Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-54700 State: PUBLISHED Published: 2025-08-14T10:34:55.769Z Last Updated: 2025-08-14T13:18:54.275Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ThemeMove Products: Makeaholic Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Makeaholic allows PHP Local File Inclusion. This issue affects Makeaholic: from n/a through 1.8.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/makeaholic/vulnerability/wordpress-makeaholic-theme-1-8-4-local-file-inclusion-vulnerability?_s_
atabase/wordpress/theme/makeaholic/vulnerability/wordpress-makeaholic-theme-1-8-4-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-54701 State: PUBLISHED Published: 2025-08-14T10:34:56.302Z Last Updated: 2025-08-14T14:43:53.384Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ThemeMove Products: Unicamp Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Unicamp allows PHP Local File Inclusion. This issue affects Unicamp: from n/a through 2.6.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/unicamp/vulnerability/wordpress-unicamp-theme-2-6-3-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-54702 State: PUBLISHED Published: 2025-08-14T10:34:56.861Z Last Updated: 2025-08-14T14:40:26.270Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: motov.net Products: Ebook Store Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in motov.net Ebook Store allows Cross Site Request Forgery. This issue affects Ebook Store: from n/a through 5.8013. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ebook-store/vulnerability/wordpress-ebook-store-plugin-plugin-5-8013-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-54703 State: PUBLISHED Published: 2025-08-14T10:34:57.381Z Last Updated: 2025-08-14T14:38:37.382Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Prince Products: Integrate Google Drive Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Prince Integrate Google Drive allows Cross Site Request Forgery. This issue affects Integrate Google Drive: from n/a through 1.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/integrate-google-drive/vulnerability/wordpress-integrate-google-drive-plugin-plugin-1-5-2-cross-site-request-forgery-csrf-vulnerab
google-drive/vulnerability/wordpress-integrate-google-drive-plugin-plugin-1-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-54704 State: PUBLISHED Published: 2025-08-14T10:34:57.899Z Last Updated: 2025-08-14T14:18:48.994Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: hashthemes Products: Easy Elementor Addons Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons allows DOM-Based XSS. This issue affects Easy Elementor Addons: from n/a through 2.2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/easy-elementor-addons/vulnerability/wordpress-easy-elementor-addons-plugin-plugin-2-2-6-
k.com/database/wordpress/plugin/easy-elementor-addons/vulnerability/wordpress-easy-elementor-addons-plugin-plugin-2-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54705 State: PUBLISHED Published: 2025-08-14T10:34:58.440Z Last Updated: 2025-08-14T14:08:14.543Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: magepeopleteam Products: WpEvently Problem Types: CWE-862 Description: Missing Authorization vulnerability in magepeopleteam WpEvently allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpEvently: from n/a through 4.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mage-eventpress/vulnerability/wordpress-wpevently-plugin-plugin-4-4-6-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-54706 State: PUBLISHED Published: 2025-08-14T10:34:58.971Z Last Updated: 2025-08-14T13:55:13.802Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Noor Alam Products: Magical Posts Display Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Posts Display allows DOM-Based XSS. This issue affects Magical Posts Display: from n/a through 1.2.52. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/magical-posts-display/vulnerability/wordpress-magical-posts-display-plugin-plugin-1-2-52-
.com/database/wordpress/plugin/magical-posts-display/vulnerability/wordpress-magical-posts-display-plugin-plugin-1-2-52-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54707 State: PUBLISHED Published: 2025-08-14T10:34:59.518Z Last Updated: 2025-08-14T13:43:12.294Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: RealMag777 Products: MDTF Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 MDTF allows SQL Injection. This issue affects MDTF: from n/a through 1.3.3.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-meta-data-filter-and-taxonomy-filter/vulnerability/wordpress-mdtf-plugin-1-3-3-7-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-54708 State: PUBLISHED Published: 2025-08-14T18:21:47.472Z Last Updated: 2025-08-14T19:58:52.990Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: bPlugins Products: B Blocks Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks allows DOM-Based XSS. This issue affects B Blocks: from n/a through 2.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/b-blocks/vulnerability/wordpress-b-blocks-plugin-plugin-2-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54709 State: PUBLISHED Published: 2025-09-09T16:25:32.947Z Last Updated: 2025-09-09T18:40:53.075Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: uxper Products: Sala Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Sala. This issue affects Sala: from n/a through 1.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/sala/vulnerability/wordpress-sala-theme-1-1-6-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-54710 State: PUBLISHED Published: 2025-08-28T12:37:34.462Z Last Updated: 2025-08-28T18:32:50.016Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: bPlugins Products: Tiktok Feed Problem Types: CWE-862 Description: Missing Authorization vulnerability in bPlugins Tiktok Feed allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Tiktok Feed: from n/a through 1.0.21. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/b-tiktok-feed/vulnerability/wordpress-tiktok-feed-plugin-1-0-21-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-54711 State: PUBLISHED Published: 2025-11-06T15:54:14.029Z Last Updated: 2025-11-13T10:33:42.598Z Vendors: bPlugins Products: Info Cards Problem Types: CWE-862 Description: Missing Authorization vulnerability in bPlugins Info Cards info-cards allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Info Cards: from n/a through <= 1.0.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/info-cards/vulnerability/wordpress-info-cards-plugin-1-0-11-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-54712 State: PUBLISHED Published: 2025-08-14T18:21:46.895Z Last Updated: 2025-08-14T19:57:32.890Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: hashthemes Products: Easy Elementor Addons Problem Types: CWE-862 Description: Missing Authorization vulnerability in hashthemes Easy Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Easy Elementor Addons: from n/a through 2.2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/easy-elementor-addons/vulnerability/wordpress-easy-elementor-addons-plugin-plugin-2-2-7-broken-acce
ase/wordpress/plugin/easy-elementor-addons/vulnerability/wordpress-easy-elementor-addons-plugin-plugin-2-2-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-54713 State: PUBLISHED Published: 2025-08-20T08:02:51.904Z Last Updated: 2025-08-20T15:15:01.696Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: magepeopleteam Products: Taxi Booking Manager for WooCommerce Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce allows Authentication Abuse. This issue affects Taxi Booking Manager for WooCommerce: from n/a through 1.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ecab-taxi-booking-manager/vulnerability/wordpress-tax
nt: References: - https://patchstack.com/database/wordpress/plugin/ecab-taxi-booking-manager/vulnerability/wordpress-taxi-booking-manager-for-woocommerce-plugin-1-3-0-broken-authentication-vulnerability?_s_id=cve
CVE ID: CVE-2025-54714 State: PUBLISHED Published: 2025-08-28T12:37:35.049Z Last Updated: 2025-08-28T18:29:43.469Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Dylan James Products: Zephyr Project Manager Problem Types: CWE-862 Description: Missing Authorization vulnerability in Dylan James Zephyr Project Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Zephyr Project Manager: from n/a through 3.3.201. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/zephyr-project-manager/vulnerability/wordpress-zephyr-project-manager-plugin-3-3-201-broken-ac
database/wordpress/plugin/zephyr-project-manager/vulnerability/wordpress-zephyr-project-manager-plugin-3-3-201-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-54715 State: PUBLISHED Published: 2025-08-14T18:21:46.363Z Last Updated: 2025-08-14T19:30:11.152Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Dmitry V. (CEO of "UKR Solution") Products: Barcode Scanner with Inventory & Order Manager Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager allows Path Traversal. This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through 1.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.co
Manager: from n/a through 1.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/vulnerability/wordpress-barcode-scanner-with-inventory-order-manager-plugin-plugin-1-9-0-arbitrary-file-download-vulnerability?_s_id=cve
CVE ID: CVE-2025-54716 State: PUBLISHED Published: 2025-08-28T12:37:35.635Z Last Updated: 2025-08-28T18:28:42.279Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ovatheme Products: Ireca Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Ireca allows PHP Local File Inclusion. This issue affects Ireca: from n/a through 1.8.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/ireca/vulnerability/wordpress-ireca-theme-1-8-5-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-54717 State: PUBLISHED Published: 2025-08-14T18:21:45.839Z Last Updated: 2025-08-14T19:30:30.579Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: e-plugins Products: WP Membership Problem Types: CWE-862 Description: Missing Authorization vulnerability in e-plugins WP Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Membership: from n/a through 1.6.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-membership/vulnerability/wordpress-wp-membership-plugin-plugin-1-6-3-settings-change-vulnerability?_s_id=cve
CVE ID: CVE-2025-54718 State: PUBLISHED Published: 2025-11-06T15:54:14.634Z Last Updated: 2025-11-13T10:33:42.643Z Vendors: NooTheme Products: Yogi - Health Beauty & Yoga Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Yogi - Health Beauty & Yoga noo-yogi allows Reflected XSS.This issue affects Yogi - Health Beauty & Yoga: from n/a through <= 2.9.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/noo-yogi/vulnerability/wordpress-yogi-health-beauty-yoga-theme-2-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54719 State: PUBLISHED Published: 2025-11-06T15:54:15.371Z Last Updated: 2025-11-13T10:33:42.629Z Vendors: NooTheme Products: Yogi - Health Beauty & Yoga Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in NooTheme Yogi - Health Beauty & Yoga noo-yogi allows Object Injection.This issue affects Yogi - Health Beauty & Yoga: from n/a through <= 2.9.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/noo-yogi/vulnerability/wordpress-yogi-health-beauty-yoga-theme-2-9-2-deserialization-of-untrusted-data-vulnerability?_s_id=cve
CVE ID: CVE-2025-54720 State: PUBLISHED Published: 2025-08-28T12:37:36.205Z Last Updated: 2025-08-28T18:25:00.738Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: SteelThemes Products: Nest Addons Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SteelThemes Nest Addons allows SQL Injection. This issue affects Nest Addons: from n/a through 1.6.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/nest-addons/vulnerability/wordpress-nest-addons-plugin-1-6-3-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-54721 State: PUBLISHED Published: 2025-11-06T15:54:16.209Z Last Updated: 2025-11-13T10:33:42.642Z Vendors: ThimPress Products: Resca Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Resca resca allows Reflected XSS.This issue affects Resca: from n/a through <= 3.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/resca/vulnerability/wordpress-resca-theme-3-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54722 State: PUBLISHED Published: 2025-11-06T15:54:16.991Z Last Updated: 2025-11-13T10:33:42.641Z Vendors: Ex-Themes Products: WooTour Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ex-Themes WooTour woo-tour allows Reflected XSS.This issue affects WooTour: from n/a through <= 3.6.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/woo-tour/vulnerability/wordpress-wootour-plugin-3-6-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54724 State: PUBLISHED Published: 2025-08-28T12:37:36.762Z Last Updated: 2025-08-28T18:23:39.142Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: uxper Products: Golo Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Golo allows Reflected XSS. This issue affects Golo: from n/a through 1.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/golo/vulnerability/wordpress-golo-theme-1-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54725 State: PUBLISHED Published: 2025-08-28T12:37:37.318Z Last Updated: 2025-08-28T18:21:02.232Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: uxper Products: Golo Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in uxper Golo allows Authentication Abuse. This issue affects Golo: from n/a through 1.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/golo/vulnerability/wordpress-golo-theme-1-7-0-broken-authentication-vulnerability?_s_id=cve
CVE ID: CVE-2025-54726 State: PUBLISHED Published: 2025-08-20T08:02:51.388Z Last Updated: 2025-08-20T15:15:09.365Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: Miguel Useche Products: JS Archive List Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Miguel Useche JS Archive List allows SQL Injection. This issue affects JS Archive List: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jquery-archive-list-widget/vulnerability/wordpress-js-archive-list-plugin-6-1-6-sql-injection-vulner
se/wordpress/plugin/jquery-archive-list-widget/vulnerability/wordpress-js-archive-list-plugin-6-1-6-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-54727 State: PUBLISHED Published: 2025-08-14T18:21:45.295Z Last Updated: 2025-08-14T19:30:52.184Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: CreativeMindsSolutions Products: CM On Demand Search And Replace Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM On Demand Search And Replace allows Stored XSS. This issue affects CM On Demand Search And Replace: from n/a through 1.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cm-on-demand-search-and-replace/vulne
A ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cm-on-demand-search-and-replace/vulnerability/wordpress-cm-on-demand-search-and-replace-plugin-plugin-1-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54728 State: PUBLISHED Published: 2025-08-14T18:21:43.685Z Last Updated: 2025-08-14T19:31:16.535Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: CreativeMindsSolutions Products: CM On Demand Search And Replace Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace allows Cross Site Request Forgery. This issue affects CM On Demand Search And Replace: from n/a through 1.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cm-on-demand-search-and-replace/vulnerability/wordpress-cm-on-demand-se
https://patchstack.com/database/wordpress/plugin/cm-on-demand-search-and-replace/vulnerability/wordpress-cm-on-demand-search-and-replace-plugin-plugin-1-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-54729 State: PUBLISHED Published: 2025-08-14T18:21:41.050Z Last Updated: 2025-08-14T19:32:16.402Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Webba Appointment Booking Products: Webba Booking Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webba Appointment Booking Webba Booking allows Stored XSS. This issue affects Webba Booking: from n/a through 6.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/webba-booking-lite/vulnerability/wordpress-webba-booking-plugin-plugin-6-0-5-cross-si
tack.com/database/wordpress/plugin/webba-booking-lite/vulnerability/wordpress-webba-booking-plugin-plugin-6-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54730 State: PUBLISHED Published: 2025-08-14T18:21:40.043Z Last Updated: 2025-08-14T19:33:17.924Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: PARETO Digital Products: Embedder for Google Reviews Problem Types: CWE-862 Description: Missing Authorization vulnerability in PARETO Digital Embedder for Google Reviews allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Embedder for Google Reviews: from n/a through 1.7.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/embedder-for-google-reviews/vulnerability/wordpress-embedder-for-google-reviews-p
tchstack.com/database/wordpress/plugin/embedder-for-google-reviews/vulnerability/wordpress-embedder-for-google-reviews-plugin-plugin-1-7-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-54731 State: PUBLISHED Published: 2025-08-28T12:37:37.895Z Last Updated: 2025-08-28T14:01:59.212Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: emarket-design Products: YouTube Showcase Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in emarket-design YouTube Showcase allows Object Injection. This issue affects YouTube Showcase: from n/a through 3.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/youtube-showcase/vulnerability/wordpress-youtube-showcase-plugin-3-5-1-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-54732 State: PUBLISHED Published: 2025-08-14T18:21:39.427Z Last Updated: 2025-08-14T19:33:42.937Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Shahjada Products: WPDM – Premium Packages Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Shahjada WPDM – Premium Packages allows Cross Site Request Forgery. This issue affects WPDM – Premium Packages: from n/a through 6.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpdm-premium-packages/vulnerability/wordpress-wpdm-premium-packages-plugin-plugin-6-0-2-cross-site-request-forgery-csrf-vul
m-premium-packages/vulnerability/wordpress-wpdm-premium-packages-plugin-plugin-6-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve