Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
for multiple transactions. Only the first transaction is processed via Stripe, but the plugin sends a successful email message for each transaction, which may trick an administrator into fulfilling each order. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/38257dbf-288e-4028-af65-85f5389888ac?source=cve - https://plugins.trac.wordpress.org/browser/contact-form-7/tags/6.0.5/modules/stripe/stripe.php#L114 - https://plugins.trac.wordpress.org/changeset/3270138/
CVE ID: CVE-2025-3248 State: PUBLISHED Published: 2025-04-07T14:22:38.980Z Last Updated: 2025-11-04T22:33:33.254Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: langflow-ai Products: langflow Problem Types: CWE-306 Description: Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/langflow-ai/langflow/pull/6911 - https://github.com/langflow-ai/langflow/releases/tag/1.3.0 - https://www.horizon3.ai/attack-research/disclosures/uns
1 - https://github.com/langflow-ai/langflow/releases/tag/1.3.0 - https://www.horizon3.ai/attack-research/disclosures/unsafe-at-any-speed-abusing-python-exec-for-unauth-rce-in-langflow-ai/ - https://www.vulncheck.com/advisories/langflow-unauthenticated-rce
CVE ID: CVE-2025-3249 State: PUBLISHED Published: 2025-04-04T14:00:15.508Z Last Updated: 2025-04-04T14:29:11.138Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TOTOLINK Products: A6000R Problem Types: CWE-77, CWE-74 Description: A vulnerability classified as critical was found in TOTOLINK A6000R 1.0.1-B20201211.2000. Affected by this vulnerability is the function apcli_cancel_wps of the file /usr/lib/lua/luci/controller/mtkwifi.lua. The manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303319 - https://
nd may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303319 - https://vuldb.com/?ctiid.303319 - https://vuldb.com/?submit.543214 - https://github.com/fjl1113/cve/blob/main/totolink.md - https://www.totolink.net/
CVE ID: CVE-2025-3250 State: PUBLISHED Published: 2025-04-04T15:00:15.814Z Last Updated: 2025-04-04T15:25:44.432Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: elunez Products: eladmin Problem Types: CWE-502, CWE-20 Description: A vulnerability, which was classified as problematic, has been found in elunez eladmin 2.7. Affected by this issue is some unknown functionality of the file /api/database/testConnect of the component Maintenance Management Module. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303320 - https://vuldb.com/?ctiid.303320 - https://vuldb.com/?submit.546132 - https://www.yuque.com/u520611/giuhru/vfvchim8sphv2y1g?singleDoc
CVE ID: CVE-2025-3251 State: PUBLISHED Published: 2025-04-04T15:00:17.679Z Last Updated: 2025-04-04T15:21:05.290Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: xujiangfei Products: admintwo Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in xujiangfei admintwo 1.0. This affects an unknown part of the file /user/updateSet. The manipulation of the argument motto leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303321 - https://vuldb.com/?ctiid.303
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303321 - https://vuldb.com/?ctiid.303321 - https://vuldb.com/?submit.548971 - https://github.com/caigo8/CVE-md/blob/main/admintwo/XSS1.md
CVE ID: CVE-2025-3252 State: PUBLISHED Published: 2025-04-04T15:31:04.132Z Last Updated: 2025-04-04T19:49:35.454Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: xujiangfei Products: admintwo Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in xujiangfei admintwo 1.0 and classified as problematic. This vulnerability affects unknown code of the file /resource/add. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303322 - https://vuldb.com/?ctiid.303322 -
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303322 - https://vuldb.com/?ctiid.303322 - https://vuldb.com/?submit.548976 - https://github.com/caigo8/CVE-md/blob/main/admintwo/XSS2.md
CVE ID: CVE-2025-3253 State: PUBLISHED Published: 2025-04-04T15:31:05.615Z Last Updated: 2025-04-04T19:48:44.077Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: xujiangfei Products: admintwo Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in xujiangfei admintwo 1.0 and classified as problematic. This issue affects some unknown processing of the file /ztree/insertTree. The manipulation of the argument Name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303323 - https://vuldb.com/?ctiid.303323
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303323 - https://vuldb.com/?ctiid.303323 - https://vuldb.com/?submit.548978 - https://github.com/caigo8/CVE-md/blob/main/admintwo/XSS3.md
CVE ID: CVE-2025-3254 State: PUBLISHED Published: 2025-04-04T16:00:15.857Z Last Updated: 2025-04-04T19:58:40.007Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: xujiangfei Products: admintwo Problem Types: CWE-918 Description: A vulnerability was found in xujiangfei admintwo 1.0. It has been classified as critical. Affected is an unknown function of the file /resource/add. The manipulation of the argument description leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303324 - https://vuldb.com/?ctii
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303324 - https://vuldb.com/?ctiid.303324 - https://vuldb.com/?submit.548979 - https://github.com/caigo8/CVE-md/blob/main/admintwo/SSRF.md
CVE ID: CVE-2025-3255 State: PUBLISHED Published: 2025-04-04T16:00:17.488Z Last Updated: 2025-04-04T17:39:56.281Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: xujiangfei Products: admintwo Problem Types: CWE-284, CWE-266 Description: A vulnerability was found in xujiangfei admintwo 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /user/home. The manipulation of the argument ID leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?i
sed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303325 - https://vuldb.com/?ctiid.303325 - https://vuldb.com/?submit.548986 - https://github.com/caigo8/CVE-md/blob/main/admintwo/%E6%9C%AA%E6%8E%88%E6%9D%83%E7%94%A8%E6%88%B7%E4%BF%A1%E6%81%AF%E9%81%8D%E5%8E%86.md
CVE ID: CVE-2025-3256 State: PUBLISHED Published: 2025-04-04T16:31:04.634Z Last Updated: 2025-04-04T17:38:21.094Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: xujiangfei Products: admintwo Problem Types: CWE-284, CWE-266 Description: A vulnerability was found in xujiangfei admintwo 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /user/updateSet. The manipulation of the argument email leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303326 - https://vuldb.
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303326 - https://vuldb.com/?ctiid.303326 - https://vuldb.com/?submit.549009 - https://github.com/caigo8/CVE-md/blob/main/admintwo/%E6%B0%B4%E5%B9%B3%E8%B6%8A%E6%9D%83.md
CVE ID: CVE-2025-3257 State: PUBLISHED Published: 2025-04-04T16:31:06.180Z Last Updated: 2025-04-04T17:36:16.101Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: xujiangfei Products: admintwo Problem Types: CWE-352, CWE-862 Description: A vulnerability classified as problematic has been found in xujiangfei admintwo 1.0. This affects an unknown part of the file /user/updateSet. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303327 - https://vuldb.com/?ctiid.303327 - https://vuldb.c
- CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303327 - https://vuldb.com/?ctiid.303327 - https://vuldb.com/?submit.549011 - https://github.com/caigo8/CVE-md/blob/main/admintwo/CSRF.md
CVE ID: CVE-2025-3258 State: PUBLISHED Published: 2025-04-04T17:00:09.893Z Last Updated: 2025-04-04T17:34:31.111Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Old Age Home Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in PHPGurukul Old Age Home Management System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303328 - ht
blic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303328 - https://vuldb.com/?ctiid.303328 - https://vuldb.com/?submit.549186 - https://github.com/404heihei/CVE/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-3259 State: PUBLISHED Published: 2025-04-04T17:31:06.694Z Last Updated: 2025-04-04T18:55:17.132Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: RX3 Problem Types: CWE-121, CWE-119 Description: A vulnerability, which was classified as critical, has been found in Tenda RX3 16.03.13.11. This issue affects the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303329 - https:/
and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303329 - https://vuldb.com/?ctiid.303329 - https://vuldb.com/?submit.549199 - https://sixth-action-50e.notion.site/Tenda-RX3-Buffer-Overflow-1c9f6468377380a2977cd6c3a81f453c?pvs=4 - https://www.tenda.com.cn/
CVE ID: CVE-2025-3260 State: PUBLISHED Published: 2025-06-02T10:06:39.039Z Last Updated: 2025-06-02T12:14:34.036Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: Grafana Products: Grafana Problem Types: CWE-863 Description: A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1). Impact: - Viewers can view all dashboards/folders regardless of permissions - Editors can view/edit/delete all dashboards/folders regardless of permissions - Editors can create dashboards in any folder regardless of permission
all dashboards/folders regardless of permissions - Editors can create dashboards in any folder regardless of permissions - Anonymous users with viewer/editor roles are similarly affected Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://grafana.com/security/security-advisories/CVE-2025-3260/
CVE ID: CVE-2025-3262 State: PUBLISHED Published: 2025-07-07T09:54:39.079Z Last Updated: 2025-07-07T15:19:42.413Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: huggingface Products: huggingface/transformers Problem Types: CWE-1333 Description: A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing
The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings. The issue is fixed in version 4.51.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/ecf5ccc4-39e7-4fb3-b547-14a41d31a184 - https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76
CVE ID: CVE-2025-3263 State: PUBLISHED Published: 2025-07-07T09:54:59.670Z Last Updated: 2025-07-07T14:51:54.953Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: huggingface Products: huggingface/transformers Problem Types: CWE-1333 Description: A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_configuration_file()` function within the `transformers.configuration_utils` module. The affected version is 4.49.0, and the issue is resolved in version 4.51.0. The vulnerability arises from the use of a regular expression pattern `config\.(.*)\.json` that can be exploited to
1.0. The vulnerability arises from the use of a regular expression pattern `config\.(.*)\.json` that can be exploited to cause excessive CPU consumption through crafted input strings, leading to catastrophic backtracking. This can result in model serving disruption, resource exhaustion, and increased latency in applications using the library. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/c7a69150-54f8-4e81-8094-791e7a2a0f29 - https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76
CVE ID: CVE-2025-3264 State: PUBLISHED Published: 2025-07-07T09:55:11.030Z Last Updated: 2025-07-07T14:40:12.531Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: huggingface Products: huggingface/transformers Problem Types: CWE-1333 Description: A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_imports()` function within `dynamic_module_utils.py`. This vulnerability affects versions 4.49.0 and is fixed in version 4.51.0. The issue arises from a regular expression pattern `\s*try\s*:.*?except.*?:` used to filter out try/except blocks from Python code, which can be exp
lar expression pattern `\s*try\s*:.*?except.*?:` used to filter out try/except blocks from Python code, which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to remote code loading disruption, resource exhaustion in model serving, supply chain attack vectors, and development pipeline disruption. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/3c6f7822-9992-476d-8cf0-b0b1623427df - https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76
CVE ID: CVE-2025-3265 State: PUBLISHED Published: 2025-04-04T19:31:06.110Z Last Updated: 2025-04-04T19:48:08.154Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: e-Diary Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in PHPGurukul e-Diary Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /add-category.php. The manipulation of the argument Category leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id
ed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303337 - https://vuldb.com/?ctiid.303337 - https://vuldb.com/?submit.549212 - https://github.com/yasuoz99/CVE-/issues/2 - https://phpgurukul.com/
CVE ID: CVE-2025-3266 State: PUBLISHED Published: 2025-04-04T19:31:07.959Z Last Updated: 2025-04-04T19:47:11.477Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: qinguoyi Products: TinyWebServer Problem Types: CWE-121, CWE-119 Description: A vulnerability, which was classified as critical, has been found in qinguoyi TinyWebServer up to 1.0. Affected by this issue is some unknown functionality of the file /http/http_conn.cpp. The manipulation of the argument name/password leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://v
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303338 - https://vuldb.com/?ctiid.303338 - https://vuldb.com/?submit.549227 - https://magnificent-dill-351.notion.site/Stack-Overflow-in-TinyWebServer-1-0-1c9c693918ed80229bbce911b3513054
CVE ID: CVE-2025-3267 State: PUBLISHED Published: 2025-04-04T20:00:09.305Z Last Updated: 2025-04-04T20:28:42.495Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: qinguoyi Products: TinyWebServer Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in qinguoyi TinyWebServer up to 1.0. This affects an unknown part of the file /http/http_conn.cpp. The manipulation of the argument name/password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303339 - https://vuld
ay be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303339 - https://vuldb.com/?ctiid.303339 - https://vuldb.com/?submit.549228 - https://magnificent-dill-351.notion.site/SQL-Injection-in-TinyWebServer-1-0-1c9c693918ed800ba172f55997565735
CVE ID: CVE-2025-3268 State: PUBLISHED Published: 2025-04-04T21:00:14.220Z Last Updated: 2025-04-07T16:07:39.864Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: qinguoyi Products: TinyWebServer Problem Types: CWE-287 Description: A vulnerability has been found in qinguoyi TinyWebServer up to 1.0 and classified as critical. This vulnerability affects unknown code of the file http/http_conn.cpp. The manipulation of the argument m_url_real leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303
o the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303340 - https://vuldb.com/?ctiid.303340 - https://vuldb.com/?submit.549229 - https://magnificent-dill-351.notion.site/Improper-Authentication-in-TinyWebServer-1-0-1c9c693918ed80cfa0f5db1a1d03c5e7
CVE ID: CVE-2025-3269 State: REJECTED Published: N/A Last Updated: 2025-04-30T17:09:34.491Z Description: No description available.
CVE ID: CVE-2025-3272 State: PUBLISHED Published: 2025-05-07T18:42:19.512Z Last Updated: 2025-05-07T20:06:49.809Z Vendors: OpenText™ Products: Operations Bridge Manager Problem Types: CWE-863 Description: Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager. The vulnerability could allow authenticated users to change their password without providing their old password. This issue affects Operations Bridge Manager: 24.2, 24.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://portal.microfocus.com/s/article/KM000040405
CVE ID: CVE-2025-3275 State: PUBLISHED Published: 2025-04-19T03:21:24.199Z Last Updated: 2025-04-21T02:42:38.236Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themesflat Products: Themesflat Addons For Elementor Problem Types: CWE-79 Description: The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slider widget in all versions up to, and including, 2.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inj
butor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4ec73a61-9ae2-4e6f-b1fa-2d61f27d6809?source=cve - https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/assets/js/tf-flexslider.js - https://plugins.trac.wordpress.org/changeset/3268183/themesflat-addons-for-elementor/tags/2.2.2/assets/js/tf-flexslider.js
CVE ID: CVE-2025-3276 State: PUBLISHED Published: 2025-04-12T06:37:18.853Z Last Updated: 2025-04-14T16:19:09.135Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sonalsinha21 Products: SKT Blocks – Gutenberg based Page Builder Problem Types: CWE-79 Description: The SKT Blocks – Gutenberg based Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Carousel block in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a
ttackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d9345eaa-c8c0-4830-a9af-48305a2f80fd?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3267889%40skt-blocks&new=3267889%40skt-blocks&sfp_email=&sfph_mail=