Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
th a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01331.html
CVE ID: CVE-2025-25060 State: PUBLISHED Published: 2025-04-02T03:20:54.826Z Last Updated: 2025-04-02T16:04:49.028Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Hammock Corporation Products: AssetView, AssetView CLOUD Problem Types: CWE-306 Description: Missing authentication for critical function vulnerability exists in AssetView and AssetView CLOUD. If exploited, the files on the server where the product is running may be obtained and/or deleted by a remote unauthenticated attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hammock.jp/assetview/info/250325.html - https://jvn.jp/en/jp/JVN26321838/
CVE ID: CVE-2025-25061 State: PUBLISHED Published: 2025-04-04T02:10:08.271Z Last Updated: 2025-04-04T14:21:05.467Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: JTEKT ELECTRONICS CORPORATION Products: HMI ViewJet C-more series, HMI GC-A2 series Problem Types: CWE-441 Description: Unintended proxy or intermediary ('Confused Deputy') issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remote unauthenticated attacker to use the product as an intermediary for FTP bounce attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.electronics.jtekt.co.jp/en/topics/202503207271/ - https://www.electronics.jtek
P Vulnrichment: References: - https://www.electronics.jtekt.co.jp/en/topics/202503207271/ - https://www.electronics.jtekt.co.jp/en/topics/202503207269/ - https://jvn.jp/en/jp/JVN17260367/
CVE ID: CVE-2025-25062 State: PUBLISHED Published: 2025-02-03T00:00:00.000Z Last Updated: 2025-05-09T12:03:34.762Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: backdropcms Products: backdrop Problem Types: CWE-79 Description: An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It doesn't sufficiently isolate long text content when the CKEditor 5 rich text editor is used. This allows a potential attacker to craft specialized HTML and JavaScript that may be executed when an administrator attempts to edit a piece of content. This vulnerability is mitigated by the fact that an attacker must have the ability to create lon
dit a piece of content. This vulnerability is mitigated by the fact that an attacker must have the ability to create long text content (such as through the node or comment forms) and an administrator must edit (not view) the content that contains the malicious content. This problem only exists when using the CKEditor 5 module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://backdropcms.org/security/backdrop-sa-core-2025-001 - https://medium.com/@rudranshsinghrajpurohit/cve-2025-25062-stored-cross-site-scripting-xss-in-backdrop-cms-5073df76612b - https://www.getastra.com/blog/vulnerability/cve-2025-25062stored-cross-site-scripting-xss-in-backdrop-cms-v1-28-2/
CVE ID: CVE-2025-25063 State: PUBLISHED Published: 2025-02-03T00:00:00.000Z Last Updated: 2025-02-12T20:41:38.109Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: backdropcms Products: backdrop Problem Types: CWE-79 Description: An XSS issue was discovered in Backdrop CMS 1.28.x before 1.28.5 and 1.29.x before 1.29.3. It does not sufficiently validate uploaded SVG images to ensure they do not contain potentially dangerous SVG tags. SVG images can contain clickable links and executable scripting, and using a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is mitigated by the attacker needing to be able t
ecute scripting in the browser when an SVG image is viewed. This issue is mitigated by the attacker needing to be able to upload SVG images, and that Backdrop embeds all uploaded SVG images within &lt;img&gt; tags, which prevents scripting from executing. The SVG must be viewed directly by its URL in order to run any embedded scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://backdropcms.org/security/backdrop-sa-core-2025-002
CVE ID: CVE-2025-25064 State: PUBLISHED Published: 2025-02-03T00:00:00.000Z Last Updated: 2025-03-14T17:22:58.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a user-supplied parameter. Authenticated attackers can exploit this vulnerability by manipulating a specific parameter in the request, allowing them to inject arbitrary SQL queries that could retrieve email metadata. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wik
lyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.4#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.12#Security_Fixes
CVE ID: CVE-2025-25065 State: PUBLISHED Published: 2025-02-03T00:00:00.000Z Last Updated: 2025-03-13T20:47:30.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 allows unauthorized redirection to internal network endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.4#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.12#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P43#Security_
imbra.com/wiki/Zimbra_Releases/10.0.12#Security_Fixes - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P43#Security_Fixes
CVE ID: CVE-2025-25066 State: PUBLISHED Published: 2025-02-03T00:00:00.000Z Last Updated: 2025-02-12T20:41:37.926Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: ntop Products: nDPI Problem Types: CWE-121 Description: nDPI through 4.12 has a potential stack-based buffer overflow in ndpi_address_cache_restore in lib/ndpi_cache.c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ntop/nDPI/commit/678697b5eb6c3caa5dd5f8cccfe9eed8d13b94bb
CVE ID: CVE-2025-25067 State: PUBLISHED Published: 2025-02-13T21:35:45.844Z Last Updated: 2025-02-14T15:47:02.910Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: mySCADA Products: myPRO Manager Problem Types: CWE-78 Description: mySCADA myPRO Manager is vulnerable to an OS command injection which could allow a remote attacker to execute arbitrary OS commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-16 - https://www.myscada.org/downloads/mySCADAPROManager/ - https://www.myscada.org/contacts/
CVE ID: CVE-2025-25068 State: PUBLISHED Published: 2025-03-21T08:26:32.027Z Last Updated: 2025-03-21T12:25:55.494Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Mattermost Products: Mattermost Problem Types: CWE-306 Description: Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to enforce MFA on plugin endpoints, which allows authenticated attackers to bypass MFA protections via API requests to plugin-specific routes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-25069 State: PUBLISHED Published: 2025-02-07T12:46:11.350Z Last Updated: 2025-02-13T21:21:42.342Z Vendors: Apache Software Foundation Products: Apache Kvrocks Problem Types: CWE-115 Description: A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks. Since Kvrocks didn't detect if "Host:" or "POST" appears in RESP requests, a valid HTTP request can also be sent to Kvrocks as a valid RESP request and trigger some database operations, which can be dangerous when it is chained with SSRF. It is similiar to CVE-2016-10517 in Redis. This issue affects Apache Kvrocks: from the initial version to the latest version 2.11.0. Users are recommended to upgrade to version 2.1
s Apache Kvrocks: from the initial version to the latest version 2.11.0. Users are recommended to upgrade to version 2.11.1, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cve.org/CVERecord?id=CVE-2016-10517 - https://lists.apache.org/thread/gbxv9gpsskmdzg6z48zm3tvo8cyo9v3t
CVE ID: CVE-2025-25070 State: PUBLISHED Published: 2025-03-03T13:30:21.716Z Last Updated: 2025-03-03T17:37:54.014Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Album Reviewer Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Album Reviewer allows Stored XSS. This issue affects Album Reviewer: from n/a through 2.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/albumreviewer/vulnerability/wordpress-album-reviewer-plugin-2-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25071 State: PUBLISHED Published: 2025-02-07T10:11:33.492Z Last Updated: 2025-02-07T15:52:13.728Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: topplugins Products: Vignette Ads Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in topplugins Vignette Ads allows Stored XSS. This issue affects Vignette Ads: from n/a through 0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/vignete-ads/vulnerability/wordpress-vignette-ads-plugin-0-2-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25072 State: PUBLISHED Published: 2025-02-07T10:11:26.396Z Last Updated: 2025-02-07T16:03:26.180Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: thunderbax Products: WP Admin Custom Page Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in thunderbax WP Admin Custom Page allows Stored XSS. This issue affects WP Admin Custom Page: from n/a through 1.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-admin-custom-page/vulnerability/wordpress-wp-admin-custom-page-plugin-1-5-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25073 State: PUBLISHED Published: 2025-02-07T10:11:27.788Z Last Updated: 2025-02-07T16:03:09.308Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Vasilis Triantafyllou Products: Easy WP Tiles Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vasilis Triantafyllou Easy WP Tiles allows Stored XSS. This issue affects Easy WP Tiles: from n/a through 1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/easy-wp-tiles/vulnerability/wordpress-easy-wp-tiles-plugin-1-cross-site-scripting-xss-vulnerabili
abase/wordpress/plugin/easy-wp-tiles/vulnerability/wordpress-easy-wp-tiles-plugin-1-cross-site-scripting-xss-vulnerability-3?_s_id=cve
CVE ID: CVE-2025-25074 State: PUBLISHED Published: 2025-02-07T10:11:29.636Z Last Updated: 2025-02-07T15:55:46.357Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Nirmal Kumar Ram Products: WP Social Stream Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Nirmal Kumar Ram WP Social Stream allows Stored XSS. This issue affects WP Social Stream: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-social-stream/vulnerability/wordpress-wp-social-stream-plugin-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25075 State: PUBLISHED Published: 2025-02-07T10:11:30.986Z Last Updated: 2025-02-07T15:02:05.668Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Venugopal Products: Show notice or message on admin area Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Show notice or message on admin area allows Stored XSS. This issue affects Show notice or message on admin area: from n/a through 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/show-notice-or-message-on-admin-area/vulnerability/wordpress-show-notice-or-message-on-admin-area-plug
/wordpress/plugin/show-notice-or-message-on-admin-area/vulnerability/wordpress-show-notice-or-message-on-admin-area-plugin-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25076 State: PUBLISHED Published: 2025-02-07T10:11:24.818Z Last Updated: 2025-02-07T15:56:49.303Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: nicholaswilson Products: Graceful Email Obfuscation Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicholaswilson Graceful Email Obfuscation allows Stored XSS. This issue affects Graceful Email Obfuscation: from n/a through 0.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/graceful-email-obfuscation/vulnerability/wordpress-graceful-email-ob
- https://patchstack.com/database/wordpress/plugin/graceful-email-obfuscation/vulnerability/wordpress-graceful-email-obfuscation-plugin-0-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25077 State: PUBLISHED Published: 2025-02-07T10:11:31.579Z Last Updated: 2025-02-07T15:01:30.259Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: dugbug Products: Easy Chart Builder for WordPress Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dugbug Easy Chart Builder for WordPress allows Stored XSS. This issue affects Easy Chart Builder for WordPress: from n/a through 1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/easy-chart-builder/vulnerability/wordpress-easy-chart-builder-for-wo
- https://patchstack.com/database/wordpress/plugin/easy-chart-builder/vulnerability/wordpress-easy-chart-builder-for-wordpress-plugin-1-3-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25078 State: PUBLISHED Published: 2025-02-07T10:11:30.377Z Last Updated: 2025-02-07T15:55:13.292Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Andrew Norcross Products: Google Earth Embed Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrew Norcross Google Earth Embed allows Stored XSS. This issue affects Google Earth Embed: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/google-earth-tours/vulnerability/wordpress-google-earth-embed-plugin-1-0-cross-site-scriptin
m/database/wordpress/plugin/google-earth-tours/vulnerability/wordpress-google-earth-embed-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25079 State: PUBLISHED Published: 2025-02-07T10:11:29.017Z Last Updated: 2025-02-07T15:56:23.279Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Garrett Grimm Products: Simple Select All Text Box Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Garrett Grimm Simple Select All Text Box allows Stored XSS. This issue affects Simple Select All Text Box: from n/a through 3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-select-all-text-box/vulnerability/wordpress-simple-select-all-tex
ttps://patchstack.com/database/wordpress/plugin/simple-select-all-text-box/vulnerability/wordpress-simple-select-all-text-box-plugin-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25080 State: PUBLISHED Published: 2025-02-07T10:11:32.264Z Last Updated: 2025-02-07T15:00:49.308Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: gubbigubbi Products: Kona Gallery Block Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gubbigubbi Kona Gallery Block allows Stored XSS. This issue affects Kona Gallery Block: from n/a through 1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/kona-instagram-feed-for-gutenberg/vulnerability/wordpress-kona-gallery-block-plugin-1-7-stored-cross-s
/wordpress/plugin/kona-instagram-feed-for-gutenberg/vulnerability/wordpress-kona-gallery-block-plugin-1-7-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25081 State: PUBLISHED Published: 2025-02-07T10:11:37.135Z Last Updated: 2025-02-07T15:00:15.793Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: DeannaS Products: Embed RSS Problem Types: CWE-862 Description: Missing Authorization vulnerability in DeannaS Embed RSS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Embed RSS: from n/a through 3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/embed-rss/vulnerability/wordpress-embed-rss-plugin-3-1-arbitrary-shortcode-execution-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-25082 State: PUBLISHED Published: 2025-02-07T10:11:27.013Z Last Updated: 2025-02-07T16:03:18.074Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Max Chirkov Products: FlexIDX Home Search Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max Chirkov FlexIDX Home Search allows Stored XSS. This issue affects FlexIDX Home Search: from n/a through 2.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/flexidx-home-search/vulnerability/wordpress-flexidx-home-search-plugin-2-1-2-stored-cross-site-
atabase/wordpress/plugin/flexidx-home-search/vulnerability/wordpress-flexidx-home-search-plugin-2-1-2-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25083 State: PUBLISHED Published: 2025-03-03T13:30:21.883Z Last Updated: 2025-03-03T17:37:47.563Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: EP4 More Embeds Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound EP4 More Embeds allows Stored XSS. This issue affects EP4 More Embeds: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ep4-more-embeds/vulnerability/wordpress-ep4-more-embeds-plugin-1-0-0-stored-cross-site-scripting-xss-vulnerability?
ugin/ep4-more-embeds/vulnerability/wordpress-ep4-more-embeds-plugin-1-0-0-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25084 State: PUBLISHED Published: 2025-03-03T13:30:22.023Z Last Updated: 2025-03-03T17:37:39.982Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: UniTimetable Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound UniTimetable allows Stored XSS. This issue affects UniTimetable: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/unitimetable/vulnerability/wordpress-unitimetable-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25085 State: PUBLISHED Published: 2025-02-07T10:11:34.106Z Last Updated: 2025-02-07T15:51:39.645Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: matt_mcbrien Products: WP SimpleWeather Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matt_mcbrien WP SimpleWeather allows Stored XSS. This issue affects WP SimpleWeather: from n/a through 0.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-simpleweather/vulnerability/wordpress-wp-simpleweather-plugin-0-2-5-cross-site-scripting-xss-vulner
/wordpress/plugin/wp-simpleweather/vulnerability/wordpress-wp-simpleweather-plugin-0-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25086 State: PUBLISHED Published: 2025-03-27T14:08:54.345Z Last Updated: 2025-03-27T15:45:04.126Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: WPDeveloper Products: Secret Meta Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WPDeveloper Secret Meta allows Reflected XSS.This issue affects Secret Meta: from n/a through 1.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/facebook-secret-meta/vulnerability/wordpress-secret-meta-plugin-1-2-1-csrf-to-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25087 State: PUBLISHED Published: 2025-03-03T13:30:22.176Z Last Updated: 2025-03-03T17:37:33.214Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: seekXL Snapr Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound seekXL Snapr allows Reflected XSS. This issue affects seekXL Snapr: from n/a through 2.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/seekxl-snapr/vulnerability/wordpress-seekxl-snapr-plugin-2-0-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-25088 State: PUBLISHED Published: 2025-02-07T10:11:39.065Z Last Updated: 2025-02-07T14:56:49.172Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: blackus3r Products: WP Keyword Monitor Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in blackus3r WP Keyword Monitor allows Stored XSS. This issue affects WP Keyword Monitor: from n/a through 1.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-keyword-monitor/vulnerability/wordpress-wp-keyword-monitor-plugin-1-0-5-csrf-to-stored-xss-vulnerability?_s_id=cve