Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-5514 State: PUBLISHED Published: 2025-08-25T05:55:32.622Z Last Updated: 2025-08-26T04:19:57.230Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Mitsubishi Electric Corporation Products: MELSEC iQ-F Series FX5U-32MT/ES, MELSEC iQ-F Series FX5U-32MT/DS, MELSEC iQ-F Series FX5U-32MT/ESS, MELSEC iQ-F Series FX5U-32MT/DSS, MELSEC iQ-F Series FX5U-32MR/ES, MELSEC iQ-F Series FX5U-32MR/DS, MELSEC iQ-F Series FX5U-64MT/ES, MELSEC iQ-F Series FX5U-64MT/DS, MELSEC iQ-F Series FX5U-64MT/ESS, MELSEC iQ-F Series FX5U-64MT/DSS, MELSEC iQ-F Series FX5U-64MR/ES, MELSEC iQ-F Series FX5U-64MR/DS, MELSEC iQ-F Series FX5U-80MT/ES, MELSEC iQ-F Series FX5U-80MT/
MELSEC iQ-F Series FX5S-80MT/ESS, MELSEC iQ-F Series FX5S-80MR/ES, MELSEC iQ-F Series FX5S-30MT/DS, MELSEC iQ-F Series FX5S-30MT/DSS, MELSEC iQ-F Series FX5S-30MR/DS, MELSEC iQ-F Series FX5S-40MT/DS, MELSEC iQ-F Series FX5S-40MT/DSS, MELSEC iQ-F Series FX5S-40MR/DS, MELSEC iQ-F Series FX5S-60MT/DS, MELSEC iQ-F Series FX5S-60MT/DSS, MELSEC iQ-F Series FX5S-60MR/DS, MELSEC iQ-F Series FX5S-80MT/DS, MELSEC iQ-F Series FX5S-80MT/DSS, MELSEC iQ-F Series FX5S-80MR/DS Problem Types: CWE-130 Description: Improper Handling of Length Parameter Inconsistency vulnerability in web server function on Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to
er function on Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to delay the processing of the web server function and prevent legitimate users from utilizing the web server function, by sending a specially crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-010_en.pdf - https://jvn.jp/vu/JVNVU90316328/ - https://www.cisa.gov/news-events/ics-advisories/icsa-25-233-01
CVE ID: CVE-2025-5515 State: PUBLISHED Published: 2025-06-03T17:31:08.920Z Last Updated: 2025-06-03T17:52:50.972Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: TOTOLINK Products: X2000R Problem Types: CWE-77, CWE-74 Description: A vulnerability, which was classified as critical, has been found in TOTOLINK X2000R 1.0.0-B20230726.1108. Affected by this issue is some unknown functionality of the file /boafrm/formMapDel. The manipulation of the argument devicemac1 leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Addition
he public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310952 - https://vuldb.com/?ctiid.310952 - https://vuldb.com/?submit.584653 - https://github.com/fizz-is-on-the-way/Iot_vuls/blob/main/X2000R/RCE_formMapDel/RCE_formMapDel.md - https://www.totolink.net/
CVE ID: CVE-2025-5516 State: PUBLISHED Published: 2025-06-03T18:00:18.786Z Last Updated: 2025-06-03T18:21:49.966Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: TOTOLINK Products: X2000R Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in TOTOLINK X2000R 1.0.0-B20230726.1108. This affects an unknown part of the file /boafrm/formFilter of the component URL Filtering Page. The manipulation of the argument URL Address leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not res
t has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310953 - https://vuldb.com/?ctiid.310953 - https://vuldb.com/?submit.584661 - https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/X2000R/XSS_url_filtering - https://www.totolink.net/
CVE ID: CVE-2025-5517 State: PUBLISHED Published: 2025-10-20T18:27:32.374Z Last Updated: 2025-10-20T18:47:22.917Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: ABB Products: Terra AC wallbox (UL40/80A), Terra AC wallbox (UL32A), Terra AC wallbox (MID/ CE) -Terra AC MID, Terra AC wallbox (MID/ CE) -Terra AC Juno CE, Terra AC wallbox (MID/ CE) -Terra AC PTB, Terra AC wallbox (JP) Problem Types: CWE-122 Description: Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (MID/ CE) -Terra AC MID, ABB Terra AC wallbox (MID/ CE) -Terra AC Juno CE, ABB Terra AC wallbox (MID/ CE) -Terra AC PTB
(MID/ CE) -Terra AC MID, ABB Terra AC wallbox (MID/ CE) -Terra AC Juno CE, ABB Terra AC wallbox (MID/ CE) -Terra AC PTB, ABB Terra AC wallbox (JP).This issue affects Terra AC wallbox (UL40/80A): through 1.8.32; Terra AC wallbox (UL32A): through 1.8.2; Terra AC wallbox (MID/ CE) -Terra AC MID: through 1.8.32; Terra AC wallbox (MID/ CE) -Terra AC Juno CE: through 1.8.32; Terra AC wallbox (MID/ CE) -Terra AC PTB: through 1.8.21; Terra AC wallbox (JP): through 1.8.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A8948&LanguageCode=en&DocumentPartId=PDF&Action=Launch
CVE ID: CVE-2025-5518 State: PUBLISHED Published: 2025-09-16T08:00:12.020Z Last Updated: 2025-09-16T19:17:26.251Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: ArgusTech Products: BILGER Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability with user privileges in ArgusTech BILGER allows Exploitation of Trusted Identifiers.This issue affects BILGER: before 2.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0250
CVE ID: CVE-2025-5519 State: PUBLISHED Published: 2025-09-16T08:03:36.253Z Last Updated: 2025-09-16T19:17:56.876Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: ArgusTech Products: BILGER Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in ArgusTech BILGER allows Choosing Message Identifier.This issue affects BILGER: before 2.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0250
CVE ID: CVE-2025-5520 State: PUBLISHED Published: 2025-06-03T18:00:22.302Z Last Updated: 2025-06-03T18:21:12.742Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Open5GS Problem Types: CWE-617 Description: A vulnerability was found in Open5GS up to 2.7.3. It has been classified as problematic. Affected is the function gmm_state_authentication/emm_state_authentication of the component AMF/MME. The manipulation leads to reachable assertion. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 9f5d133657850e6167231527514ee1364d37a884. It is recommended to apply a patch
c and may be used. The name of the patch is 9f5d133657850e6167231527514ee1364d37a884. It is recommended to apply a patch to fix this issue. This is a different issue than CVE-2025-1893. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310956 - https://vuldb.com/?ctiid.310956 - https://vuldb.com/?submit.582269 - https://github.com/open5gs/open5gs/issues/3910 - https://github.com/open5gs/open5gs/issues/3910#issuecomment-2926719317 - https://github.com/user-attachments/files/20362243/Problematic.handover.required.process.zip - https://github.com/open5gs/open5gs/commit/9f5d133657850e6167231527514ee1364d37a884
CVE ID: CVE-2025-5521 State: PUBLISHED Published: 2025-06-03T18:31:04.266Z Last Updated: 2025-06-03T20:10:22.509Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: WuKongOpenSource Products: WukongCRM Problem Types: CWE-352, CWE-862 Description: A vulnerability was found in WuKongOpenSource WukongCRM 9.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /system/user/updataPassword. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additiona
e public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310957 - https://vuldb.com/?ctiid.310957 - https://vuldb.com/?submit.584636 - https://github.com/Aiyakami/CVE-1/issues/6
CVE ID: CVE-2025-5522 State: PUBLISHED Published: 2025-06-03T19:00:22.162Z Last Updated: 2025-06-03T19:11:52.108Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: jack0240 魏 Products: bskms 蓝天幼儿园管理系统 Problem Types: CWE-285, CWE-266 Description: A vulnerability was found in jack0240 魏 bskms 蓝天幼儿园管理系统 up to dffe6640b5b54d8e29da6f060e0493fea74b3fad. It has been rated as critical. Affected by this issue is some unknown functionality of the file /sa/addUser of the component User Creation Handler. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases
nched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310958 - https://vuldb.com/?ctiid.310958 - https://vuldb.com/?submit.584986 - https://gitee.com/jack0240/bskms/issues/ICAOOU
CVE ID: CVE-2025-5523 State: PUBLISHED Published: 2025-06-03T19:31:20.057Z Last Updated: 2025-06-03T20:15:24.579Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: enilu Products: web-flash Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in enilu web-flash 1.0. This affects the function fileService.upload of the file src/main/java/cn/enilu/flash/api/controller/FileController/upload of the component File Upload. The manipulation of the argument File leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrich
ck remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310959 - https://vuldb.com/?ctiid.310959 - https://vuldb.com/?submit.585342 - https://gitee.com/enilu/web-flash/issues/ICAXTM
CVE ID: CVE-2025-5524 State: PUBLISHED Published: 2025-06-19T04:25:19.424Z Last Updated: 2025-06-20T13:11:57.382Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: oceanwp Products: OceanWP Problem Types: CWE-79 Description: The OceanWP theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Select HTML tag in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnri
cripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/37b085f9-3b15-44aa-9ba0-de5321dfbce4?source=cve - https://themes.trac.wordpress.org/browser/oceanwp/4.0.9/assets/js/select.min.js - https://themes.trac.wordpress.org/changeset/276114/
CVE ID: CVE-2025-5525 State: PUBLISHED Published: 2025-06-03T20:00:10.318Z Last Updated: 2025-06-03T20:14:30.777Z Severity: MEDIUM (CVSS 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Jrohy Products: trojan Problem Types: CWE-78, CWE-77 Description: A vulnerability was found in Jrohy trojan up to 2.15.3. It has been declared as critical. This vulnerability affects the function LogChan of the file trojan/util/linux.go. The manipulation of the argument c leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Additional Ana
. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310966 - https://vuldb.com/?ctiid.310966 - https://vuldb.com/?submit.586673 - https://github.com/ainrm/Jrohy-trojan-unauth-poc/blob/main/README.en.md - https://github.com/Tritium0041/Jrohy-trojan-RCE-POC/blob/main/POC.py
CVE ID: CVE-2025-5526 State: PUBLISHED Published: 2025-06-27T06:00:11.971Z Last Updated: 2025-07-01T19:19:08.270Z Vendors: Unknown Products: BuddyPress Docs Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belonging to another user Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/10196cd3-5bf7-4e40-a4f7-4ff2d34d516d/
CVE ID: CVE-2025-5527 State: PUBLISHED Published: 2025-06-03T20:31:06.838Z Last Updated: 2025-06-04T13:55:16.897Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: RX3 Problem Types: CWE-121, CWE-119 Description: A vulnerability was found in Tenda RX3 16.03.13.11_multi_TDE01. It has been rated as critical. This issue affects the function save_staticroute_data of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310967 - ht
blic and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.310967 - https://vuldb.com/?ctiid.310967 - https://vuldb.com/?submit.586781 - https://github.com/alc9700jmo/CVE/issues/13 - https://www.tenda.com.cn/
CVE ID: CVE-2025-5528 State: PUBLISHED Published: 2025-06-07T11:17:50.548Z Last Updated: 2025-06-09T16:03:46.320Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: heateor Products: Social Sharing Plugin – Sassy Social Share Problem Types: CWE-79 Description: The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in all versions up to, and including, 3.3.75 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user i
unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action, such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/99e922ec-d40a-47e7-a10f-d966a351d182?source=cve - https://plugins.trac.wordpress.org/browser/sassy-social-share/tags/3.3.75/public/class-sassy-social-share-public.php#L1481
CVE ID: CVE-2025-5529 State: PUBLISHED Published: 2025-07-26T07:23:51.169Z Last Updated: 2025-07-28T15:06:46.863Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sparklewpthemes Products: Educenter Problem Types: CWE-79 Description: The Educenter theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Circle Counter Block in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes:
t arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6f524163-4d4c-40fc-b58a-311f1f6cac15?source=cve - https://themes.trac.wordpress.org/browser/educenter/1.6.2/blocks-extends/blocks/circle-counter.php#L46
CVE ID: CVE-2025-5530 State: PUBLISHED Published: 2025-07-11T07:23:00.319Z Last Updated: 2025-07-11T16:52:48.519Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpclever Products: WPC Smart Compare for WooCommerce Problem Types: CWE-79 Description: The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcode_btn' shortcode in all versions up to, and including, 6.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages tha
sible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3bd09891-8117-43b1-8744-8f3773971540?source=cve - https://plugins.trac.wordpress.org/browser/woo-smart-compare/tags/6.4.5/wpc-smart-compare.php#L187 - https://plugins.trac.wordpress.org/browser/woo-smart-compare/tags/6.4.5/wpc-smart-compare.php#L2616 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3318565%40woo-smart-compare&new=3318565%40woo-smart-compare&sfp_e
ress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3318565%40woo-smart-compare&new=3318565%40woo-smart-compare&sfp_email=&sfph_mail=
CVE ID: CVE-2025-5531 State: PUBLISHED Published: 2025-06-04T03:40:58.146Z Last Updated: 2025-06-04T13:47:50.021Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: emarket-design Products: Employee Directory – Staff Listing & Team Directory Plugin for WordPress Problem Types: CWE-79 Description: The Employee Directory – Staff Listing & Team Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wit
ut sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/143c5f1f-032c-4207-9401-20f18efcad9d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3295945%40employee-directory&new=3295945%40employee-directory&sfp_email=&sfph_mail=
CVE ID: CVE-2025-5532 State: PUBLISHED Published: 2025-06-04T03:40:58.751Z Last Updated: 2025-06-04T13:47:29.398Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: emarket-design Products: Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress Problem Types: CWE-79 Description: The Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,
input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/20301685-9b76-4dd3-8185-3a4463f3201b?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3303022%40campus-directory&new=3303022%40campus-directory&sfp_email=&sfph_mail=
CVE ID: CVE-2025-5533 State: PUBLISHED Published: 2025-06-06T06:42:48.260Z Last Updated: 2025-06-06T16:09:51.970Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ajay Products: Knowledge Base Problem Types: CWE-79 Description: The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kbalert' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injec
tor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/400564ba-70f8-4566-b2e7-cfa6450b609e?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3306850%40knowledgebase&new=3306850%40knowledgebase&sfp_email=&sfph_mail=
CVE ID: CVE-2025-5534 State: PUBLISHED Published: 2025-06-06T06:42:48.851Z Last Updated: 2025-06-06T16:09:46.602Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: calebzahnd Products: ESV Bible Shortcode for WordPress Problem Types: CWE-79 Description: The ESV Bible Shortcode for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'esv' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will e
r authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/40e8dc83-6417-4881-a9a3-15525c5cc6ba?source=cve - https://plugins.svn.wordpress.org/esv-bible-shortcode-for-wordpress/tags/1.0.2/esv-shortcode.php
CVE ID: CVE-2025-5535 State: PUBLISHED Published: 2025-06-26T01:44:38.853Z Last Updated: 2025-06-26T13:30:14.372Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: chemiker Products: e.nigma buttons Problem Types: CWE-79 Description: The e.nigma buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an