Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-46178 State: PUBLISHED Published: 2025-06-09T00:00:00.000Z Last Updated: 2025-06-10T15:12:30.358Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability exists in askquery.php via the eid parameter in the CloudClassroom PHP Project. This allows remote attackers to inject arbitrary JavaScript in the context of a victim s browser session by sending a crafted URL, leading to session hijacking or defacement. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/SacX-7/CVE-2025-46178/blob/main/Cross-Site%20Scripting%20%28XSS%29%20in%20CloudClassroom%20PHP%20Project
CVE ID: CVE-2025-46179 State: PUBLISHED Published: 2025-06-20T00:00:00.000Z Last Updated: 2025-06-24T15:28:32.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was discovered in the askquery.php file of CloudClassroom-PHP Project v1.0. The squeryx parameter accepts unsanitized input, which is passed directly into backend SQL queries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portswigger.net/web-security/sql-injection - https://pastebin.com/DGraeWm8
CVE ID: CVE-2025-46183 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T16:26:09.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Utils.deserialize function in pgCodeKeeper 10.12.0 processes serialized data from untrusted sources. If an attacker provides a specially crafted .ser file, deserialization may result in unintended code execution or other malicious behavior on the target system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/hacktimepro/vulnerabilities/blob/main/Disclosure_CVE-2025-46183_pgcodekeeper.md
CVE ID: CVE-2025-46185 State: PUBLISHED Published: 2025-10-24T00:00:00.000Z Last Updated: 2025-10-24T16:29:58.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Permission vulnerability in pgcodekeeper 10.12.0 allows a local attacker to obtain sensitive information via the plaintext storage of passwords and usernames. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/hacktimepro/vulnerabilities/blob/main/Disclosure_CVE-2025-46185_pgcodekeeper.md
CVE ID: CVE-2025-46188 State: PUBLISHED Published: 2025-05-09T00:00:00.000Z Last Updated: 2025-05-10T02:05:49.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in superadmin_phpmyadmin.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@bijay.kumar1857/sql-injection-to-rce-exploitation-0a5048e592be - https://github.com/x6vrn/mitre/blob/main/CVE-2025-46188.md
CVE ID: CVE-2025-46189 State: PUBLISHED Published: 2025-05-09T00:00:00.000Z Last Updated: 2025-05-10T02:02:38.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_order_customer_update.php via the order_id POST parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/@YousefAlotaibi/disclaimer-1699f46cb1a0 - https://github.com/x6vrn/mitre/blob/main/CVE-2025-46189.md
CVE ID: CVE-2025-46190 State: PUBLISHED Published: 2025-05-09T00:00:00.000Z Last Updated: 2025-05-10T01:59:15.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_delivery_update.php via the order_id POST parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.invicti.com/learn/blind-sql-injection/ - https://github.com/x6vrn/mitre/blob/main/CVE-2025-46190.md
CVE ID: CVE-2025-46191 State: PUBLISHED Published: 2025-05-09T00:00:00.000Z Last Updated: 2025-05-10T01:57:45.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arbitrary File Upload in user_payment_update.php in SourceCodester Client Database Management System 1.0 allows unauthenticated users to upload arbitrary files via the uploaded_file_cancelled field. Due to the absence of proper file extension checks, MIME type validation, and authentication, attackers can upload executable PHP files to a web-accessible directory (/files/). This allows them to execute arbitrary commands remotely by accessing the uploaded script, resulting in full Remote Code Execution (RCE) without authen
bitrary commands remotely by accessing the uploaded script, resulting in full Remote Code Execution (RCE) without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portswigger.net/web-security/file-upload - https://github.com/x6vrn/mitre/blob/main/CVE-2025-46191.md
CVE ID: CVE-2025-46192 State: PUBLISHED Published: 2025-05-09T00:00:00.000Z Last Updated: 2025-05-10T01:54:52.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in user_payment_update.php via the order_id POST parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.invicti.com/learn/blind-sql-injection/ - https://github.com/x6vrn/mitre/blob/main/CVE-2025-46192.md
CVE ID: CVE-2025-46193 State: PUBLISHED Published: 2025-05-09T00:00:00.000Z Last Updated: 2025-05-12T22:12:32.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Client Database Management System 1.0 is vulnerable to Remote code execution via Arbitrary file upload in user_proposal_update_order.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portswigger.net/web-security/file-upload - https://github.com/x6vrn/mitre/blob/main/CVE-2025-46193.md
CVE ID: CVE-2025-46198 State: PUBLISHED Published: 2025-07-25T00:00:00.000Z Last Updated: 2025-07-25T20:06:10.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attribute of the img element Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rapid-echo-f9c.notion.site/Grav-XSS-1dbaf8998a078072bb30ffc9b9e7ab4a?pvs=4 - https://tyojong.tistory.com/1
CVE ID: CVE-2025-46199 State: PUBLISHED Published: 2025-07-25T00:00:00.000Z Last Updated: 2025-07-25T18:02:28.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fields Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rapid-echo-f9c.notion.site/Grav-XSS-25-04-21-1dcaf8998a078001a2eff3dc47974d6d?pvs=4 - https://tyojong.tistory.com/2
CVE ID: CVE-2025-46203 State: PUBLISHED Published: 2025-06-04T00:00:00.000Z Last Updated: 2025-06-04T20:44:26.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /students/edit/{id} endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/changeweb/Unifiedtransform - https://github.com/spbavarva/CVE-2025-46203
CVE ID: CVE-2025-46204 State: PUBLISHED Published: 2025-06-04T00:00:00.000Z Last Updated: 2025-06-04T20:45:16.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /course/edit/{id} endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/changeweb/Unifiedtransform - https://github.com/spbavarva/CVE-2025-46204
CVE ID: CVE-2025-46205 State: PUBLISHED Published: 2025-10-01T00:00:00.000Z Last Updated: 2025-10-27T04:48:40.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-use-after free in the PdfTokenizer::ReadDictionary function of podofo v0.10.0 to v0.10.5 allows attackers to cause a Denial of Service (DoS) by supplying a crafted PDF file. NOTE: this is disputed by the Supplier because there is no available file to reproduce the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/podofo/podofo - https://github.com/ShadowByte1/CVE-Reports/blob/main/CVE-2025-46205.md - https://github.com/ShadowByte1/CVE-Reports/issues/1
CVE ID: CVE-2025-46206 State: PUBLISHED Published: 2025-08-04T00:00:00.000Z Last Updated: 2025-08-05T16:46:11.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://artifex.com - http://mupdf.com - https://github.com/Landw-hub/CVE-2025-46206 - https://bugs.ghostscript.com/show_bug.cgi?id=708521 - https://cgit.gho
m - https://github.com/Landw-hub/CVE-2025-46206 - https://bugs.ghostscript.com/show_bug.cgi?id=708521 - https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=0ec7e4d2201bb6df217e01c17396d36297abf9ac
CVE ID: CVE-2025-46215 State: PUBLISHED Published: 2025-11-18T17:01:21.449Z Last Updated: 2025-11-18T20:04:14.836Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiSandbox Problem Types: CWE-653 Description: An Improper Isolation or Compartmentalization vulnerability [CWE-653] in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an unauthenticated attacker to evade the sandboxing scan via a crafted file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-501
CVE ID: CVE-2025-46216 State: REJECTED Published: N/A Last Updated: 2025-04-23T02:55:09.261Z Description: No description available.
CVE ID: CVE-2025-46217 State: REJECTED Published: N/A Last Updated: 2025-04-23T02:55:08.783Z Description: No description available.
CVE ID: CVE-2025-46218 State: REJECTED Published: N/A Last Updated: 2025-04-23T02:55:08.283Z Description: No description available.
CVE ID: CVE-2025-46219 State: REJECTED Published: N/A Last Updated: 2025-04-23T02:55:07.484Z Description: No description available.
CVE ID: CVE-2025-46220 State: REJECTED Published: N/A Last Updated: 2025-04-23T02:55:07.008Z Description: No description available.
CVE ID: CVE-2025-46221 State: REJECTED Published: N/A Last Updated: 2025-04-23T02:55:06.522Z Description: No description available.
CVE ID: CVE-2025-46222 State: REJECTED Published: N/A Last Updated: 2025-04-23T02:55:06.042Z Description: No description available.
CVE ID: CVE-2025-46223 State: REJECTED Published: N/A Last Updated: 2025-04-23T02:55:05.449Z Description: No description available.
CVE ID: CVE-2025-46224 State: REJECTED Published: N/A Last Updated: 2025-04-23T02:55:04.885Z Description: No description available.
CVE ID: CVE-2025-46225 State: PUBLISHED Published: 2025-04-22T09:53:19.295Z Last Updated: 2025-04-22T17:02:47.132Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Michael Products: Post in page for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Post in page for Elementor allows DOM-Based XSS. This issue affects Post in page for Elementor: from n/a through 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/post-in-page-for-elementor/vulnerability/wordpress-post-in-page-for-elementor-p
patchstack.com/database/wordpress/plugin/post-in-page-for-elementor/vulnerability/wordpress-post-in-page-for-elementor-plugin-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46226 State: PUBLISHED Published: 2025-04-22T09:53:19.931Z Last Updated: 2025-04-22T17:02:22.614Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: ferranfg Products: MPL-Publisher Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ferranfg MPL-Publisher allows Stored XSS. This issue affects MPL-Publisher: from n/a through 2.18.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mpl-publisher/vulnerability/wordpress-mpl-publisher-2-18-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46227 State: PUBLISHED Published: 2025-04-22T09:53:20.549Z Last Updated: 2025-04-22T17:01:59.074Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Brecht Products: Custom Related Posts Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brecht Custom Related Posts allows Stored XSS. This issue affects Custom Related Posts: from n/a through 1.7.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/custom-related-posts/vulnerability/wordpress-custom-related-posts-1-7-4-cross-site-scripting-xss-vulne
/wordpress/plugin/custom-related-posts/vulnerability/wordpress-custom-related-posts-1-7-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46228 State: PUBLISHED Published: 2025-04-22T09:53:21.279Z Last Updated: 2025-04-22T17:01:25.813Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Bastien Ho Products: Event post Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post allows DOM-Based XSS. This issue affects Event post: from n/a through 5.9.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/event-post/vulnerability/wordpress-event-post-5-9-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46229 State: PUBLISHED Published: 2025-04-22T09:53:22.034Z Last Updated: 2025-04-22T14:38:58.251Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Israpil Products: Textmetrics Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Israpil Textmetrics allows Stored XSS. This issue affects Textmetrics: from n/a through 3.6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/webtexttool/vulnerability/wordpress-textmetrics-3-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46230 State: PUBLISHED Published: 2025-04-24T16:08:29.765Z Last Updated: 2025-04-25T13:57:41.871Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: GhozyLab Products: Popup Builder Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in GhozyLab Popup Builder allows PHP Local File Inclusion. This issue affects Popup Builder: from n/a through 1.1.35. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/easy-notify-lite/vulnerability/wordpress-popup-builder-1-1-35-local-file-inclusion-vuln
ck.com/database/wordpress/plugin/easy-notify-lite/vulnerability/wordpress-popup-builder-1-1-35-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-46231 State: PUBLISHED Published: 2025-04-22T09:53:22.691Z Last Updated: 2025-04-22T14:36:17.444Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: SERVIT Software Solutions Products: affiliate-toolkit Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in SERVIT Software Solutions affiliate-toolkit allows Cross Site Request Forgery. This issue affects affiliate-toolkit: from n/a through 3.7.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/affiliate-toolkit-starter/vulnerability/wordpress-affiliate-toolkit-3-7-3-cross-site-request-forgery-csrf-v
press/plugin/affiliate-toolkit-starter/vulnerability/wordpress-affiliate-toolkit-3-7-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-46232 State: PUBLISHED Published: 2025-04-22T09:53:23.356Z Last Updated: 2025-04-22T14:32:42.707Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: alttextai Products: Download Alt Text AI Problem Types: CWE-862 Description: Missing Authorization vulnerability in alttextai Download Alt Text AI allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Download Alt Text AI: from n/a through 1.9.93. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/alttext-ai/vulnerability/wordpress-download-alt-text-ai-1-9-93-broken-access-control-vulnerability?_s_i
wordpress/plugin/alttext-ai/vulnerability/wordpress-download-alt-text-ai-1-9-93-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-46233 State: PUBLISHED Published: 2025-04-22T09:53:23.959Z Last Updated: 2025-04-22T14:21:01.954Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Sirv CDN and Image Hosting Products: Sirv Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sirv CDN and Image Hosting Sirv allows Stored XSS. This issue affects Sirv: from n/a through 7.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/sirv/vulnerability/wordpress-sirv-7-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46234 State: PUBLISHED Published: 2025-04-24T16:08:29.212Z Last Updated: 2025-04-25T13:57:49.296Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Habibur Rahman Razib Products: Control Listings Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Habibur Rahman Razib Control Listings allows Reflected XSS. This issue affects Control Listings: from n/a through 1.0.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/control-listings/vulnerability/wordpress-control-listings-plugin-1-0-4-1-reflected-
hstack.com/database/wordpress/plugin/control-listings/vulnerability/wordpress-control-listings-plugin-1-0-4-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46235 State: PUBLISHED Published: 2025-04-22T09:53:24.616Z Last Updated: 2025-04-22T14:18:03.647Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: sonalsinha21 Products: SKT Blocks – Gutenberg based Page Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks – Gutenberg based Page Builder allows Stored XSS. This issue affects SKT Blocks – Gutenberg based Page Builder: from n/a through 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/skt-blocks/vulnerability/word
s: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/skt-blocks/vulnerability/wordpress-skt-blocks-gutenberg-based-page-builder-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46236 State: PUBLISHED Published: 2025-04-22T09:53:25.263Z Last Updated: 2025-04-22T14:12:04.172Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Link Software LLC Products: HTML Forms Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Software LLC HTML Forms allows Stored XSS. This issue affects HTML Forms: from n/a through 1.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/html-forms/vulnerability/wordpress-html-forms-1-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46237 State: PUBLISHED Published: 2025-04-22T09:53:25.888Z Last Updated: 2025-04-22T14:03:04.690Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Yannick Lefebvre Products: Link Library Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library allows Stored XSS. This issue affects Link Library: from n/a through 7.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/link-library/vulnerability/wordpress-link-library-7-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46238 State: PUBLISHED Published: 2025-04-22T09:53:26.476Z Last Updated: 2025-04-22T13:59:09.727Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: rbaer Products: List Last Changes Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rbaer List Last Changes allows Stored XSS. This issue affects List Last Changes: from n/a through 1.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/list-last-changes/vulnerability/wordpress-list-last-changes-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cv
plugin/list-last-changes/vulnerability/wordpress-list-last-changes-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46239 State: PUBLISHED Published: 2025-04-22T09:53:27.116Z Last Updated: 2025-04-22T13:56:32.899Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Jeff Starr Products: Theme Switcha Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Theme Switcha allows Stored XSS. This issue affects Theme Switcha: from n/a through 3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/theme-switcha/vulnerability/wordpress-theme-switcha-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46240 State: PUBLISHED Published: 2025-04-22T09:53:27.711Z Last Updated: 2025-04-22T13:52:21.048Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Jeff Starr Products: Simple Download Counter Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Simple Download Counter allows Stored XSS. This issue affects Simple Download Counter: from n/a through 2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-download-counter/vulnerability/wordpress-simple-download-counter-2-2-cross-site-
ck.com/database/wordpress/plugin/simple-download-counter/vulnerability/wordpress-simple-download-counter-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-46241 State: PUBLISHED Published: 2025-04-22T09:53:28.272Z Last Updated: 2025-04-22T16:52:09.206Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L) Vendors: codepeople Products: Appointment Booking Calendar Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar allows SQL Injection. This issue affects Appointment Booking Calendar: from n/a through 1.3.92. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/appointment-booking-calendar/vulnerability/wordpress-appointment-booking-calendar-plugin-1-3-92-csrf-to-sql-injection-