Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
e public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316881 - https://vuldb.com/?ctiid.316881 - https://vuldb.com/?submit.616347 - https://github.com/panda666-888/vuls/blob/main/tenda/fh451/fromPptpUserSetting.md - https://github.com/panda666-888/vuls/blob/main/tenda/fh451/fromPptpUserSetting.md#poc - https://www.tenda.com.cn/
CVE ID: CVE-2025-7806 State: PUBLISHED Published: 2025-07-18T20:32:07.733Z Last Updated: 2025-07-21T15:15:04.681Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: FH451 Problem Types: CWE-121, CWE-119 Description: A vulnerability classified as critical was found in Tenda FH451 1.0.0.9. This vulnerability affects the function fromSafeClientFilter of the file /goform/SafeClientFilter. The manipulation of the argument Go/page leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3168
the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316882 - https://vuldb.com/?ctiid.316882 - https://vuldb.com/?submit.616348 - https://vuldb.com/?submit.616349 - https://github.com/panda666-888/vuls/blob/main/tenda/fh451/fromSafeClientFilter_Go.md - https://github.com/panda666-888/vuls/blob/main/tenda/fh451/fromSafeClientFilter_page.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-7807 State: PUBLISHED Published: 2025-07-18T20:44:07.510Z Last Updated: 2025-07-21T15:15:44.725Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: FH451 Problem Types: CWE-121, CWE-119 Description: A vulnerability, which was classified as critical, has been found in Tenda FH451 1.0.0.9. This issue affects the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. The manipulation of the argument Go/page leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316883 - https://vuldb.com/?ctiid.316883 - https://vuldb.com/?submit.616350 - https://vuldb.com/?submit.616352 - https://github.com/panda666-888/vuls/blob/main/tenda/fh451/fromSafeUrlFilter_Go.md - https://github.com/panda666-888/vuls/blob/main/tenda/fh451/fromSafeUrlFilter_page.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-7808 State: PUBLISHED Published: 2025-08-14T06:00:05.544Z Last Updated: 2025-08-14T13:29:10.567Z Vendors: Unknown Products: WP Shopify Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Shopify WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fa199423-6526-47f6-bab5-9f6dff0f236a/
CVE ID: CVE-2025-7809 State: PUBLISHED Published: 2025-07-29T03:41:21.936Z Last Updated: 2025-07-29T14:07:51.377Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: streamweasels Products: StreamWeasels Twitch Integration Problem Types: CWE-79 Description: The StreamWeasels Twitch Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions up to, and including, 1.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that
ible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eed5b1ea-213c-4a37-b357-8d058af86d38?source=cve - https://plugins.trac.wordpress.org/browser/streamweasels-twitch-integration/trunk/public/js/streamweasels-public.js#L1349 - https://plugins.trac.wordpress.org/changeset/3335250
CVE ID: CVE-2025-7810 State: PUBLISHED Published: 2025-07-29T03:41:21.378Z Last Updated: 2025-07-29T13:47:50.448Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: streamweasels Products: StreamWeasels Kick Integration Problem Types: CWE-79 Description: The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wil
for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b564eacd-1561-4c42-8a9e-395d4e951723?source=cve - https://plugins.trac.wordpress.org/browser/streamweasels-kick-integration/trunk/public/js/streamweasels-kick-public.js#L574 - https://plugins.trac.wordpress.org/changeset/3335307#file11
CVE ID: CVE-2025-7811 State: PUBLISHED Published: 2025-07-29T03:41:22.294Z Last Updated: 2025-07-29T14:04:43.244Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: streamweasels Products: StreamWeasels YouTube Integration Problem Types: CWE-79 Description: The StreamWeasels YouTube Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages th
ssible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fb6783b4-f7a5-4f8f-a8d0-5f5c7f91f687?source=cve - https://plugins.trac.wordpress.org/browser/streamweasels-youtube-integration/trunk/public/js/streamweasels-youtube-public.js#L874 - https://plugins.trac.wordpress.org/changeset/3335284#file11
CVE ID: CVE-2025-7812 State: PUBLISHED Published: 2025-08-28T01:46:29.920Z Last Updated: 2025-08-28T14:20:09.272Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: videowhisper Products: Video Share VOD – Turnkey Video Site Builder Script Problem Types: CWE-352 Description: The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.6. This is due to missing or incorrect nonce validation on the adminExport() function. This makes it possible for unauthenticated attackers to update settings and execute remote code when the Server command execution setting is enab
r unauthenticated attackers to update settings and execute remote code when the Server command execution setting is enabled via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b9e499c4-e683-4587-b0ab-7f4ecde94e41?source=cve - https://plugins.trac.wordpress.org/browser/video-share-vod/trunk/video-share-vod.php#L3360 - https://plugins.trac.wordpress.org/browser/video-share-vod/trunk/inc/options.php#L728 - https://plugins.trac.wordpress.org/changeset/3348480/video-share-vod/trunk/video-share-vod.php
CVE ID: CVE-2025-7813 State: PUBLISHED Published: 2025-08-23T05:48:19.990Z Last Updated: 2025-08-25T18:43:09.697Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: arraytics Products: Eventin – AI Powered Event Manager, Events Calendar, Booking and Tickets Plugin Problem Types: CWE-918 Description: The Events Calendar, Event Booking, Registrations and Event Tickets – Eventin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.37 via the proxy_image function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used t
thenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a73f806d-5d64-4df5-b032-3d3a149036ff?source=cve - https://plugins.trac.wordpress.org/browser/wp-event-solution/trunk/core/Admin/hooks.php#L451 - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-event-solution/event-manager-events-calendar-tickets-registrations-eventin-4026-unauthenticated-arbitrary-file-read - https://plugins.trac.wordpress.org/changeset/3345781/wp-event-s
tions-eventin-4026-unauthenticated-arbitrary-file-read - https://plugins.trac.wordpress.org/changeset/3345781/wp-event-solution/tags/4.0.38/core/Admin/hooks.php
CVE ID: CVE-2025-7814 State: PUBLISHED Published: 2025-07-18T21:44:05.160Z Last Updated: 2025-07-21T15:19:20.606Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Food Ordering Review System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in code-projects Food Ordering Review System 1.0. This vulnerability affects unknown code of the file /pages/signup_function.php. The manipulation of the argument fname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes:
has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316918 - https://vuldb.com/?ctiid.316918 - https://vuldb.com/?submit.616770 - https://github.com/n0name-yang/myCVE/issues/4 - https://code-projects.org/
CVE ID: CVE-2025-7815 State: PUBLISHED Published: 2025-07-19T09:32:07.509Z Last Updated: 2025-07-21T16:10:24.236Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Apartment Visitors Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in PHPGurukul Apartment Visitors Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php of the component HTTP POST Request Handler. The manipulation of the argument visname leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and
me leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316919 - https://vuldb.com/?ctiid.316919 - https://vuldb.com/?submit.616769 - https://github.com/HieuGITLAB/my-cves/issues/3 - https://phpgurukul.com/
CVE ID: CVE-2025-7816 State: PUBLISHED Published: 2025-07-19T10:32:06.842Z Last Updated: 2025-07-21T15:39:50.722Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Apartment Visitors Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in PHPGurukul Apartment Visitors Management System 1.0. Affected is an unknown function of the file /visitor-detail.php of the component HTTP POST Request Handler. The manipulation of the argument visname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316920 - https://vuldb.com/?ctiid.316920 - https://vuldb.com/?submit.616822 - https://github.com/HieuGITLAB/my-cves/issues/4 - https://phpgurukul.com/
CVE ID: CVE-2025-7817 State: PUBLISHED Published: 2025-07-19T11:32:07.337Z Last Updated: 2025-07-21T15:43:34.956Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Apartment Visitors Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in PHPGurukul Apartment Visitors Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /bwdates-reports.php of the component HTTP POST Request Handler. The manipulation of the argument visname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public a
sname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316921 - https://vuldb.com/?ctiid.316921 - https://vuldb.com/?submit.616828 - https://github.com/HieuGITLAB/my-cves/issues/5 - https://phpgurukul.com/
CVE ID: CVE-2025-7818 State: PUBLISHED Published: 2025-07-19T12:02:06.810Z Last Updated: 2025-07-21T15:44:37.831Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Apartment Visitors Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /category.php of the component HTTP POST Request Handler. The manipulation of the argument categoryname leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be use
o cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316922 - https://vuldb.com/?ctiid.316922 - https://vuldb.com/?submit.616834 - https://github.com/HieuGITLAB/my-cves/issues/6 - https://phpgurukul.com/
CVE ID: CVE-2025-7819 State: PUBLISHED Published: 2025-07-19T12:14:07.079Z Last Updated: 2025-07-21T15:45:51.594Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:ND/RL:ND/RC:UR) Vendors: PHPGurukul Products: Apartment Visitors Management System Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /create-pass.php of the component HTTP POST Request Handler. The manipulation of the argument visname leads to cross site scripting. It is possible to initiate the attack remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ipting. It is possible to initiate the attack remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316923 - https://vuldb.com/?ctiid.316923 - https://vuldb.com/?submit.616839 - https://github.com/HieuGITLAB/my-cves/issues/7 - https://phpgurukul.com/
CVE ID: CVE-2025-7821 State: PUBLISHED Published: 2025-08-23T04:25:48.541Z Last Updated: 2025-08-25T16:44:00.584Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: wcplus Products: WC Plus Problem Types: CWE-862 Description: The WC Plus plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pluswc_logo_favicon_logo_base' AJAX action in all versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to update the site's favicon logo base. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dd35a017-3b80
st Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dd35a017-3b80-483d-8144-3986ea064669?source=cve - https://wordpress.org/plugins/wc-plus/
CVE ID: CVE-2025-7822 State: PUBLISHED Published: 2025-07-24T09:22:18.285Z Last Updated: 2025-07-24T13:35:43.601Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: alexalouit Products: WP Wallcreeper Problem Types: CWE-862 Description: The WP Wallcreeper plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_notices hook in all versions up to, and including, 1.6.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable and disable caching. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabi
ching. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/629f36e3-f4a4-43a6-a98b-960088c8dd77?source=cve - https://plugins.trac.wordpress.org/browser/wp-wallcreeper/trunk/wp-wallcreeper.php#L166
CVE ID: CVE-2025-7823 State: PUBLISHED Published: 2025-07-19T12:44:06.138Z Last Updated: 2025-07-21T15:46:51.806Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Jinher Products: OA Problem Types: CWE-611, CWE-610 Description: A vulnerability was found in Jinher OA 1.2. It has been declared as problematic. This vulnerability affects unknown code of the file ProjectScheduleDelete.aspx. The manipulation leads to xml external entity reference. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316924 - https://vuldb.com/?ctiid.316
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316924 - https://vuldb.com/?ctiid.316924 - https://vuldb.com/?submit.616841 - https://github.com/cc2024k/CVE/issues/3
CVE ID: CVE-2025-7824 State: PUBLISHED Published: 2025-07-19T13:02:05.434Z Last Updated: 2025-07-21T15:48:01.570Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Jinher Products: OA Problem Types: CWE-611, CWE-610 Description: A vulnerability was found in Jinher OA 1.1. It has been rated as problematic. This issue affects some unknown processing of the file XmlHttp.aspx. The manipulation leads to xml external entity reference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316925 - https://vuldb.com/?ctiid.316925 - https://
Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.316925 - https://vuldb.com/?ctiid.316925 - https://vuldb.com/?submit.616842 - https://github.com/cc2024k/CVE/issues/2
CVE ID: CVE-2025-7825 State: PUBLISHED Published: 2025-10-03T11:17:21.024Z Last Updated: 2025-10-03T13:58:33.363Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: wpt00ls Products: Schema Plugin For Divi, Gutenberg & Shortcodes Problem Types: CWE-96 Description: The Schema Plugin For Divi, Gutenberg & Shortcodes plugin for WordPress is vulnerable to Object Instantiation in all versions up to, and including, 4.3.2 via deserialization of untrusted input via the wpt_schema_breadcrumbs shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable soft
s, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ccb81a3e-744f-4a16-ad9b-1b9dbc09571c?source=cve - https://wordpress.org/plugins/wp-
.com/threat-intel/vulnerabilities/id/ccb81a3e-744f-4a16-ad9b-1b9dbc09571c?source=cve - https://wordpress.org/plugins/wp-structured-data-schema/
CVE ID: CVE-2025-7826 State: PUBLISHED Published: 2025-09-10T06:38:48.287Z Last Updated: 2025-09-10T20:29:36.216Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: laki_patel Products: Testimonial Problem Types: CWE-89 Description: The Testimonial plugin for WordPress is vulnerable to SQL Injection via the 'iNICtestimonial' shortcode in all versions up to, and including, 2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be
rs, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/840fefde-8c9d-413f-a6a6-1e796fb9e910?source=cve - https://wordpress.org/plugins/indianic-testimonial/
CVE ID: CVE-2025-7827 State: PUBLISHED Published: 2025-08-23T04:25:46.212Z Last Updated: 2025-08-25T17:34:55.886Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: anzia Products: Ni WooCommerce Customer Product Report Problem Types: CWE-862 Description: The Ni WooCommerce Customer Product Report plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ni_woocpr_action() function in all versions up to, and including, 1.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ber-level access and above, to update plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/35b02e79-9d31-482a-92b9-b1e8201d45f1?source=cve - https://wordpress.org/plugins/ni-woocommerce-customer-product-report/
CVE ID: CVE-2025-7828 State: PUBLISHED Published: 2025-08-23T04:25:48.156Z Last Updated: 2025-08-25T17:01:36.224Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: evigeo Products: WP Filter & Combine RSS Feeds Problem Types: CWE-862 Description: The WP Filter & Combine RSS Feeds plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the post_listing_page() function in all versions up to, and including, 0.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete feeds. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/t