Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
stack.com/database/wordpress/plugin/wt-woocommerce-wishlist/vulnerability/wordpress-wishlist-for-woocommerce-plugin-2-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24658 State: PUBLISHED Published: 2025-01-24T17:24:47.058Z Last Updated: 2025-01-24T18:56:57.250Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Joe Hawes Products: Auction Nudge – Your eBay on Your Site Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Hawes Auction Nudge – Your eBay on Your Site allows Stored XSS. This issue affects Auction Nudge – Your eBay on Your Site: from n/a through 7.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/auction-nudge/vulnerability/wordpress-auct
Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/auction-nudge/vulnerability/wordpress-auction-nudge-your-ebay-on-your-site-plugin-7-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24659 State: PUBLISHED Published: 2025-01-24T17:24:44.883Z Last Updated: 2025-01-24T18:57:19.412Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: WordPress Download Manager Products: Premium Packages Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WordPress Download Manager Premium Packages allows Blind SQL Injection. This issue affects Premium Packages: from n/a through 5.9.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpdm-premium-packages/vulnerability/wordpress-premium-packages-sell
: - https://patchstack.com/database/wordpress/plugin/wpdm-premium-packages/vulnerability/wordpress-premium-packages-sell-digital-products-securely-plugin-5-9-6-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-24660 State: PUBLISHED Published: 2025-02-03T14:22:48.987Z Last Updated: 2025-02-03T16:26:26.768Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: wp.insider Products: Simple Membership Custom Messages Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp.insider Simple Membership Custom Messages allows Reflected XSS. This issue affects Simple Membership Custom Messages: from n/a through 2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-membership-custom-messages/vulnerability/wordpres
References: - https://patchstack.com/database/wordpress/plugin/simple-membership-custom-messages/vulnerability/wordpress-simple-membership-custom-messages-plugin-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24661 State: PUBLISHED Published: 2025-02-03T14:23:53.755Z Last Updated: 2025-05-21T19:54:51.704Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: MagePeople Team Products: Taxi Booking Manager for WooCommerce Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in MagePeople Team Taxi Booking Manager for WooCommerce allows Object Injection.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 1.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ecab-taxi-booking-manager/vulnerability/wordpress-taxi-booking-manager-for-woocomme
hstack.com/database/wordpress/plugin/ecab-taxi-booking-manager/vulnerability/wordpress-taxi-booking-manager-for-woocommerce-plugin-1-1-8-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-24662 State: PUBLISHED Published: 2025-01-27T14:22:16.706Z Last Updated: 2025-03-27T21:15:59.421Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: LearnDash Products: LearnDash LMS Problem Types: CWE-862 Description: Missing Authorization vulnerability in LearnDash LearnDash LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnDash LMS: from n/a through 4.20.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/sfwd-lms/vulnerability/wordpress-learndash-lms-plugin-4-20-0-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-24663 State: PUBLISHED Published: 2025-01-24T17:24:43.701Z Last Updated: 2025-01-24T18:57:33.644Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Tips and Tricks HQ, Ruhul Amin, Josh Lobe Products: Simple Download Monitor Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tips and Tricks HQ, Ruhul Amin, Josh Lobe Simple Download Monitor allows Blind SQL Injection. This issue affects Simple Download Monitor: from n/a through 3.9.25. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-download
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-download-monitor/vulnerability/wordpress-simple-download-monitor-plugin-3-9-25-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-24664 State: PUBLISHED Published: 2025-01-27T13:59:49.368Z Last Updated: 2025-01-27T14:31:27.825Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: Eniture Technology Products: LTL Freight Quotes – Worldwide Express Edition Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eniture Technology LTL Freight Quotes – Worldwide Express Edition allows SQL Injection. This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a through 5.0.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/p
ugh 5.0.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ltl-freight-quotes-worldwide-express-edition/vulnerability/wordpress-ltl-freight-quotes-plugin-5-0-20-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-24665 State: PUBLISHED Published: 2025-01-27T14:22:16.865Z Last Updated: 2025-02-12T20:41:34.181Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: Eniture Technology Products: Small Package Quotes – Unishippers Edition Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eniture Technology Small Package Quotes – Unishippers Edition allows SQL Injection. This issue affects Small Package Quotes – Unishippers Edition: from n/a through 2.4.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/small-p
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/small-package-quotes-unishippers-edition/vulnerability/wordpress-small-package-quotes-plugin-2-4-8-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-24666 State: PUBLISHED Published: 2025-01-24T17:24:50.523Z Last Updated: 2025-01-24T18:56:26.036Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: ThemeIsle Products: AI Chatbot for WordPress – Hyve Lite Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeIsle AI Chatbot for WordPress – Hyve Lite allows Stored XSS. This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 1.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/hyve-lite/vulnerability/wordpress-hyve-lite-plug
ichment: References: - https://patchstack.com/database/wordpress/plugin/hyve-lite/vulnerability/wordpress-hyve-lite-plugin-1-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24667 State: PUBLISHED Published: 2025-01-27T14:22:17.046Z Last Updated: 2025-02-12T20:41:35.484Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: Eniture Technology Products: Small Package Quotes – Worldwide Express Edition Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eniture Technology Small Package Quotes – Worldwide Express Edition allows SQL Injection. This issue affects Small Package Quotes – Worldwide Express Edition: from n/a through 5.2.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordp
a through 5.2.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/small-package-quotes-wwe-edition/vulnerability/wordpress-small-package-quotes-plugin-5-2-17-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-24668 State: PUBLISHED Published: 2025-01-24T17:24:45.470Z Last Updated: 2025-01-24T18:57:12.046Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Themeisle Products: PPOM for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle PPOM for WooCommerce allows Stored XSS. This issue affects PPOM for WooCommerce: from n/a through 33.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woocommerce-product-addon/vulnerability/wordpress-ppom-for-woocommerce-plugin-33-0-8-cross-site
atabase/wordpress/plugin/woocommerce-product-addon/vulnerability/wordpress-ppom-for-woocommerce-plugin-33-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24669 State: PUBLISHED Published: 2025-01-24T17:24:47.661Z Last Updated: 2025-01-24T18:56:49.688Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: SERPed Products: SERPed.net Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERPed SERPed.net allows SQL Injection. This issue affects SERPed.net: from n/a through 4.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/serped-net/vulnerability/wordpress-serped-net-plugin-4-4-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-24670 State: PUBLISHED Published: 2025-04-17T15:48:13.200Z Last Updated: 2025-04-17T18:18:15.803Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Dhanendran Rajagopal Products: Term Taxonomy Converter Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dhanendran Rajagopal Term Taxonomy Converter allows Reflected XSS. This issue affects Term Taxonomy Converter: from n/a through 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/term-taxonomy-converter/vulnerability/wordpress-term-taxonomy-conv
s: - https://patchstack.com/database/wordpress/plugin/term-taxonomy-converter/vulnerability/wordpress-term-taxonomy-converter-plugin-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24671 State: PUBLISHED Published: 2025-01-27T14:22:17.211Z Last Updated: 2025-02-12T20:41:35.344Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Pdfcrowd Products: Save as PDF plugin by Pdfcrowd Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Object Injection. This issue affects Save as PDF plugin by Pdfcrowd: from n/a through 4.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/save-as-pdf-by-pdfcrowd/vulnerability/wordpress-save-as-pdf-plugin-by-pdfcrowd-plugin-4-4-0-php-object-injecti
ss/plugin/save-as-pdf-by-pdfcrowd/vulnerability/wordpress-save-as-pdf-plugin-by-pdfcrowd-plugin-4-4-0-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-24672 State: PUBLISHED Published: 2025-01-24T17:24:46.086Z Last Updated: 2025-01-24T18:57:04.482Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: CodePeople Products: Form Builder CP Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CodePeople Form Builder CP allows SQL Injection. This issue affects Form Builder CP: from n/a through 1.2.41. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cp-easy-form-builder/vulnerability/wordpress-form-builder-cp-plugin-1-2-41-sql-injection-vulnerability?_s_i
press/plugin/cp-easy-form-builder/vulnerability/wordpress-form-builder-cp-plugin-1-2-41-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-24673 State: PUBLISHED Published: 2025-01-24T17:24:48.234Z Last Updated: 2025-01-24T18:56:41.024Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: AyeCode Ltd Products: Ketchup Shortcodes Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AyeCode Ltd Ketchup Shortcodes allows Stored XSS. This issue affects Ketchup Shortcodes: from n/a through 0.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ketchup-shortcodes-pack/vulnerability/wordpress-ketchup-shortcodes-plugin-0-1-2-cross-site-scripting-xss-
rdpress/plugin/ketchup-shortcodes-pack/vulnerability/wordpress-ketchup-shortcodes-plugin-0-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24674 State: PUBLISHED Published: 2025-01-24T17:24:57.971Z Last Updated: 2025-02-12T20:01:18.291Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Teplitsa. Technologies for Social Good Products: ShMapper by Teplitsa Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Teplitsa. Technologies for Social Good ShMapper by Teplitsa allows Stored XSS. This issue affects ShMapper by Teplitsa: from n/a through 1.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/shmapper-by-teplitsa/vulnerability/wor
ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/shmapper-by-teplitsa/vulnerability/wordpress-shmapper-by-teplitsa-plugin-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24675 State: PUBLISHED Published: 2025-01-24T17:24:51.094Z Last Updated: 2025-01-24T18:56:17.806Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: osamaesh Products: WP Visitor Statistics (Real Time Traffic) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osamaesh WP Visitor Statistics (Real Time Traffic) allows Stored XSS. This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 7.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-stats-manager/vulnerability/wordpr
A ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-stats-manager/vulnerability/wordpress-wp-visitor-statistics-real-time-traffic-plugin-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24676 State: PUBLISHED Published: 2025-02-03T14:22:49.140Z Last Updated: 2025-05-19T17:46:48.241Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: umangmetatagg Products: Custom WP Store Locator Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in umangmetatagg Custom WP Store Locator allows Reflected XSS.This issue affects Custom WP Store Locator: from n/a through 1.4.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/custom-store-locator/vulnerability/wordpress-custom-wp-store-locator-plugin-1-4
patchstack.com/database/wordpress/plugin/custom-store-locator/vulnerability/wordpress-custom-wp-store-locator-plugin-1-4-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24677 State: PUBLISHED Published: 2025-02-04T14:21:15.461Z Last Updated: 2025-02-04T15:07:43.158Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: WPSpins Products: Post/Page Copying Tool Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in WPSpins Post/Page Copying Tool allows Remote Code Inclusion. This issue affects Post/Page Copying Tool: from n/a through 2.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/postpage-import-export-with-custom-fields-taxonomies/vulnerability/wordpress-post-page-copying-tool-to-expor
ress/plugin/postpage-import-export-with-custom-fields-taxonomies/vulnerability/wordpress-post-page-copying-tool-to-export-and-import-post-page-for-cross-site-migration-plugin-2-0-3-remote-code-execution-rce-vulnerability?_s_id=cve
CVE ID: CVE-2025-24678 State: PUBLISHED Published: 2025-01-24T17:24:53.678Z Last Updated: 2025-01-24T18:55:47.476Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Listamester Products: Listamester Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Listamester Listamester allows Stored XSS. This issue affects Listamester: from n/a through 2.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/listamester/vulnerability/wordpress-listamester-plugin-2-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24679 State: PUBLISHED Published: 2025-01-24T17:24:48.805Z Last Updated: 2025-01-24T18:56:33.071Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: webraketen Products: Internal Links Manager Problem Types: CWE-862 Description: Missing Authorization vulnerability in webraketen Internal Links Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Internal Links Manager: from n/a through 2.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/seo-automated-link-building/vulnerability/wordpress-internal-links-manager-plugin-2-5-2-broken-a
tabase/wordpress/plugin/seo-automated-link-building/vulnerability/wordpress-internal-links-manager-plugin-2-5-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-24680 State: PUBLISHED Published: 2025-01-27T14:22:17.430Z Last Updated: 2025-02-12T20:41:35.222Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: WpMultiStoreLocator Products: WP Multi Store Locator Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WpMultiStoreLocator WP Multi Store Locator allows Reflected XSS. This issue affects WP Multi Store Locator: from n/a through 2.4.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-multi-store-locator/vulnerability/wordpress-wp-multi-store-locator-plugin
://patchstack.com/database/wordpress/plugin/wp-multi-store-locator/vulnerability/wordpress-wp-multi-store-locator-plugin-2-4-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24681 State: PUBLISHED Published: 2025-01-24T17:24:54.277Z Last Updated: 2025-01-24T18:55:38.727Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: wpWax Products: Product Carousel Slider & Grid Ultimate for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Product Carousel Slider & Grid Ultimate for WooCommerce allows Stored XSS. This issue affects Product Carousel Slider & Grid Ultimate for WooCommerce: from n/a through 1.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugi
1.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woo-product-carousel-slider-and-grid-ultimate/vulnerability/wordpress-product-carousel-slider-grid-ultimate-for-woocommerce-plugin-1-10-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24682 State: PUBLISHED Published: 2025-01-24T17:24:52.835Z Last Updated: 2025-01-24T18:55:55.013Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: mikemmx Products: Super Block Slider Problem Types: CWE-862 Description: Missing Authorization vulnerability in mikemmx Super Block Slider allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Super Block Slider: from n/a through 2.7.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/super-block-slider/vulnerability/wordpress-super-block-slider-plugin-2-7-9-broken-access-control-vulnerability?_s_
lugin/super-block-slider/vulnerability/wordpress-super-block-slider-plugin-2-7-9-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-24683 State: PUBLISHED Published: 2025-01-24T17:24:57.418Z Last Updated: 2025-02-12T20:01:18.418Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: WPChill Products: RSVP and Event Management Plugin Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill RSVP and Event Management Plugin allows SQL Injection. This issue affects RSVP and Event Management Plugin: from n/a through 2.7.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/rsvp/vulnerability/wordpress-rsvp-and-event-management-plugin-
ences: - https://patchstack.com/database/wordpress/plugin/rsvp/vulnerability/wordpress-rsvp-and-event-management-plugin-2-7-14-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-24684 State: PUBLISHED Published: 2025-02-03T14:22:49.297Z Last Updated: 2025-02-03T16:26:07.636Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Ederson Peka Products: Media Downloader Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ederson Peka Media Downloader allows Reflected XSS. This issue affects Media Downloader: from n/a through 0.4.7.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/media-downloader/vulnerability/wordpress-media-downloader-plugin-0-4-7-5-reflected-cross-site-scrip
ase/wordpress/plugin/media-downloader/vulnerability/wordpress-media-downloader-plugin-0-4-7-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24685 State: PUBLISHED Published: 2025-01-27T13:59:49.555Z Last Updated: 2025-01-27T14:29:25.409Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MORKVA Products: Morkva UA Shipping Problem Types: CWE-35 Description: Path Traversal vulnerability in MORKVA Morkva UA Shipping allows PHP Local File Inclusion. This issue affects Morkva UA Shipping: from n/a through 1.0.18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/morkva-ua-shipping/vulnerability/wordpress-morkva-ua-shipping-plugin-1-0-18-local-file-inclusion-vulnerability?_s_id=cve