Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-49034 State: PUBLISHED Published: 2025-07-16T11:27:59.710Z Last Updated: 2025-07-16T13:39:24.744Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: FunnelKit Products: Funnel Builder by FunnelKit Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder by FunnelKit allows SQL Injection. This issue affects Funnel Builder by FunnelKit: from n/a through 3.10.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/funnel-builder/vulnerability/wordpress-funnel-builder-by-funnelkit-plugin
tps://patchstack.com/database/wordpress/plugin/funnel-builder/vulnerability/wordpress-funnel-builder-by-funnelkit-plugin-3-10-2-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49035 State: PUBLISHED Published: 2025-08-27T03:26:16.618Z Last Updated: 2025-08-27T16:10:42.538Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: chaimchaikin Products: Admin Menu Groups Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chaimchaikin Admin Menu Groups allows Stored XSS.This issue affects Admin Menu Groups: from n/a through 0.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/admin-menu-groups/vulnerability/wordpress-admin-menu-groups-plugin-0-1-2-cross-site-scripting-xss-vu
se/wordpress/plugin/admin-menu-groups/vulnerability/wordpress-admin-menu-groups-plugin-0-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49036 State: PUBLISHED Published: 2025-08-14T10:34:22.147Z Last Updated: 2025-08-14T19:34:44.357Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: octagonwebstudio Products: Premium Addons for KingComposer Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in octagonwebstudio Premium Addons for KingComposer allows PHP Local File Inclusion. This issue affects Premium Addons for KingComposer: from n/a through 1.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/premium-addons-for
nalyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/premium-addons-for-kingcomposer/vulnerability/wordpress-premium-addons-for-kingcomposer-plugin-1-1-1-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-49037 State: PUBLISHED Published: 2025-08-14T10:34:21.603Z Last Updated: 2025-08-14T19:32:44.072Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Federico Rota Products: Authentication and xmlrpc log writer Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Federico Rota Authentication and xmlrpc log writer allows Reflected XSS. This issue affects Authentication and xmlrpc log writer: from n/a through 1.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/authentication-and-xmlrpc-log-writer/vu
ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/authentication-and-xmlrpc-log-writer/vulnerability/wordpress-authentication-and-xmlrpc-log-writer-plugin-1-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49038 State: PUBLISHED Published: 2025-08-14T10:34:21.050Z Last Updated: 2025-08-14T19:31:44.798Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Soflyy Products: WP Dynamic Links Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soflyy WP Dynamic Links allows Reflected XSS. This issue affects WP Dynamic Links: from n/a through 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-dynamic-links/vulnerability/wordpress-wp-dynamic-links-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnera
plugin/wp-dynamic-links/vulnerability/wordpress-wp-dynamic-links-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49039 State: PUBLISHED Published: 2025-08-27T03:25:25.765Z Last Updated: 2025-08-27T13:59:32.924Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: mibuthu Products: Link View Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mibuthu Link View allows Stored XSS.This issue affects Link View: from n/a through 0.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/link-view/vulnerability/wordpress-link-view-plugin-0-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49040 State: PUBLISHED Published: 2025-08-27T03:24:25.693Z Last Updated: 2025-08-27T13:59:55.476Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Backup Bolt Products: Backup Bolt Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Backup Bolt allows Cross Site Request Forgery.This issue affects Backup Bolt: from n/a through 1.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/backup-bolt/vulnerability/wordpress-backup-bolt-plugin-1-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-49042 State: PUBLISHED Published: 2025-10-29T04:50:12.507Z Last Updated: 2025-10-29T13:31:19.805Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Automattic Products: WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This issue affects WooCommerce: from n/a through 10.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/wordpress/plugin/woocommerce/security-policy/vdp/vulnerability/wordpress-woocommerce-plugin-10-0-2-cross-site-scripting-xs
rdpress/plugin/woocommerce/security-policy/vdp/vulnerability/wordpress-woocommerce-plugin-10-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49044 State: PUBLISHED Published: 2025-08-14T10:34:20.493Z Last Updated: 2025-08-14T19:31:15.978Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: tosend.it Products: Simple Poll Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in tosend.it Simple Poll allows Stored XSS. This issue affects Simple Poll: from n/a through 1.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-poll/vulnerability/wordpress-simple-poll-plugin-1-1-1-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49047 State: PUBLISHED Published: 2025-08-14T10:34:19.931Z Last Updated: 2025-08-14T14:43:09.172Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: keeross Products: DigitalOcean Spaces Sync Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in keeross DigitalOcean Spaces Sync allows Stored XSS. This issue affects DigitalOcean Spaces Sync: from n/a through 2.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/do-spaces-sync/vulnerability/wordpress-digitalocean-spaces-sync-plugin-2-2-1-cross-site-
k.com/database/wordpress/plugin/do-spaces-sync/vulnerability/wordpress-digitalocean-spaces-sync-plugin-2-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49048 State: PUBLISHED Published: 2025-08-14T10:34:19.394Z Last Updated: 2025-08-14T14:43:15.190Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: inspectlet Products: Inspectlet &#8211; User Session Recording and Heatmaps Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in inspectlet Inspectlet &#8211; User Session Recording and Heatmaps allows Stored XSS. This issue affects Inspectlet &#8211; User Session Recording and Heatmaps: from n/a through 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/p
hrough 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/inspectlet-heatmaps-and-user-session-recording/vulnerability/wordpress-inspectlet-user-session-recording-and-heatmaps-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49051 State: PUBLISHED Published: 2025-08-14T10:34:18.826Z Last Updated: 2025-08-14T14:43:21.155Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: biscia7 Products: Hide Text Shortcode Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in biscia7 Hide Text Shortcode allows Stored XSS. This issue affects Hide Text Shortcode: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/hide-text-shortcode/vulnerability/wordpress-hide-text-shortcode-plugin-1-1-cross-site-scripting-xss-vulne
rdpress/plugin/hide-text-shortcode/vulnerability/wordpress-hide-text-shortcode-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49052 State: PUBLISHED Published: 2025-08-14T10:34:18.280Z Last Updated: 2025-08-14T14:43:28.351Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Dariolee Products: Netease Music Problem Types: CWE-862 Description: Missing Authorization vulnerability in Dariolee Netease Music allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Netease Music: from n/a through 3.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/netease-music/vulnerability/wordpress-netease-music-plugin-3-2-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49053 State: PUBLISHED Published: 2025-08-14T10:34:17.757Z Last Updated: 2025-08-14T15:12:06.035Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: kadesthemes Products: WP Airdrop Manager Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kadesthemes WP Airdrop Manager allows Stored XSS. This issue affects WP Airdrop Manager: from n/a through 1.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/airdrop/vulnerability/wordpress-wp-airdrop-manager-plugin-1-0-5-cross-site-scripting-xss-vulnerabi
base/wordpress/plugin/airdrop/vulnerability/wordpress-wp-airdrop-manager-plugin-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49054 State: PUBLISHED Published: 2025-08-14T10:34:16.023Z Last Updated: 2025-08-14T15:25:07.860Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: mrdenny Products: Time Sheets Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mrdenny Time Sheets allows Reflected XSS. This issue affects Time Sheets: from n/a through 2.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/time-sheets/vulnerability/wordpress-time-sheets-plugin-2-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49056 State: PUBLISHED Published: 2025-08-14T10:34:15.436Z Last Updated: 2025-08-14T15:38:57.548Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: shen2 Products: 多说社会化评论框 Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shen2 多说社会化评论框 allows Reflected XSS. This issue affects 多说社会化评论框: from n/a through 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/duoshuo/vulnerability/wordpress-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49057 State: PUBLISHED Published: 2025-08-14T10:34:14.890Z Last Updated: 2025-08-14T18:44:22.101Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Ko Min Products: WP Voting Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ko Min WP Voting allows Reflected XSS. This issue affects WP Voting: from n/a through 1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-voting/vulnerability/wordpress-wp-voting-plugin-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49058 State: PUBLISHED Published: 2025-08-14T10:34:14.370Z Last Updated: 2025-08-14T18:45:02.881Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Sound Strategies Products: SoundSt SEO Search Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sound Strategies SoundSt SEO Search allows Reflected XSS. This issue affects SoundSt SEO Search: from n/a through 1.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/soundst-seo-search/vulnerability/wordpress-soundst-seo-search-plugin-1-2-3-reflected-cr
ck.com/database/wordpress/plugin/soundst-seo-search/vulnerability/wordpress-soundst-seo-search-plugin-1-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49059 State: PUBLISHED Published: 2025-08-14T10:34:13.819Z Last Updated: 2025-08-14T18:52:09.848Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: CleverReach® Products: CleverReach® WP Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CleverReach® CleverReach® WP allows SQL Injection. This issue affects CleverReach® WP: from n/a through 1.5.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cleverreach-wp/vulnerability/wordpress-cleverreach-wp-plugin-1-5-20-sql-injection-vulnerability?_s_
ase/wordpress/plugin/cleverreach-wp/vulnerability/wordpress-cleverreach-wp-plugin-1-5-20-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49060 State: PUBLISHED Published: 2025-10-22T14:32:08.196Z Last Updated: 2025-11-13T10:33:39.434Z Vendors: CMSSuperHeroes Products: Wastia Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Wastia wastia allows Upload a Web Shell to a Web Server.This issue affects Wastia: from n/a through < 1.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/wastia/vulnerability/wordpress-wastia-theme-1-1-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-49061 State: PUBLISHED Published: 2025-08-14T10:34:13.291Z Last Updated: 2025-08-14T19:48:49.923Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: perteus Products: Porn Videos Embed Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in perteus Porn Videos Embed allows Stored XSS. This issue affects Porn Videos Embed: from n/a through 0.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/porn-videos-embed/vulnerability/wordpress-porn-videos-embed-plugin-0-9-1-cross-site-scripting-xss-vulnerabili
ess/plugin/porn-videos-embed/vulnerability/wordpress-porn-videos-embed-plugin-0-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49062 State: PUBLISHED Published: 2025-08-14T10:34:12.705Z Last Updated: 2025-08-14T19:50:36.228Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: cornfeed Products: WP-jScrollPane Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cornfeed WP-jScrollPane allows Reflected XSS. This issue affects WP-jScrollPane: from n/a through 2.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-jscrollpane/vulnerability/wordpress-wp-jscrollpane-plugin-2-0-3-reflected-cross-site-scripting-xss-vulnerability
ugin/wp-jscrollpane/vulnerability/wordpress-wp-jscrollpane-plugin-2-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49063 State: PUBLISHED Published: 2025-08-14T10:34:12.190Z Last Updated: 2025-08-14T19:54:24.518Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: i3geek Products: BaiduXZH Submit(百度熊掌号) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in i3geek BaiduXZH Submit(百度熊掌号) allows Reflected XSS. This issue affects BaiduXZH Submit(百度熊掌号): from n/a through 1.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/i3geek-baiduxzh/vulnerability/wordpress-baiduxzh-submit-plugin-1-4-6-reflected-cross-site-scrip
atabase/wordpress/plugin/i3geek-baiduxzh/vulnerability/wordpress-baiduxzh-submit-plugin-1-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49064 State: PUBLISHED Published: 2025-08-14T10:34:11.643Z Last Updated: 2025-08-14T19:55:53.129Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Webilop Products: User Language Switch Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webilop User Language Switch allows Reflected XSS. This issue affects User Language Switch: from n/a through 1.6.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/user-language-switch/vulnerability/wordpress-user-language-switch-plugin-1-6-10-reflected-cross-si
base/wordpress/plugin/user-language-switch/vulnerability/wordpress-user-language-switch-plugin-1-6-10-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49065 State: PUBLISHED Published: 2025-08-14T10:34:11.102Z Last Updated: 2025-08-14T14:43:33.568Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: BestiaDurmiente Products: Visit Counter Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BestiaDurmiente Visit Counter allows Stored XSS. This issue affects Visit Counter: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/visit-counter/vulnerability/wordpress-visit-counter-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=c
ess/plugin/visit-counter/vulnerability/wordpress-visit-counter-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49067 State: PUBLISHED Published: 2025-06-06T11:31:20.491Z Last Updated: 2025-06-06T16:43:58.634Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: NasaTheme Products: Nasa Core Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Nasa Core allows Stored XSS.This issue affects Nasa Core: from n/a before 6.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/nasa-core/vulnerability/wordpress-nasa-core-plugin-6-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49068 State: PUBLISHED Published: 2025-06-06T11:32:21.762Z Last Updated: 2025-06-06T16:02:46.293Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: OceanWP Products: Ocean Extra Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP Ocean Extra allows Stored XSS.This issue affects Ocean Extra: from n/a through 2.4.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ocean-extra/vulnerability/wordpress-ocean-extra-plugin-2-4-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49069 State: PUBLISHED Published: 2025-06-02T18:49:25.588Z Last Updated: 2025-06-03T02:00:34.080Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Cimatti Consulting Products: Contact Forms by Cimatti Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Cimatti Consulting Contact Forms by Cimatti allows Cross Site Request Forgery.This issue affects Contact Forms by Cimatti: from n/a through 1.9.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/contact-forms/vulnerability/wordpress-contact-forms-by-cimatti-plugin-1-9-8-cross-site-request-forger
e/wordpress/plugin/contact-forms/vulnerability/wordpress-contact-forms-by-cimatti-plugin-1-9-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-49070 State: PUBLISHED Published: 2025-07-04T11:17:50.195Z Last Updated: 2025-07-07T16:27:48.904Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NasaTheme Products: Elessi Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Elessi allows PHP Local File Inclusion. This issue affects Elessi: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/elessi-theme/vulnerability/wordpress-elessi-6-4-1-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-49071 State: PUBLISHED Published: 2025-06-17T15:01:42.839Z Last Updated: 2025-06-17T17:20:25.393Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: NasaTheme Products: Flozen Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in NasaTheme Flozen allows Upload a Web Shell to a Web Server. This issue affects Flozen: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/flozen-theme/vulnerability/wordpress-flozen-1-5-1-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-49072 State: PUBLISHED Published: 2025-06-06T12:15:02.441Z Last Updated: 2025-06-06T16:07:37.993Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: AncoraThemes Products: Mr. Murphy Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in AncoraThemes Mr. Murphy allows Object Injection.This issue affects Mr. Murphy: from n/a before 1.2.12.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/mr-murphy/vulnerability/wordpress-mr-murphy-1-2-12-1-php-object-injection-vulnerability?_s_id=cve