Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-h45x-qhg2-q375 - https://github.com/AcademySoftwareFoundation/openexr/commit/916cc729e24aa16b86d82813f6e136340ab2876f - https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3
CVE ID: CVE-2025-48072 State: PUBLISHED Published: 2025-07-31T20:18:40.598Z Last Updated: 2025-07-31T20:37:21.287Z Vendors: AcademySoftwareFoundation Products: openexr Problem Types: CWE-125 Description: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk. This is fixed in version 3.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AcademySoftwareFoundation/openexr/security/
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-4r7w-q3jg-ff43 - https://github.com/AcademySoftwareFoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361 - https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3
CVE ID: CVE-2025-48073 State: PUBLISHED Published: 2025-07-31T20:25:51.545Z Last Updated: 2025-07-31T20:36:41.060Z Vendors: AcademySoftwareFoundation Products: openexr Problem Types: CWE-476 Description: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, when reading a deep scanline image with a large sample count in reduceMemory mode, it is possible to crash a target application with a NULL pointer dereference in a write operation. This is fixed in version 3.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AcademySoftwareFoundation/openexr/s
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-qhpm-86v7-phmm - https://github.com/ShielderSec/poc/tree/main/CVE-2025-48073
CVE ID: CVE-2025-48074 State: PUBLISHED Published: 2025-08-01T16:32:54.595Z Last Updated: 2025-08-01T17:09:00.696Z Vendors: AcademySoftwareFoundation Products: openexr Problem Types: CWE-770 Description: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. This is fixed in version 3.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AcademySoftwareFoundation/openexr/sec
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-x22w-82jp-8rvf - https://github.com/ShielderSec/poc/tree/main/CVE-2025-48074
CVE ID: CVE-2025-48075 State: PUBLISHED Published: 2025-05-22T17:25:18.447Z Last Updated: 2025-05-22T17:59:02.707Z Vendors: gofiber Products: fiber Problem Types: CWE-129 Description: Fiber is an Express-inspired web framework written in Go. Starting in version 2.52.6 and prior to version 2.52.7, `fiber.Ctx.BodyParser` can map flat data to nested slices using `key[idx]value` syntax, but when idx is negative, it causes a panic instead of returning an error stating it cannot process the data. Since this data is user-provided, this could lead to denial of service for anyone relying on this `fiber.Ctx.BodyParser` functionality. Version 2.52.7 fixes the issue. Additional Analyst Notes: - CISA ADP
lying on this `fiber.Ctx.BodyParser` functionality. Version 2.52.7 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gofiber/fiber/security/advisories/GHSA-hg3g-gphw-5hhm - https://github.com/gofiber/fiber/commit/e115c08b8f059a4a031b492aa9eef0712411853d
CVE ID: CVE-2025-48076 State: PUBLISHED Published: 2025-11-04T20:40:09.121Z Last Updated: 2025-11-04T21:04:06.991Z Vendors: galette Products: galette Problem Types: CWE-87 Description: Galette is a membership management web application for non profit organizations. Versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS payload. This issue is fixed in version 1.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/galette/galette/security/advisories/GHSA-ccwq-mxx3-chvh
CVE ID: CVE-2025-48077 State: PUBLISHED Published: 2025-11-06T15:53:36.642Z Last Updated: 2025-11-13T10:33:40.356Z Vendors: nitinmaurya12 Products: Block Country Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in nitinmaurya12 Block Country block-country allows Stored XSS.This issue affects Block Country: from n/a through <= 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/block-country/vulnerability/wordpress-block-country-plugin-1-0-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48078 State: PUBLISHED Published: 2025-11-06T15:53:37.443Z Last Updated: 2025-11-13T10:33:39.996Z Vendors: Norbert Products: Slick Google Map Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Norbert Slick Google Map slick-google-map allows Stored XSS.This issue affects Slick Google Map: from n/a through <= 0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/slick-google-map/vulnerability/wordpress-slick-google-map-plugin-0-3-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48079 State: PUBLISHED Published: 2025-05-16T15:45:05.014Z Last Updated: 2025-05-16T16:26:06.180Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Metagauss Products: ProfileGrid Problem Types: CWE-862 Description: Missing Authorization vulnerability in Metagauss ProfileGrid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ProfileGrid : from n/a through 5.9.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/profilegrid-user-profiles-groups-and-communities/vulnerability/wordpress-profilegrid-5-9-5-1-broken-access-control-vulnerability
rid-user-profiles-groups-and-communities/vulnerability/wordpress-profilegrid-5-9-5-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-48080 State: PUBLISHED Published: 2025-05-16T15:45:05.899Z Last Updated: 2025-05-16T16:25:51.962Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Uncanny Owl Products: Uncanny Toolkit for LearnDash Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash allows Stored XSS. This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.7.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/uncanny-learndash-toolkit/vulnerability/wordpress-uncanny-toolk
nces: - https://patchstack.com/database/wordpress/plugin/uncanny-learndash-toolkit/vulnerability/wordpress-uncanny-toolkit-for-learndash-3-7-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48081 State: PUBLISHED Published: 2025-08-27T05:03:53.571Z Last Updated: 2025-08-27T13:37:38.293Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Printeers Products: Printeers Print & Ship Problem Types: CWE-35 Description: Path Traversal: '.../...//' vulnerability in Printeers Printeers Print & Ship allows Path Traversal.This issue affects Printeers Print & Ship: from n/a through 1.17.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/invition-print-ship/vulnerability/wordpress-printeers-print-ship-plugin-1-17-0-directory-traversal-vulnerability?_s_id=cve
CVE ID: CVE-2025-48082 State: PUBLISHED Published: 2025-10-22T14:32:05.935Z Last Updated: 2025-11-13T10:33:40.380Z Vendors: Progress Planner Products: Progress Planner Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in Progress Planner Progress Planner progress-planner allows Privilege Escalation.This issue affects Progress Planner: from n/a through <= 1.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/progress-planner/vulnerability/wordpress-progress-planner-plugin-1-8-0-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-48083 State: PUBLISHED Published: 2025-11-06T15:53:40.546Z Last Updated: 2025-11-13T10:33:40.496Z Vendors: andriassundskard Products: wpNamedUsers Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in andriassundskard wpNamedUsers wpnamedusers allows Stored XSS.This issue affects wpNamedUsers: from n/a through <= 0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wpnamedusers/vulnerability/wordpress-wpnamedusers-plugin-0-5-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48085 State: PUBLISHED Published: 2025-11-06T15:53:41.777Z Last Updated: 2025-11-13T10:33:40.523Z Vendors: ZIPANG Products: Simple Stripe Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ZIPANG Simple Stripe simple-stripe allows Stored XSS.This issue affects Simple Stripe: from n/a through <= 0.9.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/simple-stripe/vulnerability/wordpress-simple-stripe-plugin-0-9-17-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48086 State: PUBLISHED Published: 2025-11-06T15:53:42.585Z Last Updated: 2025-11-13T10:33:40.258Z Vendors: wpdreams Products: Ajax Search Lite Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in wpdreams Ajax Search Lite ajax-search-lite allows Object Injection.This issue affects Ajax Search Lite: from n/a through <= 4.13.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/ajax-search-lite/vulnerability/wordpress-ajax-search-lite-plugin-4-13-3-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-48087 State: PUBLISHED Published: 2025-10-17T14:18:04.368Z Last Updated: 2025-10-17T14:37:36.727Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Jason C. Products: Memberlite Shortcodes Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason C. Memberlite Shortcodes memberlite-shortcodes allows Stored XSS.This issue affects Memberlite Shortcodes: from n/a through 1.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/WordPress/Plugin/memberlite-shortcodes/vulnerability/wordpress-memberlite-shortcodes-pl
ps://vdp.patchstack.com/database/WordPress/Plugin/memberlite-shortcodes/vulnerability/wordpress-memberlite-shortcodes-plugin-1-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48088 State: PUBLISHED Published: 2025-10-27T02:09:52.224Z Last Updated: 2025-10-28T16:03:09.945Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Brainstorm Force Products: Ultimate Addons for WPBakery Page Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder allows Stored XSS.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a before 3.21.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/WordPress/Plugin/ultimate_vc_addo
lyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/WordPress/Plugin/ultimate_vc_addons/vulnerability/wordpress-ultimate-addons-for-wpbakery-page-builder-plugin-3-21-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48089 State: PUBLISHED Published: 2025-11-06T15:53:43.152Z Last Updated: 2025-11-13T10:33:40.325Z Vendors: Rainbow-Themes Products: Education WordPress Theme | HiStudy Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rainbow-Themes Education WordPress Theme | HiStudy histudy allows SQL Injection.This issue affects Education WordPress Theme | HiStudy: from n/a through < 3.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/histudy/vulnerability/wordpress-education-wordpress-theme-histudy-theme-3-1-0-sql-injection-vulnera
base/Wordpress/Theme/histudy/vulnerability/wordpress-education-wordpress-theme-histudy-theme-3-1-0-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-48090 State: PUBLISHED Published: 2025-11-06T15:53:43.727Z Last Updated: 2025-11-13T10:33:40.489Z Vendors: CocoBasic Products: Blanka - One Page WordPress Theme Problem Types: CWE-35 Description: Path Traversal: '.../...//' vulnerability in CocoBasic Blanka - One Page WordPress Theme blanka-wp allows PHP Local File Inclusion.This issue affects Blanka - One Page WordPress Theme: from n/a through < 1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/blanka-wp/vulnerability/wordpress-blanka-one-page-wordpress-theme-theme-1-5-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-48091 State: PUBLISHED Published: 2025-10-22T14:32:06.134Z Last Updated: 2025-11-13T10:33:39.885Z Vendors: Alexander Products: AnyComment Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alexander AnyComment anycomment allows SQL Injection.This issue affects AnyComment: from n/a through <= 0.3.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/anycomment/vulnerability/wordpress-anycomment-plugin-0-3-6-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-48092 State: PUBLISHED Published: 2025-10-22T14:32:06.317Z Last Updated: 2025-11-13T10:33:40.476Z Vendors: jurajpuchky Products: Fix Multiple Redirects Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jurajpuchky Fix Multiple Redirects fix-multiple-redirects allows Reflected XSS.This issue affects Fix Multiple Redirects: from n/a through <= 1.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/fix-multiple-redirects/vulnerability/wordpress-fix-multiple-redirects-plugin-1-2-3-reflected-cross-site-scripting-xss-vulnerabi
tiple-redirects/vulnerability/wordpress-fix-multiple-redirects-plugin-1-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48093 State: PUBLISHED Published: 2025-10-22T14:32:06.499Z Last Updated: 2025-11-13T10:33:40.453Z Vendors: Calvaweb Products: Password only login Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Calvaweb Password only login password-only-login allows Reflected XSS.This issue affects Password only login: from n/a through <= 0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/password-only-login/vulnerability/wordpress-password-only-login-plugin-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48095 State: PUBLISHED Published: 2025-10-22T14:32:06.692Z Last Updated: 2025-11-13T10:33:40.343Z Vendors: Ays Pro Products: Survey Maker Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.1.8.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/survey-maker/vulnerability/wordpress-survey-maker-plugin-5-1-8-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48096 State: PUBLISHED Published: 2025-10-22T14:32:06.895Z Last Updated: 2025-11-13T10:33:39.994Z Vendors: FRESHFACE Products: Custom CSS Problem Types: CWE-862 Description: Missing Authorization vulnerability in FRESHFACE Custom CSS custom-css-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom CSS: from n/a through <= 1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/custom-css-editor/vulnerability/wordpress-custom-css-plugin-1-4-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-48097 State: PUBLISHED Published: 2025-10-22T14:32:07.078Z Last Updated: 2025-11-13T10:33:39.975Z Vendors: Shiva Products: WSAnalytics Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shiva WSAnalytics wsanalytics-google-analytics-and-dashboards allows Reflected XSS.This issue affects WSAnalytics: from n/a through <= 1.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wsanalytics-google-analytics-and-dashboards/vulnerability/wordpress-wsanalytics-plugin-1-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48098 State: PUBLISHED Published: 2025-10-22T14:32:07.268Z Last Updated: 2025-11-13T10:33:40.338Z Vendors: Ays Pro Products: Survey Maker Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.1.8.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/survey-maker/vulnerability/wordpress-survey-maker-plugin-5-1-8-8-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-48099 State: PUBLISHED Published: 2025-10-22T14:32:07.494Z Last Updated: 2025-11-13T10:33:40.467Z Vendors: Code Amp Products: Search & Filter Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Code Amp Search & Filter search-filter allows Cross Site Request Forgery.This issue affects Search & Filter: from n/a through <= 1.2.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/search-filter/vulnerability/wordpress-search-filter-plugin-1-2-17-cross-site-request-forgery-csrf-to-open-redirect-vulnerability?_s_id=cve
CVE ID: CVE-2025-48100 State: PUBLISHED Published: 2025-08-28T12:36:45.662Z Last Updated: 2025-08-28T14:47:58.805Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: extremeidea Products: bidorbuy Store Integrator Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in extremeidea bidorbuy Store Integrator allows Remote Code Inclusion. This issue affects bidorbuy Store Integrator: from n/a through 2.12.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bidorbuystoreintegrator/vulnerability/wordpress-bidorbuy-store-integrator-plugin-2-10-0-re
com/database/wordpress/plugin/bidorbuystoreintegrator/vulnerability/wordpress-bidorbuy-store-integrator-plugin-2-10-0-remote-code-execution-rce-vulnerability?_s_id=cve
CVE ID: CVE-2025-48101 State: PUBLISHED Published: 2025-09-09T16:26:04.152Z Last Updated: 2025-09-09T18:40:17.509Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: webdevstudios Products: Constant Contact for WordPress Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress allows Object Injection. This issue affects Constant Contact for WordPress: from n/a through 4.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/constant-contact-api/vulnerability/wordpress-constant-contact-for-wordpress-plugin-4-1-1-php-object-inje
ordpress/plugin/constant-contact-api/vulnerability/wordpress-constant-contact-for-wordpress-plugin-4-1-1-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-48102 State: PUBLISHED Published: 2025-09-05T16:15:43.514Z Last Updated: 2025-09-05T19:52:40.004Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: gourl Products: GoUrl Bitcoin Payment Gateway &amp; Paid Downloads &amp; Membership Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gourl GoUrl Bitcoin Payment Gateway &amp; Paid Downloads &amp; Membership allows Stored XSS. This issue affects GoUrl Bitcoin Payment Gateway &amp; Paid Downloads &amp; Membership: from n/a through 1.6.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patc
&amp; Membership: from n/a through 1.6.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gourl-bitcoin-payment-gateway-paid-downloads-membership/vulnerability/wordpress-gourl-bitcoin-payment-gateway-paid-downloads-membership-plugin-1-6-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48103 State: PUBLISHED Published: 2025-09-05T16:15:42.975Z Last Updated: 2025-09-09T13:42:40.724Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: mulscully Products: Today&#039;s Date Inserter Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mulscully Today&#039;s Date Inserter allows Stored XSS. This issue affects Today&#039;s Date Inserter: from n/a through 1.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/todays-date-inserter/vulnerability/wordpress-today-s-date-inserter-plugin-1-2-
/patchstack.com/database/wordpress/plugin/todays-date-inserter/vulnerability/wordpress-today-s-date-inserter-plugin-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48104 State: PUBLISHED Published: 2025-09-05T16:15:42.454Z Last Updated: 2025-09-09T13:43:28.247Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: ericzane Products: Floating Window Music Player Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ericzane Floating Window Music Player allows Stored XSS. This issue affects Floating Window Music Player: from n/a through 3.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/floating-window-music-player/vulnerability/wordpress-floating-window-music-player-plugin-3-4-2-cross-site-request-forgery-csrf
ng-window-music-player/vulnerability/wordpress-floating-window-music-player-plugin-3-4-2-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve