Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-48268 State: PUBLISHED Published: 2025-05-19T14:45:24.051Z Last Updated: 2025-05-19T15:17:25.680Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Guru Team Products: Bot for Telegram on WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in Guru Team Bot for Telegram on WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Bot for Telegram on WooCommerce: from n/a through 1.2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bot-for-telegram-on-woocommerce/vulnerability/wordpress-bot-for-telegra
https://patchstack.com/database/wordpress/plugin/bot-for-telegram-on-woocommerce/vulnerability/wordpress-bot-for-telegram-on-woocommerce-1-2-6-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-48269 State: PUBLISHED Published: 2025-05-19T14:45:24.544Z Last Updated: 2025-05-19T15:17:19.468Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Greg Winiarski Products: WPAdverts Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts allows DOM-Based XSS. This issue affects WPAdverts: from n/a through 2.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpadverts/vulnerability/wordpress-wpadverts-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48270 State: PUBLISHED Published: 2025-05-19T14:45:25.014Z Last Updated: 2025-05-19T15:17:12.211Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: sonalsinha21 Products: SKT Blocks Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks allows DOM-Based XSS. This issue affects SKT Blocks: from n/a through 2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/skt-blocks/vulnerability/wordpress-skt-blocks-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48271 State: PUBLISHED Published: 2025-05-23T12:43:16.869Z Last Updated: 2025-05-27T14:32:04.855Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Leadinfo Products: Leadinfo Problem Types: CWE-862 Description: Missing Authorization vulnerability in Leadinfo Leadinfo allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Leadinfo: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/leadinfo/vulnerability/wordpress-leadinfo-1-1-settings-change-vulnerability?_s_id=cve
CVE ID: CVE-2025-48272 State: PUBLISHED Published: 2025-05-19T14:45:25.486Z Last Updated: 2025-05-19T15:17:00.918Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: wpjobportal Products: WP Job Portal Problem Types: CWE-862 Description: Missing Authorization vulnerability in wpjobportal WP Job Portal allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Job Portal: from n/a through 2.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-2-3-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE ID: CVE-2025-48273 State: PUBLISHED Published: 2025-05-23T12:43:16.413Z Last Updated: 2025-05-27T14:36:01.416Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: wpjobportal Products: WP Job Portal Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpjobportal WP Job Portal allows Path Traversal. This issue affects WP Job Portal: from n/a through 2.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-2-3-2-arbitrary-file-download-vulnerability?_s_id=cve
CVE ID: CVE-2025-48274 State: PUBLISHED Published: 2025-06-17T15:01:31.321Z Last Updated: 2025-06-17T18:37:55.642Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: wpjobportal Products: WP Job Portal Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpjobportal WP Job Portal allows Blind SQL Injection. This issue affects WP Job Portal: from n/a through 2.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-2-3-2-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-48275 State: PUBLISHED Published: 2025-05-23T12:43:15.964Z Last Updated: 2025-05-27T14:36:22.536Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: dastan800 Products: Visual Header Problem Types: CWE-862 Description: Missing Authorization vulnerability in dastan800 Visual Header allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Visual Header: from n/a through 1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/visual-header/vulnerability/wordpress-visual-header-1-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-48276 State: PUBLISHED Published: 2025-05-19T14:45:25.944Z Last Updated: 2025-05-19T15:16:52.320Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Visual Composer Products: Visual Composer Website Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder allows Stored XSS. This issue affects Visual Composer Website Builder: from n/a through 45.11.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/visualcomposer/vulnerability/wordpress-visual-com
chment: References: - https://patchstack.com/database/wordpress/plugin/visualcomposer/vulnerability/wordpress-visual-composer-website-builder-45-11-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48277 State: PUBLISHED Published: 2025-05-19T14:45:26.444Z Last Updated: 2025-05-19T15:16:45.788Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Stylemix Products: Cost Calculator Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stylemix Cost Calculator Builder allows Stored XSS. This issue affects Cost Calculator Builder: from n/a through 3.2.74. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cost-calculator-builder/vulnerability/wordpress-cost-calculator-builder-3-2-74-cross-sit
k.com/database/wordpress/plugin/cost-calculator-builder/vulnerability/wordpress-cost-calculator-builder-3-2-74-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48278 State: PUBLISHED Published: 2025-05-19T14:45:26.912Z Last Updated: 2025-05-19T15:16:36.067Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: davidfcarr Products: RSVPMarker Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in davidfcarr RSVPMarker allows SQL Injection. This issue affects RSVPMarker : from n/a through 11.5.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/rsvpmaker/vulnerability/wordpress-rsvpmarker-11-5-6-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-48279 State: PUBLISHED Published: 2025-06-09T15:53:54.808Z Last Updated: 2025-06-09T19:46:23.467Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Richard Perdaan Products: WC MyParcel Belgium Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Perdaan WC MyParcel Belgium allows Reflected XSS. This issue affects WC MyParcel Belgium: from 4.5.5 through beta. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wc-myparcel-belgium/vulnerability/wordpress-wc-myparcel-belgium-plugin-4-5-5-beta-ref
tack.com/database/wordpress/plugin/wc-myparcel-belgium/vulnerability/wordpress-wc-myparcel-belgium-plugin-4-5-5-beta-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48280 State: PUBLISHED Published: 2025-05-19T14:45:27.384Z Last Updated: 2025-05-19T15:16:26.951Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Ruben Garcia Products: AutomatorWP Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia AutomatorWP allows Blind SQL Injection. This issue affects AutomatorWP: from n/a through 5.2.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/automatorwp/vulnerability/wordpress-automatorwp-5-2-1-3-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-48281 State: PUBLISHED Published: 2025-06-09T15:53:53.912Z Last Updated: 2025-06-09T17:23:37.812Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: mystyleplatform Products: MyStyle Custom Product Designer Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mystyleplatform MyStyle Custom Product Designer allows Blind SQL Injection. This issue affects MyStyle Custom Product Designer: from n/a through 3.21.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mystyle-custom-product-designer/vulnera
ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mystyle-custom-product-designer/vulnerability/wordpress-mystyle-custom-product-designer-3-21-1-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-48282 State: PUBLISHED Published: 2025-05-19T14:45:27.844Z Last Updated: 2025-05-19T15:16:17.817Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Majestic Support Products: Majestic Support Problem Types: CWE-862 Description: Missing Authorization vulnerability in Majestic Support Majestic Support allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Majestic Support: from n/a through 1.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/majestic-support/vulnerability/wordpress-majestic-support-1-1-0-broken-access-control-vulnerability?_s
/wordpress/plugin/majestic-support/vulnerability/wordpress-majestic-support-1-1-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-48283 State: PUBLISHED Published: 2025-05-23T12:43:15.502Z Last Updated: 2025-05-27T14:36:45.002Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: Majestic Support Products: Majestic Support Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Majestic Support Majestic Support allows SQL Injection. This issue affects Majestic Support: from n/a through 1.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/majestic-support/vulnerability/wordpress-majestic-support-1-1-0-sql-injection-vulnerabili
.com/database/wordpress/plugin/majestic-support/vulnerability/wordpress-majestic-support-1-1-0-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-48284 State: PUBLISHED Published: 2025-05-19T14:45:28.326Z Last Updated: 2025-05-19T15:16:10.892Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: shohei.tanaka Products: Japanized For WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in shohei.tanaka Japanized For WooCommerce allows Cross Site Request Forgery. This issue affects Japanized For WooCommerce: from n/a through 2.6.40. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woocommerce-for-japan/vulnerability/wordpress-japanized-for-woocommerce-2-6-40-cross-site-request-forgery-
dpress/plugin/woocommerce-for-japan/vulnerability/wordpress-japanized-for-woocommerce-2-6-40-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-48285 State: PUBLISHED Published: 2025-05-19T14:45:28.812Z Last Updated: 2025-05-19T15:16:01.018Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: sbouey Products: Falang multilanguage Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in sbouey Falang multilanguage allows Cross Site Request Forgery. This issue affects Falang multilanguage: from n/a through 1.3.61. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/falang/vulnerability/wordpress-falang-multilanguage-1-3-61-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-48286 State: PUBLISHED Published: 2025-05-23T12:43:15.038Z Last Updated: 2025-05-27T14:37:11.990Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: catkin Products: ReDi Restaurant Reservation Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catkin ReDi Restaurant Reservation allows Reflected XSS. This issue affects ReDi Restaurant Reservation: from n/a through 24.1209. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/redi-restaurant-reservation/vulnerability/wordpress-redi-restaurant-reservatio
/patchstack.com/database/wordpress/plugin/redi-restaurant-reservation/vulnerability/wordpress-redi-restaurant-reservation-plugin-24-1209-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48287 State: PUBLISHED Published: 2025-05-23T12:43:14.537Z Last Updated: 2025-05-23T14:53:31.809Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Pagaleve Products: Pix 4x sem juros - Pagaleve Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Pagaleve Pix 4x sem juros - Pagaleve allows Object Injection.This issue affects Pix 4x sem juros - Pagaleve: from n/a through 1.6.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wc-pagaleve/vulnerability/wordpress-pix-4x-sem-juros-pagaleve-1-6-9-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-48288 State: PUBLISHED Published: 2025-05-19T14:45:29.272Z Last Updated: 2025-05-19T15:15:54.013Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Element Invader Products: ElementInvader Addons for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor allows Stored XSS. This issue affects ElementInvader Addons for Elementor: from n/a through 1.3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/elementinvader-addons-for-elementor/vul
ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/elementinvader-addons-for-elementor/vulnerability/wordpress-elementinvader-addons-for-elementor-1-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48289 State: PUBLISHED Published: 2025-05-23T12:43:14.067Z Last Updated: 2025-05-23T15:26:13.714Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: AncoraThemes Products: Kids Planet Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in AncoraThemes Kids Planet allows Object Injection. This issue affects Kids Planet: from n/a through 2.2.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/kidsplanet/vulnerability/wordpress-kids-planet-2-2-14-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-48290 State: PUBLISHED Published: 2025-11-06T15:53:47.362Z Last Updated: 2025-11-13T10:33:39.924Z Vendors: bslthemes Products: Kinsley Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in bslthemes Kinsley kinsley allows PHP Local File Inclusion.This issue affects Kinsley: from n/a through <= 3.4.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/kinsley/vulnerability/wordpress-kinsley-theme-3-4-4-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-48291 State: PUBLISHED Published: 2025-07-16T11:28:02.305Z Last Updated: 2025-07-16T14:08:07.461Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Wasiliy Strecker / ContestGallery developer Products: Contest Gallery Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery allows Stored XSS. This issue affects Contest Gallery: from n/a through 26.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/contest-gallery/vulnerability/wordpress-cont
ulnrichment: References: - https://patchstack.com/database/wordpress/plugin/contest-gallery/vulnerability/wordpress-contest-gallery-26-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48292 State: PUBLISHED Published: 2025-05-23T12:43:13.593Z Last Updated: 2025-05-23T15:26:34.141Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: GoodLayers Products: Tourmaster Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in GoodLayers Tourmaster allows PHP Local File Inclusion. This issue affects Tourmaster: from n/a through 5.3.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/tourmaster/vulnerability/wordpress-tourmaster-plugin-5-3-8-local-file-inclusion-vulnerability
/database/wordpress/plugin/tourmaster/vulnerability/wordpress-tourmaster-plugin-5-3-8-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-48293 State: PUBLISHED Published: 2025-08-14T10:34:23.777Z Last Updated: 2025-08-14T14:42:46.371Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dylan Kuhn Products: Geo Mashup Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dylan Kuhn Geo Mashup allows PHP Local File Inclusion. This issue affects Geo Mashup: from n/a through 1.13.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/geo-mashup/vulnerability/wordpress-geo-mashup-plugin-1-13-16-local-file-inclusion-vulne
ck.com/database/wordpress/plugin/geo-mashup/vulnerability/wordpress-geo-mashup-plugin-1-13-16-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-48294 State: PUBLISHED Published: 2025-07-16T10:36:54.686Z Last Updated: 2025-07-16T14:32:00.813Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Kerfred Products: FG Drupal to WordPress Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Kerfred FG Drupal to WordPress allows Server Side Request Forgery. This issue affects FG Drupal to WordPress: from n/a through 3.90.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/fg-drupal-to-wp/vulnerability/wordpress-fg-drupal-to-wordpress-plugin-3-90-0-server-side-request-forgery-ssrf-vulnerability?_
upal-to-wp/vulnerability/wordpress-fg-drupal-to-wordpress-plugin-3-90-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-48295 State: PUBLISHED Published: 2025-07-16T10:36:54.182Z Last Updated: 2025-07-16T20:17:20.198Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: hashthemes Products: Easy Elementor Addons Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons allows Stored XSS. This issue affects Easy Elementor Addons: from n/a through 2.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/easy-elementor-addons/vulnerability/wordpress-easy-elementor-addons-plugin-2-2-5-cross-site
om/database/wordpress/plugin/easy-elementor-addons/vulnerability/wordpress-easy-elementor-addons-plugin-2-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48296 State: PUBLISHED Published: 2025-08-20T08:03:25.030Z Last Updated: 2025-08-20T17:42:56.739Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: skygroup Products: UpStore Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup UpStore allows Reflected XSS. This issue affects UpStore: from n/a through 1.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/upstore/vulnerability/wordpress-upstore-1-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48297 State: PUBLISHED Published: 2025-08-20T08:03:24.518Z Last Updated: 2025-08-20T17:43:32.792Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: quantumcloud Products: Simple Link Directory Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quantumcloud Simple Link Directory allows Reflected XSS. This issue affects Simple Link Directory: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/qc-simple-link-directory/vulnerability/wordpress-simple-link-directory-14-8-1-cross-site
k.com/database/wordpress/plugin/qc-simple-link-directory/vulnerability/wordpress-simple-link-directory-14-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48298 State: PUBLISHED Published: 2025-08-20T08:03:23.991Z Last Updated: 2025-08-20T17:43:55.083Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Benjamin Denis Products: SEOPress for MainWP Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Benjamin Denis SEOPress for MainWP allows PHP Local File Inclusion. This issue affects SEOPress for MainWP: from n/a through 1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/seopress-for-mainwp/vulnerability/wordpress-seopress-for-mai
erences: - https://patchstack.com/database/wordpress/plugin/seopress-for-mainwp/vulnerability/wordpress-seopress-for-mainwp-1-4-local-file-inclusion-vulnerability?_s_id=cve