Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-1475 State: PUBLISHED Published: 2025-03-07T06:40:02.364Z Last Updated: 2025-03-07T16:23:50.830Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: whyun Products: WPCOM Member Problem Types: CWE-287 Description: The WPCOM Member plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.5. This is due to insufficient verification on the 'user_phone' parameter when logging in. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if SMS login is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wo
administrator, if SMS login is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/05178bf3-3040-41aa-ba43-779376d30298?source=cve - https://plugins.trac.wordpress.org/browser/wpcom-member/tags/1.7.1/includes/form-validation.php#L110 - https://plugins.trac.wordpress.org/changeset/3248208/
CVE ID: CVE-2025-1477 State: PUBLISHED Published: 2025-08-13T17:27:25.496Z Last Updated: 2025-08-13T20:01:32.448Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 8.14 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed an unauthenticated user to create a denial of service condition by sending specially crafted payloads to specific integration API endpoints. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/520353 - https://hackerone.com/r
s: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/520353 - https://hackerone.com/reports/2987614
CVE ID: CVE-2025-1478 State: PUBLISHED Published: 2025-06-12T10:02:49.998Z Last Updated: 2025-06-12T13:30:42.186Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input validation in Board Names could be used to trigger a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/520354 - https://hackerone.com/reports/2987444
CVE ID: CVE-2025-1479 State: PUBLISHED Published: 2025-05-30T19:13:47.411Z Last Updated: 2025-06-03T03:55:11.428Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Lenovo Products: Legion Space for Legion Go, Legion Space for Legion PC Problem Types: CWE-489 Description: An open debug interface was reported in the Legion Space software included on certain Legion devices that could allow a local attacker to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-186929
CVE ID: CVE-2025-1481 State: PUBLISHED Published: 2025-03-08T02:24:01.278Z Last Updated: 2025-03-10T16:05:52.276Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: mandooox Products: Shortcode Cleaner Lite Problem Types: CWE-862 Description: The Shortcode Cleaner Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_backup() function in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export arbitrary options. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-i
t arbitrary options. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/15613da5-f900-4a33-8eec-6c9e52ed30fc?source=cve - https://wordpress.org/plugins/shortcode-cleaner-lite/#developers - https://plugins.trac.wordpress.org/browser/shortcode-cleaner-lite/trunk/vendor/codestar/codestar/core/Module/Export.php#L53
CVE ID: CVE-2025-1483 State: PUBLISHED Published: 2025-02-20T09:21:35.504Z Last Updated: 2025-02-20T14:29:19.702Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: enituretechnology Products: LTL Freight Quotes – GlobalTranz Edition Problem Types: CWE-862 Description: The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the engtz_wd_save_dropship AJAX endpoint in all versions up to, and including, 2.3.12. This makes it possible for unauthenticated attackers to update the drop shipping settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
ated attackers to update the drop shipping settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0906e9b0-5093-4ddd-8868-8fcaad8e3a5b?source=cve - https://plugins.trac.wordpress.org/changeset/3243002/
CVE ID: CVE-2025-1484 State: PUBLISHED Published: 2025-05-30T12:26:42.536Z Last Updated: 2025-05-30T13:22:41.411Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Hitachi Energy Products: Asset Suite Problem Types: CWE-184 Description: A vulnerability exists in the media upload component of the Asset Suite versions listed below. If successfully exploited an attacker could impact the confidentiality or integrity of the system. An attacker can use this vulnerability to construct a request that will cause JavaScript code supplied by the attacker to execute within the user’s browser in the context of that user’s session with the application. Additional Analyst No
r to execute within the user’s browser in the context of that user’s session with the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000212&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2025-1485 State: PUBLISHED Published: 2025-06-02T06:00:01.621Z Last Updated: 2025-06-02T15:46:10.440Z Vendors: Unknown Products: Real Cookie Banner: GDPR & ePrivacy Cookie Consent, real-cookie-banner-pro Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro WordPress plugin before 5.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnri
e unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0158eb67-cd36-4406-bf70-6f2be849ec52/
CVE ID: CVE-2025-1486 State: PUBLISHED Published: 2025-03-13T06:00:07.656Z Last Updated: 2025-03-14T15:49:48.024Z Vendors: Unknown Products: WoWPth Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WoWPth WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/182ecda8-3385-4f9f-a917-efdeb237247c/
CVE ID: CVE-2025-1487 State: PUBLISHED Published: 2025-03-13T06:00:07.938Z Last Updated: 2025-03-14T15:20:02.800Z Vendors: Unknown Products: WoWPth Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WoWPth WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9c683c2e-4f7f-4862-b844-6bdc3d1885dd/
CVE ID: CVE-2025-1488 State: PUBLISHED Published: 2025-02-24T11:10:08.896Z Last Updated: 2025-02-24T12:47:14.566Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wpo365 Products: WPO365 | MICROSOFT 365 GRAPH MAILER Problem Types: CWE-601 Description: The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.2. This is due to insufficient validation on the redirect url supplied via the 'redirect_to' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if 1. they can successfully trick them into performing an action and 2. the p
irect users to potentially malicious sites if 1. they can successfully trick them into performing an action and 2. the plugin is activated but not configured. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3a1782c3-ae0b-42f1-aa5e-dabfa2a5bbcd?source=cve - https://wordpress.org/plugins/wpo365-msgraphmailer/#developers - https://www.wpo365.com/change-log/ - https://plugins.trac.wordpress.org/changeset/3244747/
CVE ID: CVE-2025-1489 State: PUBLISHED Published: 2025-02-21T11:09:33.644Z Last Updated: 2025-02-25T19:20:11.115Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: marcelismus Products: WP-Appbox Problem Types: CWE-79 Description: The WP-Appbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's appbox shortcode in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pa
vel access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6d58355d-2762-4ecc-aec2-52a1e3323017?source=cve - https://wordpress.org/plugins/wp-appbox/#developers - https://plugins.trac.wordpress.org/changeset/3244084/
CVE ID: CVE-2025-1490 State: PUBLISHED Published: 2025-03-26T02:23:49.553Z Last Updated: 2025-03-26T18:40:28.240Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: brijeshk89 Products: Smart Maintenance Mode Problem Types: CWE-79 Description: The Smart Maintenance Mode plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘setstatus’ parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a li
b scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ea9ca8ac-e735-4e84-af0f-45d22a8e2124?source=cve - https://plugins.trac.wordpress.org/browser/smart-maintenance-mode/trunk/smart-maintenance-mode.php#L562 - https://wordpress.org/plugins/smart-maintenance-mode/#developers
CVE ID: CVE-2025-1491 State: PUBLISHED Published: 2025-03-01T12:22:40.818Z Last Updated: 2025-03-03T17:38:08.752Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: teastudiopl Products: WP Posts Carousel Problem Types: CWE-79 Description: The WP Posts Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘auto_play_timeout’ parameter in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Addi
ss and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7f708c72-7ce2-4eb0-869b-cec4613f6f3f?source=cve - https://wordpress.org/plugins/wp-posts-carousel/#developers - https://plugins.trac.wordpress.org/changeset/3248502/
CVE ID: CVE-2025-1492 State: PUBLISHED Published: 2025-02-20T01:30:46.055Z Last Updated: 2025-02-20T14:22:12.035Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Wireshark Foundation Products: Wireshark Problem Types: CWE-674 Description: Bundle Protocol and CBOR dissector crashes in Wireshark 4.4.0 to 4.4.3 and 4.2.0 to 4.2.10 allows denial of service via packet injection or crafted capture file Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wireshark.org/security/wnpa-sec-2025-01.html - https://gitlab.com/wireshark/wireshark/-/issues/20373
CVE ID: CVE-2025-1493 State: PUBLISHED Published: 2025-05-05T20:57:52.656Z Last Updated: 2025-08-28T14:27:04.604Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-362 Description: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service due to concurrent execution of shared resources. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7232518
CVE ID: CVE-2025-1494 State: PUBLISHED Published: 2025-08-26T16:45:35.076Z Last Updated: 2025-08-26T17:36:26.140Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Cognos Command Center Problem Types: CWE-1021 Description: IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7242159
CVE ID: CVE-2025-1495 State: PUBLISHED Published: 2025-05-03T16:53:00.666Z Last Updated: 2025-08-28T14:28:22.723Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: IBM Business Automation Workflow Problem Types: CWE-306 Description: IBM Business Automation Workflow 24.0.0 and 24.0.1 through 24.0.1 IF001 Center may leak sensitive information due to missing authorization validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7232434
CVE ID: CVE-2025-1496 State: PUBLISHED Published: 2025-03-20T13:30:04.057Z Last Updated: 2025-03-20T14:12:29.699Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: BG-TEK Products: Coslat Hotspot Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts vulnerability in BG-TEK Coslat Hotspot allows Password Brute Forcing, Authentication Abuse.This issue affects Coslat Hotspot: before 6.26.0.R.20250227. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.coslat.com/tr/blog/28-02-2025-guncelleme - https://www.usom.gov.tr/bildirim/tr-25-0075
CVE ID: CVE-2025-1497 State: PUBLISHED Published: 2025-03-10T13:56:24.309Z Last Updated: 2025-10-03T08:56:53.118Z Vendors: MLJAR Products: PlotAI Problem Types: CWE-94 Description: A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code. Vendor commented out vulnerable line, further usage of the software requires uncommenting it and thus accepting the risk. The vendor does not plan to release a patch to fix this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/03/CVE-2025-1497 - https://cert.pl/en/posts/2025
otes: - CISA ADP Vulnrichment: References: - https://cert.pl/posts/2025/03/CVE-2025-1497 - https://cert.pl/en/posts/2025/03/CVE-2025-1497 - https://github.com/mljar/plotai - https://github.com/mljar/plotai/commit/bdcfb13484f0b85703a4c1ddfd71cb21840e7fde
CVE ID: CVE-2025-1499 State: PUBLISHED Published: 2025-06-01T11:30:58.760Z Last Updated: 2025-08-26T14:54:42.793Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-312 Description: IBM InfoSphere Information Server 11.7 stores credential information for database authentication in a cleartext parameter file that could be viewed by an authenticated user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7233154
CVE ID: CVE-2025-1500 State: PUBLISHED Published: 2025-04-05T00:28:26.041Z Last Updated: 2025-09-01T10:16:54.102Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: IBM Products: Maximo Application Suite Problem Types: CWE-434 Description: IBM Maximo Application Suite 9.0 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7230140
CVE ID: CVE-2025-1501 State: PUBLISHED Published: 2025-08-26T10:25:47.063Z Last Updated: 2025-08-26T15:19:46.745Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Nozomi Networks Products: CMC Problem Types: CWE-863 Description: An access control vulnerability was discovered in the Request Trace and Download Trace functionalities of CMC before 25.1.0 due to a specific access restriction not being properly enforced for users with limited privileges. An authenticated user with limited privileges can request and download trace files due to improper access restrictions, potentially exposing unauthorized network data. Additional Analyst Notes: - CISA ADP Vulnrichm
oper access restrictions, potentially exposing unauthorized network data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.nozominetworks.com/NN-2025:3-01
CVE ID: CVE-2025-1502 State: PUBLISHED Published: 2025-03-01T06:39:28.059Z Last Updated: 2025-03-03T20:57:12.075Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ip2location Products: IP2Location Redirection Problem Types: CWE-862 Description: The IP2Location Redirection plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'download_ip2location_redirection_backup' AJAX action in all versions up to, and including, 1.33.3. This makes it possible for unauthenticated attackers to download the plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-i
e plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bca41dd8-5bd3-4fee-9f3f-feb8f1a4c687?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3244195%40ip2location-redirection&new=3244195%40ip2location-redirection&sfp_email=&sfph_mail=
CVE ID: CVE-2025-1503 State: PUBLISHED Published: 2025-03-13T04:21:05.601Z Last Updated: 2025-03-17T21:28:56.005Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: brechtvds Products: WP Recipe Maker Problem Types: CWE-79 Description: The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Roundup Recipe Name field in all versions up to, and including, 9.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Ana
ve, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e23f63a0-3061-42e0-a6be-05fa20a174ea?source=cve - https://plugins.trac.wordpress.org/changeset/3254687/wp-recipe-maker/trunk/includes/public/class-wprm-list-saver.php
CVE ID: CVE-2025-1504 State: PUBLISHED Published: 2025-03-08T02:24:03.840Z Last Updated: 2025-03-10T16:03:01.730Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: andyexeter Products: Post Lockdown Problem Types: CWE-862 Description: The Post Lockdown plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.0.2 via the 'pl_autocomplete' AJAX action due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract data from password protected, private, or draft posts that they should not have access to. Additional Anal
e, to extract data from password protected, private, or draft posts that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/447cef6f-fa2e-4087-946d-6e0214830ea9?source=cve - https://wordpress.org/plugins/post-lockdown/
CVE ID: CVE-2025-1505 State: PUBLISHED Published: 2025-02-28T04:21:56.533Z Last Updated: 2025-02-28T14:02:00.539Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: berocket Products: Advanced AJAX Product Filters Problem Types: CWE-79 Description: The Advanced AJAX Product Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 1.6.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicki
bitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/94b289bf-0ef1-47d1-98bd-8f7bb753c2bc?source=cve - https://plugins.trac.wordpress.org/changeset/3245830/woocommerce-ajax-filters/trunk/includes/wizard.php
CVE ID: CVE-2025-1506 State: PUBLISHED Published: 2025-02-28T05:23:16.008Z Last Updated: 2025-02-28T14:54:36.064Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: xpeedstudio Products: Wp Social Login and Register Social Counter Problem Types: CWE-352 Description: The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.0. This is due to missing or incorrect nonce validation on the counter_access_key_setup() function. This makes it possible for unauthenticated attackers to update social login provider settings via a forged request granted they can trick a site ad
unauthenticated attackers to update social login provider settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/669833b3-1689-4051-8990-c6eddae4858f?source=cve - https://plugins.trac.wordpress.org/changeset/3246155/wp-social/trunk/inc/counter.php - https://plugins.trac.wordpress.org/browser/wp-social/tags/3.0.9/inc/counter.php#L189