Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-39519 State: PUBLISHED Published: 2025-04-17T15:46:57.086Z Last Updated: 2025-04-17T18:39:53.718Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: rtpHarry Products: Bulk Page Stub Creator Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtpHarry Bulk Page Stub Creator allows Reflected XSS. This issue affects Bulk Page Stub Creator: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bulk-page-stub-creator/vulnerability/wordpress-bulk-page-stub-creator-plugin-1-1-reflected-cr
/database/wordpress/plugin/bulk-page-stub-creator/vulnerability/wordpress-bulk-page-stub-creator-plugin-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39520 State: PUBLISHED Published: 2025-04-16T12:45:50.233Z Last Updated: 2025-04-16T13:26:22.367Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WP Wham Products: Checkout Files Upload for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham Checkout Files Upload for WooCommerce allows Stored XSS. This issue affects Checkout Files Upload for WooCommerce: from n/a through 2.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/checkout-files-upload-woocommerce/vulnerability/w
chment: References: - https://patchstack.com/database/wordpress/plugin/checkout-files-upload-woocommerce/vulnerability/wordpress-checkout-files-upload-for-woocommerce-2-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39521 State: PUBLISHED Published: 2025-04-17T15:46:56.461Z Last Updated: 2025-04-17T18:40:03.763Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Ashish Ajani Products: Contact Form vCard Generator Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani Contact Form vCard Generator allows Reflected XSS. This issue affects Contact Form vCard Generator: from n/a through 2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/contact-form-vcard-generator/vulnerability/wordpress-contact-form-v
: - https://patchstack.com/database/wordpress/plugin/contact-form-vcard-generator/vulnerability/wordpress-contact-form-vcard-generator-plugin-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39522 State: PUBLISHED Published: 2025-04-16T12:45:49.617Z Last Updated: 2025-04-16T13:14:24.582Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Sebastian Lee Products: Dynamic Post Problem Types: CWE-862 Description: Missing Authorization vulnerability in Sebastian Lee Dynamic Post allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Dynamic Post: from n/a through 4.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/dynamic-post/vulnerability/wordpress-dynamic-post-4-10-settings-change-vulnerability?_s_id=cve
CVE ID: CVE-2025-39523 State: PUBLISHED Published: 2025-09-09T16:25:30.625Z Last Updated: 2025-09-09T18:41:17.625Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: GoodBarber Products: GoodBarber Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in GoodBarber GoodBarber. This issue affects GoodBarber: from n/a through 1.0.26. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/goodbarber/vulnerability/wordpress-goodbarber-1-0-26-open-redirection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39524 State: PUBLISHED Published: 2025-04-16T12:45:49.051Z Last Updated: 2025-04-16T13:15:39.316Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: bPlugins Products: Html5 Audio Player Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in bPlugins Html5 Audio Player allows Stored XSS. This issue affects Html5 Audio Player: from n/a through 2.2.28. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/html5-audio-player/vulnerability/wordpress-html5-audio-player-2-2-28-cross-site-scripting-xss-vulnerability?_s
ss/plugin/html5-audio-player/vulnerability/wordpress-html5-audio-player-2-2-28-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39525 State: PUBLISHED Published: 2025-04-16T12:45:48.469Z Last Updated: 2025-04-16T13:16:04.924Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: wpWax Products: Logo Carousel Slider Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Logo Carousel Slider allows Stored XSS. This issue affects Logo Carousel Slider: from n/a through 2.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/logo-carousel-slider/vulnerability/wordpress-logo-carousel-slider-2-1-3-cross-site-scripting-xss-vulnera
ordpress/plugin/logo-carousel-slider/vulnerability/wordpress-logo-carousel-slider-2-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39526 State: PUBLISHED Published: 2025-04-17T15:46:55.857Z Last Updated: 2025-04-17T18:40:11.559Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: nicdark Products: Hotel Booking Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nicdark Hotel Booking allows PHP Local File Inclusion. This issue affects Hotel Booking: from n/a through 3.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/nd-booking/vulnerability/wordpress-hotel-booking-plugin-3-6-local-file-inclusion-vulnerabili
m/database/wordpress/plugin/nd-booking/vulnerability/wordpress-hotel-booking-plugin-3-6-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39527 State: PUBLISHED Published: 2025-04-17T15:46:55.251Z Last Updated: 2025-04-17T18:40:20.262Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: bestwebsoft Products: Rating by BestWebSoft Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in bestwebsoft Rating by BestWebSoft allows Object Injection. This issue affects Rating by BestWebSoft: from n/a through 1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/rating-bws/vulnerability/wordpress-rating-by-bestwebsoft-1-7-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39528 State: PUBLISHED Published: 2025-04-16T12:45:47.835Z Last Updated: 2025-04-16T13:16:35.803Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Rescue Themes Products: Rescue Shortcodes Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rescue Themes Rescue Shortcodes allows Stored XSS. This issue affects Rescue Shortcodes: from n/a through 3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/rescue-shortcodes/vulnerability/wordpress-rescue-shortcodes-plugin-3-1-cross-site-scripting-xss-vul
ase/wordpress/plugin/rescue-shortcodes/vulnerability/wordpress-rescue-shortcodes-plugin-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39529 State: PUBLISHED Published: 2025-04-16T12:45:47.259Z Last Updated: 2025-04-16T13:17:08.755Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Robin Cornett Products: Scriptless Social Sharing Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robin Cornett Scriptless Social Sharing allows Stored XSS. This issue affects Scriptless Social Sharing: from n/a through 3.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/scriptless-social-sharing/vulnerability/wordpress-scriptless-social-shari
tps://patchstack.com/database/wordpress/plugin/scriptless-social-sharing/vulnerability/wordpress-scriptless-social-sharing-3-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39530 State: PUBLISHED Published: 2025-04-16T12:45:46.630Z Last Updated: 2025-04-16T13:18:34.363Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: dsky Products: Site Search 360 Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in dsky Site Search 360 allows Stored XSS. This issue affects Site Search 360: from n/a through 2.1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/site-search-360/vulnerability/wordpress-site-search-360-plugin-2-1-7-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39531 State: PUBLISHED Published: 2025-04-16T12:45:46.004Z Last Updated: 2025-04-16T13:28:21.409Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: slazzercom Products: Slazzer Background Changer Problem Types: CWE-862 Description: Missing Authorization vulnerability in slazzercom Slazzer Background Changer allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Slazzer Background Changer: from n/a through 3.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/slazzer-background-changer/vulnerability/wordpress-slazzer-background-changer-3-14-broken-acc
/database/wordpress/plugin/slazzer-background-changer/vulnerability/wordpress-slazzer-background-changer-3-14-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-39532 State: PUBLISHED Published: 2025-04-17T15:46:54.592Z Last Updated: 2025-04-17T18:40:27.138Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: spicethemes Products: Spice Blocks Problem Types: CWE-862 Description: Missing Authorization vulnerability in spicethemes Spice Blocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Spice Blocks: from n/a through 2.0.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/spice-blocks/vulnerability/wordpress-spice-blocks-2-0-7-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-39533 State: PUBLISHED Published: 2025-04-17T15:46:53.981Z Last Updated: 2025-04-17T18:40:35.617Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Starfish Reviews Products: Starfish Review Generation & Marketing Problem Types: CWE-862 Description: Missing Authorization vulnerability in Starfish Reviews Starfish Review Generation & Marketing allows Privilege Escalation. This issue affects Starfish Review Generation & Marketing: from n/a through 3.1.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/starfish-reviews/vulnerability/wordpress-starfish-review-generation-marketing-plu
tchstack.com/database/wordpress/plugin/starfish-reviews/vulnerability/wordpress-starfish-review-generation-marketing-plugin-3-1-14-arbitrary-option-update-to-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-39534 State: PUBLISHED Published: 2025-10-22T14:32:05.744Z Last Updated: 2025-11-13T10:33:40.492Z Vendors: Somonator Products: Terms Dictionary Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Somonator Terms Dictionary terms-dictionary allows Reflected XSS.This issue affects Terms Dictionary: from n/a through <= 1.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/terms-dictionary/vulnerability/wordpress-terms-dictionary-plugin-1-5-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39535 State: PUBLISHED Published: 2025-04-17T15:46:53.344Z Last Updated: 2025-04-17T18:40:43.868Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: appsbd Products: Vitepos Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos allows Authentication Abuse. This issue affects Vitepos: from n/a through 3.1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/vitepos-lite/vulnerability/wordpress-vitepos-3-1-7-broken-authentication-vulnerability?_s_id=cve
CVE ID: CVE-2025-39536 State: PUBLISHED Published: 2025-05-23T12:43:49.339Z Last Updated: 2025-05-23T15:12:02.031Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Chimpstudio Products: JobHunt Job Alerts Problem Types: CWE-862 Description: Missing Authorization vulnerability in Chimpstudio JobHunt Job Alerts allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobHunt Job Alerts: from n/a through 3.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jobhunt-notifications/vulnerability/wordpress-jobhunt-job-alerts-3-6-arbitrary-content-deletion-vulnerability?
ss/plugin/jobhunt-notifications/vulnerability/wordpress-jobhunt-job-alerts-3-6-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39537 State: PUBLISHED Published: 2025-05-16T15:45:22.765Z Last Updated: 2025-05-16T16:49:18.252Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Chimpstudio Products: WP JobHunt Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Chimpstudio WP JobHunt allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP JobHunt: from n/a through 7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-jobhunt/vulnerability/wordpress-wp-jobhunt-7-1-insecure-direct-object-references-idor-vulnerability?_s
rdpress/plugin/wp-jobhunt/vulnerability/wordpress-wp-jobhunt-7-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE ID: CVE-2025-39538 State: PUBLISHED Published: 2025-04-16T12:45:45.374Z Last Updated: 2025-04-16T13:28:58.912Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: Mathieu Chartier Products: WP-Advanced-Search Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Mathieu Chartier WP-Advanced-Search allows Upload a Web Shell to a Web Server. This issue affects WP-Advanced-Search: from n/a through 3.3.9.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-advanced-search/vulnerability/wordpress-wp-advanced-search-3-3-9-3-arbitrary-file-upload-vulner
base/wordpress/plugin/wp-advanced-search/vulnerability/wordpress-wp-advanced-search-3-3-9-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-39539 State: PUBLISHED Published: 2025-06-09T15:54:13.691Z Last Updated: 2025-06-10T13:52:15.368Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: quitenicestuff Products: Soho Hotel Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quitenicestuff Soho Hotel allows Reflected XSS. This issue affects Soho Hotel: from n/a through 4.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/soho-hotel/vulnerability/wordpress-soho-hotel-4-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39540 State: PUBLISHED Published: 2025-04-16T12:45:44.743Z Last Updated: 2025-04-16T13:41:31.053Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Rhys Wynne Products: WP Flipclock Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rhys Wynne WP Flipclock allows DOM-Based XSS. This issue affects WP Flipclock: from n/a through 1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-flipclock/vulnerability/wordpress-wp-flipclock-plugin-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39541 State: PUBLISHED Published: 2025-09-09T16:25:30.058Z Last Updated: 2025-09-09T18:41:23.445Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Roland Murg Products: WP Simple Booking Calendar Problem Types: CWE-862 Description: Missing Authorization vulnerability in Roland Murg WP Simple Booking Calendar. This issue affects WP Simple Booking Calendar: from n/a through 2.0.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-simple-booking-calendar/vulnerability/wordpress-wp-simple-booking-calendar-plugin-2-0-13-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-39542 State: PUBLISHED Published: 2025-04-17T15:46:52.675Z Last Updated: 2025-04-17T18:40:53.229Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Jauhari Xelion Products: Xelion Webchat Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in Jauhari Xelion Xelion Webchat allows Privilege Escalation. This issue affects Xelion Webchat: from n/a through 9.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/xelion-webchat/vulnerability/wordpress-xelion-webchat-9-1-0-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-39543 State: PUBLISHED Published: 2025-04-16T12:44:40.666Z Last Updated: 2025-04-16T13:42:00.851Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WP Royal Products: Royal Elementor Addons Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons allows Stored XSS. This issue affects Royal Elementor Addons: from n/a through 1.3.977. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/royal-elementor-addons/vulnerability/wordpress-royal-elementor-addons-plugin-1-3-977-cross
com/database/wordpress/plugin/royal-elementor-addons/vulnerability/wordpress-royal-elementor-addons-plugin-1-3-977-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39544 State: PUBLISHED Published: 2025-04-16T12:44:40.080Z Last Updated: 2025-04-16T13:42:28.396Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: Bill Minozzi Products: WP Tools Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Bill Minozzi WP Tools allows Path Traversal. This issue affects WP Tools: from n/a through 5.18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wptools/vulnerability/wordpress-wp-tools-plugin-5-18-csrf-to-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39545 State: PUBLISHED Published: 2025-04-16T12:44:39.462Z Last Updated: 2025-04-16T13:43:01.174Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: miniOrange Products: WordPress REST API Authentication Problem Types: CWE-862 Description: Missing Authorization vulnerability in miniOrange WordPress REST API Authentication allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WordPress REST API Authentication: from n/a through 3.6.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-rest-api-authentication/vulnerability/wordpress-wordpress-re
nces: - https://patchstack.com/database/wordpress/plugin/wp-rest-api-authentication/vulnerability/wordpress-wordpress-rest-api-authentication-3-6-3-settings-change-vulnerability?_s_id=cve
CVE ID: CVE-2025-39546 State: PUBLISHED Published: 2025-04-16T12:44:38.814Z Last Updated: 2025-04-16T13:43:30.340Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: quomodosoft Products: ElementsReady Addons for Elementor Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in quomodosoft ElementsReady Addons for Elementor allows Cross Site Request Forgery. This issue affects ElementsReady Addons for Elementor: from n/a through 6.6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/element-ready-lite/vulnerability/wordpress-elementsready-addons-for-elementor-6-6-2-
stack.com/database/wordpress/plugin/element-ready-lite/vulnerability/wordpress-elementsready-addons-for-elementor-6-6-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-39547 State: PUBLISHED Published: 2025-04-16T12:44:38.197Z Last Updated: 2025-04-16T13:44:01.700Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Toast Plugins Products: Internal Link Optimiser Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Toast Plugins Internal Link Optimiser allows Stored XSS. This issue affects Internal Link Optimiser: from n/a through 5.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/internal-link-finder/vulnerability/wordpress-internal-link-optimiser-plugin-5-1-3-csrf-to-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39548 State: PUBLISHED Published: 2025-04-16T12:44:37.588Z Last Updated: 2025-04-16T13:19:18.284Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: A WP Life Products: Right Click Disable OR Ban Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Right Click Disable OR Ban allows Stored XSS. This issue affects Right Click Disable OR Ban: from n/a through 1.1.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/right-click-disable-or-ban/vulnerability/wordpress-right-click-disable-or-ban-plugin-1-1-17-csrf-to-stored-xss-vulnerability?_s_i
ck-disable-or-ban/vulnerability/wordpress-right-click-disable-or-ban-plugin-1-1-17-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39549 State: PUBLISHED Published: 2025-04-16T12:44:36.912Z Last Updated: 2025-04-16T13:19:50.464Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: whiletrue Products: Most And Least Read Posts Widget Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in whiletrue Most And Least Read Posts Widget allows Stored XSS. This issue affects Most And Least Read Posts Widget: from n/a through 2.5.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/most-and-least-read-posts-widget/vulnerability/wordpress-mo
ferences: - https://patchstack.com/database/wordpress/plugin/most-and-least-read-posts-widget/vulnerability/wordpress-most-and-least-read-posts-widget-2-5-20-cross-site-scripting-xss-vulnerability?_s_id=cve