Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-8665 State: PUBLISHED Published: 2025-08-06T17:02:04.987Z Last Updated: 2025-08-06T17:31:11.272Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: agno-agi Products: agno Problem Types: CWE-78, CWE-77 Description: A vulnerability, which was classified as critical, has been found in agno-agi agno up to 1.7.5. This issue affects the function MCPTools/MultiMCPTools in the library libs/agno/agno/tools/mcp.py of the component Model Context Protocol Handler. The manipulation of the argument command leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted
ttack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319025 - https://vuldb.com/?ctiid.319025 - https://vuldb.com/?submit.620530 - https://github.com/bayuncao-bit/vul-30 - https://github.com/bayuncao-bit/vul-30#proof-of-concept
CVE ID: CVE-2025-8666 State: PUBLISHED Published: 2025-10-25T05:31:19.307Z Last Updated: 2025-10-27T15:48:15.392Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: uapp Products: Testimonial Carousel For Elementor Problem Types: CWE-79 Description: The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions less than, or equal to, 11.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injecte
r-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1f5c3b2c-1ed2-47e1-8e39-cbe6f2973d15?source=cve - https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/tags/11.6.2/widgets/section-with-carousel/class-section-with-cube.php#L1167 - https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/tags/11.6.2/widgets/animated-carousel/class-testimonialscarousel-coverflow.php#L1425 - https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/tags/11.6
nialscarousel-coverflow.php#L1425 - https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/tags/11.6.2/widgets/animated-carousel/class-testimonialscarousel-coverflow.php#L1443 - https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/tags/11.6.2/widgets/animated-carousel/class-testimonialscarousel-cube.php#L913 - https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/tags/11.6.2/widgets/testimonials-carousel/class-testimonialscarousel-blog.php#L1192
CVE ID: CVE-2025-8667 State: PUBLISHED Published: 2025-08-06T18:02:05.465Z Last Updated: 2025-08-06T20:27:56.519Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SkyworkAI Products: DeepResearchAgent Problem Types: CWE-78, CWE-77 Description: A vulnerability, which was classified as critical, was found in SkyworkAI DeepResearchAgent up to 08eb7f8eb9505d0094d75bb97ff7dacc3fa3bbf2. Affected is the function from_code/from_dict/from_mcp of the file src/tools/tools.py. The manipulation leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is
ack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.319026 - https://vuldb.com/?ctiid.319026 - https://vuldb.com/?submit.621324 - https://github.com/bayuncao-bit/vul-36 - https://github.com/bayuncao-bit/vul-36#proof-of-concept
CVE ID: CVE-2025-8669 State: PUBLISHED Published: 2025-10-03T11:17:18.759Z Last Updated: 2025-10-03T14:04:16.514Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: pressmaximum Products: Customify Problem Types: CWE-352 Description: The Customify theme for WordPress is vulnerable to Cross-Site Request Forgery in version 0.4.11. This is due to missing or incorrect nonce validation on the reset_customize_section function. This makes it possible for unauthenticated attackers to reset theme customization settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA A
can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a3425d78-1e24-4224-bfdc-a3e11735384f?source=cve - https://themes.trac.wordpress.org/browser/customify/0.4.11/inc/customizer/class-customizer.php#L55 - https://themes.trac.wordpress.org/changeset/291160/customify/0.4.12/inc/customizer/class-customizer.php
CVE ID: CVE-2025-8671 State: PUBLISHED Published: 2025-08-13T12:03:37.167Z Last Updated: 2025-11-04T21:15:08.215Z Vendors: SUSE Linux, Varnish Software, Fastly, Wind River Products: Enterprise Module for Development Tools, Enterprise High Performance Computing (HPC), Varnish Enterprise, Varnish Cache, H20, Linux, Enterprise Desktop, Enterprise High Performance Computing, Enterprise Module for Dev Tools, Enterprise Module for Package Hub, Enterprise Server, Enterprise Server for SAP Applications, SUSE Manager Server, SUSE Manager Server LTS, SUSE Manager Proxy, SUSE Manager Retail Branch Server, openSUSE Leap Problem Types: CWE-404 Improper Resource Shutdown or Release Description: A mismatch
Retail Branch Server, openSUSE Leap Problem Types: CWE-404 Improper Resource Shutdown or Release Description: A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unboun
e protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://galbarnahum.com/made-you-reset - https://kb.cert.org/vuls/id/767506 - https://varnish-cache.org/security/VSV00017.html - https://www.fastlystatus.com/incident/377810 - https://github.com/h2o/h2o/commit/4729b661e3c6654198d2cc62997e1af58bef4b80 - https://support2.windriver.com/index.php?page=security-notices - https://www.suse.com/support/kb/doc/?id=00002198
4b80 - https://support2.windriver.com/index.php?page=security-notices - https://www.suse.com/support/kb/doc/?id=000021980 - https://gitlab.isc.org/isc-projects/bind9/-/issues/5325 - https://github.com/h2o/h2o/security/advisories/GHSA-mrjm-qq9m-9mjq
CVE ID: CVE-2025-8672 State: PUBLISHED Published: 2025-08-11T12:21:48.487Z Last Updated: 2025-08-11T19:45:08.822Z Vendors: GIMP Products: GIMP Problem Types: CWE-276 Description: MacOS version of GIMP bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. An attacker with local user access can invoke this interpreter with arbitrary commands or scripts, leveraging the application's previously granted TCC permissions to access user's files in privacy-protected folders without triggering user prompts. Accessing other resources beyond previously granted TCC permissions will prompt the user for approv
gering user prompts. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of GIMP, potentially disguising attacker's malicious intent. This issue has been fixed in 3.1.4.2 version of GIMP. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.gnome.org/Infrastructure/gimp-macos-build - https://cert.pl/en/posts/2025/08/tcc-bypass/ - https://www.jamf.com/blog/zero-day-tcc-bypass-discovered-in-xcsset-malware/ - https://gitlab.gnome.org/GNOME/gimp/-/issues/13848
CVE ID: CVE-2025-8675 State: PUBLISHED Published: 2025-08-15T16:27:21.147Z Last Updated: 2025-08-15T16:47:15.896Z Vendors: Drupal Products: AI SEO Link Advisor Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Drupal AI SEO Link Advisor allows Server Side Request Forgery.This issue affects AI SEO Link Advisor: from 0.0.0 before 1.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.drupal.org/sa-contrib-2025-095
CVE ID: CVE-2025-8676 State: PUBLISHED Published: 2025-08-15T02:24:23.998Z Last Updated: 2025-08-15T12:20:54.248Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: bplugins Products: B Slider- Gutenberg Slider Block for WP Problem Types: CWE-200 Description: The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in versions less than, or equal to, 2.0.0 via the get_active_plugins function. This makes it possible for authenticated attackers, with subscriber-level access and above to extract sensitive data including installed plugin information. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
ract sensitive data including installed plugin information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c19b24ef-cf49-4a5c-a187-0f09ac53c337?source=cve - https://plugins.trac.wordpress.org/browser/b-slider/tags/1.1.30/adminMenu.php#L83 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3343487%40b-slider&new=3343487%40b-slider&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8677 State: PUBLISHED Published: 2025-10-22T15:43:10.369Z Last Updated: 2025-11-04T21:15:09.556Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Problem Types: CWE-405 Description: Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2025-8677
CVE ID: CVE-2025-8678 State: PUBLISHED Published: 2025-08-22T07:24:56.107Z Last Updated: 2025-08-25T14:38:29.198Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: johnbillion Products: WP Crontrol Problem Types: CWE-918 Description: The WP Crontrol plugin for WordPress is vulnerable to blind Server-Side Request Forgery in versions 1.17.0 to 1.19.1 via the 'wp_remote_request' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CIS
web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ab40146d-9b49-4214-af73-41c5b5512542?source=cve - https://plugins.trac.wordpress.org/browser/wp-crontrol/trunk/src/bootstrap.php#L2712 - https://plugins.trac.wordpress.org/changeset/3347075/
CVE ID: CVE-2025-8679 State: PUBLISHED Published: 2025-10-01T17:19:16.743Z Last Updated: 2025-10-01T17:29:42.134Z Vendors: Extreme Networks Products: ExtremeGuest Essentials Problem Types: CWE-307 Description: In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated device to be marked as authenticated and obtain network access. Client360 logs may display the client MAC as the username despite no MAC-authentication being enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
sername despite no MAC-authentication being enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://extreme-networks.my.site.com/ExtrArticleDetail?an=000130289
CVE ID: CVE-2025-8680 State: PUBLISHED Published: 2025-08-15T02:24:23.123Z Last Updated: 2025-08-15T12:43:33.637Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: bplugins Products: B Slider- Gutenberg Slider Block for WP Problem Types: CWE-918 Description: The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Server-Side Request Forgery in version less than, or equal to, 2.0.0 via the fs_api_request function. This makes it possible for authenticated attackers, with subscriber-level access and above to make web requests to arbitrary locations originating from the web application which can be used to query and modify information fro
quests to arbitrary locations originating from the web application which can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ac245316-228e-4508-b3fe-f7071fb1bc8e?source=cve - https://plugins.trac.wordpress.org/browser/b-slider/tags/1.1.30/bplugins_sdk/inc/Base/FSActivate.php#L166 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3343487%40b-slider&new=3343487%40b-slider&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8681 State: PUBLISHED Published: 2025-09-10T16:00:15.062Z Last Updated: 2025-09-11T14:42:58.353Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: Pegasystems Products: Pega Infinity Problem Types: CWE-79 Description: Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component. Requires a high privileged user with a developer role. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pega.com/support-doc/pega-security-advisory-g25-vulnerability-remediation-note
CVE ID: CVE-2025-8682 State: PUBLISHED Published: 2025-10-11T09:28:39.133Z Last Updated: 2025-10-14T18:45:32.811Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: themeansar Products: Newsup Problem Types: CWE-862 Description: The Newsup theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the newsup_admin_info_install_plugin() function in all versions up to, and including, 5.0.10. This makes it possible for unauthenticated attackers to install the ansar-import plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/939b408c-ae22-40
Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/939b408c-ae22-40ce-b500-317150a2da3b?source=cve - https://research.cleantalk.org/cve-2025-8682 - https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=292407%40newsup&new=292407%40newsup&sfp_email=&sfph_mail=
CVE ID: CVE-2025-8684 State: PUBLISHED Published: 2025-09-05T03:25:31.012Z Last Updated: 2025-09-05T15:50:40.361Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ux-themes Products: Flatsome Problem Types: CWE-79 Description: The Flatsome Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's shortcodes in all versions up to, and including, 3.20.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additio
and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ffc82708-b04d-4fba-9a79-594ad25dc965?source=cve - https://themeforest.net/item/flatsome-multipurpose-responsive-woocommerce-theme/5484319#item-description__change-log
CVE ID: CVE-2025-8685 State: PUBLISHED Published: 2025-08-12T02:24:46.331Z Last Updated: 2025-08-13T20:19:19.123Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: emilien Products: Wp chart generator Problem Types: CWE-79 Description: The Wp chart generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpchart shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/25302010-202a-458e-93b6-2e6b8604c091?source=cve - https://plugins.svn.wordpress.org/wp-chart-generator/trunk/wp-chart.php - https://wordpress.org/plugins/wp-chart-generator/#developers
CVE ID: CVE-2025-8686 State: PUBLISHED Published: 2025-09-11T07:24:50.705Z Last Updated: 2025-09-11T14:41:18.254Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wen-solutions Products: WP Easy FAQs Problem Types: CWE-79 Description: The WP Easy FAQs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's WP_EASY_FAQ shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inj
uthor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2d3c2f4b-389e-4dec-bb18-b63cfa053947?source=cve - https://plugins.svn.wordpress.org/wp-easy-faqs/tags/1.0.5/includes/class-wp-easy-faqs-shortcode.php - https://plugins.svn.wordpress.org/wp-easy-faqs/tags/1.0.5/admin/class-wp-easy-faqs-admin.php - https://wordpress.org/plugins/wp-easy-faqs/#developers
CVE ID: CVE-2025-8688 State: PUBLISHED Published: 2025-08-12T02:24:47.964Z Last Updated: 2025-08-12T15:59:52.758Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ebernstein Products: Inline Stock Quotes Problem Types: CWE-79 Description: The Inline Stock Quotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesse
h contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/93ab3e05-dbaf-4f55-a411-793a74c75071?source=cve - https://plugins.svn.wordpress.org/inline-stock-quotes/trunk/inline-quotes.php - https://wordpress.org/plugins/inline-stock-quotes/#developers
CVE ID: CVE-2025-8689 State: PUBLISHED Published: 2025-09-11T07:24:58.699Z Last Updated: 2025-09-11T14:38:14.558Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cssigniterteam Products: Elements Plus! Problem Types: CWE-79 Description: The Elements Plus! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison, HotSpot Plus, and Google Maps widgets in all versions up to, and including, 2.16.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that
ible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bdebb4a6-1bf8-4a61-b690-cf933215216a?source=cve - https://wordpress.org/plugins/elements-plus/#developers
CVE ID: CVE-2025-8690 State: PUBLISHED Published: 2025-08-12T02:24:47.163Z Last Updated: 2025-08-13T20:19:04.998Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: addix Products: Simple Responsive Slider Problem Types: CWE-79 Description: The Simple Responsive Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP
y web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7888aedb-5421-4c3a-8459-d6177b398a06?source=cve - https://plugins.svn.wordpress.org/addi-simple-slider/tags/2.0/methods.php - https://wordpress.org/plugins/addi-simple-slider/#developers
CVE ID: CVE-2025-8691 State: PUBLISHED Published: 2025-09-11T07:25:03.555Z Last Updated: 2025-09-11T14:36:52.311Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: softmus Products: WP Scriptcase Problem Types: CWE-79 Description: The WP Scriptcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CI
bitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f6cb6fbc-456d-4912-a574-cb25ab16df3a?source=cve - https://plugins.svn.wordpress.org/wp-scriptcase/trunk/wpscriptcase.php - https://wordpress.org/plugins/wp-scriptcase/#developers