.584Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: NotFound Products: Fresh Framework Problem Types: CWE-862 Description: Missing Authorization vulnerability in NotFound Fresh Framework allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Fresh Framework: from n/a through 1.70.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/fresh-framework/vulnerability/wordpress-fresh-framework-plugin-1-70-0-unauthenticated-broken-access-control-vulnerability?_s_id=cv
ework/vulnerability/wordpress-fresh-framework-plugin-1-70-0-unauthenticated-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-26962 State: PUBLISHED Published: 2025-02-25T14:17:57.150Z Last Updated: 2025-02-25T17:12:03.305Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: GhozyLab Products: Easy Contact Form Lite Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Easy Contact Form Lite allows Stored XSS. This issue affects Easy Contact Form Lite : from n/a through 1.1.25. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/contact-form-lite/vulnerability/wordpress-contact-form-plugin-plugin-1-1-25-cross-site-scr
com/database/wordpress/plugin/contact-form-lite/vulnerability/wordpress-contact-form-plugin-plugin-1-1-25-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26963 State: PUBLISHED Published: 2025-02-25T14:17:57.297Z Last Updated: 2025-02-25T17:11:03.808Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: flowdee Products: ClickWhale Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in flowdee ClickWhale allows Cross Site Request Forgery. This issue affects ClickWhale: from n/a through 2.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/clickwhale/vulnerability/wordpress-clickwhale-plugin-2-4-3-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE ID: CVE-2025-26964 State: PUBLISHED Published: 2025-02-25T14:17:57.457Z Last Updated: 2025-02-25T14:55:57.382Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Themewinter Products: Eventin Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themewinter Eventin allows PHP Local File Inclusion. This issue affects Eventin: from n/a through 4.0.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-eventin-plugin-4-0-20-local-file-inclusion-vulnerability?
ase/wordpress/plugin/wp-event-solution/vulnerability/wordpress-eventin-plugin-4-0-20-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-26965 State: PUBLISHED Published: 2025-02-25T14:17:57.642Z Last Updated: 2025-02-25T14:55:09.668Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: ameliabooking Products: Amelia Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in ameliabooking Amelia allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Amelia: from n/a through 1.2.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ameliabooking/vulnerability/wordpress-amelia-plugin-1-2-16-insecure-direct-object-references-idor-vulnerabilit
ss/plugin/ameliabooking/vulnerability/wordpress-amelia-plugin-1-2-16-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE ID: CVE-2025-26966 State: PUBLISHED Published: 2025-02-25T14:17:57.838Z Last Updated: 2025-02-25T14:54:20.778Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Aldo Latino Products: PrivateContent Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Aldo Latino PrivateContent. This issue affects PrivateContent: from n/a through 8.11.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/private-content/vulnerability/wordpress-privatecontent-plugin-8-11-5-unauthenticated-account-takeover-vulnerability?_s_id=cve
CVE ID: CVE-2025-26967 State: PUBLISHED Published: 2025-03-03T13:30:41.574Z Last Updated: 2025-03-03T15:09:59.570Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Stiofan Products: Events Calendar for GeoDirectory Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Stiofan Events Calendar for GeoDirectory allows Object Injection. This issue affects Events Calendar for GeoDirectory: from n/a through 2.3.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/events-for-geodirectory/vulnerability/wordpress-events-calendar-for-geodirectory-plugin-2-3-14-php-object-inj
ess/plugin/events-for-geodirectory/vulnerability/wordpress-events-calendar-for-geodirectory-plugin-2-3-14-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-26968 State: PUBLISHED Published: 2025-04-17T15:17:14.732Z Last Updated: 2025-04-17T15:49:15.202Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: webbernaut Products: Cloak Front End Email Problem Types: CWE-862 Description: Missing Authorization vulnerability in webbernaut Cloak Front End Email allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Cloak Front End Email: from n/a through 1.9.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cloak-front-end-email/vulnerability/wordpress-cloak-front-end-email-1-9-5-broken-access-control-vulne
e/wordpress/plugin/cloak-front-end-email/vulnerability/wordpress-cloak-front-end-email-1-9-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-26969 State: PUBLISHED Published: 2025-03-15T21:57:03.344Z Last Updated: 2025-03-18T16:13:51.173Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: Aldo Latino Products: PrivateContent Problem Types: CWE-862 Description: Missing Authorization vulnerability in Aldo Latino PrivateContent. This issue affects PrivateContent: from n/a through 8.11.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/private-content/vulnerability/wordpress-privatecontent-plugin-8-11-5-subscriber-site-wide-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-26970 State: PUBLISHED Published: 2025-03-03T13:30:41.713Z Last Updated: 2025-04-14T08:34:07.085Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: NotFound Products: Ark Theme Core Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in NotFound Ark Theme Core ark-core allows Code Injection.This issue affects Ark Theme Core: from n/a before 1.71.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ark-core/vulnerability/wordpress-ark-theme-core-plugin-1-70-0-unauthenticated-remote-code-execution-rce-vulnerability?_s_id=cve
CVE ID: CVE-2025-26971 State: PUBLISHED Published: 2025-02-25T14:17:57.986Z Last Updated: 2025-02-25T19:15:00.546Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: ays-pro Products: Poll Maker Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ays-pro Poll Maker allows Blind SQL Injection. This issue affects Poll Maker: from n/a through 5.6.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/poll-maker/vulnerability/wordpress-poll-maker-5-6-5-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-26972 State: PUBLISHED Published: 2025-03-15T21:57:03.551Z Last Updated: 2025-03-18T16:12:17.279Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: PrivateContent Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound PrivateContent. This issue affects PrivateContent: from n/a through 8.11.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/private-content/vulnerability/wordpress-privatecontent-plugin-8-11-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26973 State: PUBLISHED Published: 2025-02-22T15:52:11.883Z Last Updated: 2025-02-24T14:31:34.025Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WarfarePlugins Products: Social Warfare Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WarfarePlugins Social Warfare allows DOM-Based XSS. This issue affects Social Warfare: from n/a through 4.5.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/social-warfare/vulnerability/wordpress-social-warfare-plugin-4-5-4-cross-site-scripting-xss-vulnerabi
e/wordpress/plugin/social-warfare/vulnerability/wordpress-social-warfare-plugin-4-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26974 State: PUBLISHED Published: 2025-02-25T14:17:58.153Z Last Updated: 2025-02-25T17:08:33.684Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: WPExperts.io Products: WP Multi Store Locator Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPExperts.io WP Multi Store Locator allows Blind SQL Injection. This issue affects WP Multi Store Locator: from n/a through 2.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-multi-store-locator/vulnerability/wordpress-wp-multi-store-locator-plu
tps://patchstack.com/database/wordpress/plugin/wp-multi-store-locator/vulnerability/wordpress-wp-multi-store-locator-plugin-2-5-1-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-26975 State: PUBLISHED Published: 2025-02-25T14:17:58.344Z Last Updated: 2025-02-25T17:08:03.271Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: WP Chill Products: Strong Testimonials Problem Types: CWE-862 Description: Missing Authorization vulnerability in WP Chill Strong Testimonials allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Strong Testimonials: from n/a through 3.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/strong-testimonials/vulnerability/wordpress-strong-testimonials-plugin-3-2-3-broken-access-control-vulnerability?_s_i
in/strong-testimonials/vulnerability/wordpress-strong-testimonials-plugin-3-2-3-broken-access-control-vulnerability?_s_id=cve