Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ng locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304643 - https://vuldb.com/?ctiid.304643 - https://vuldb.com/?submit.550136 - https://github.com/joelittlejohn/jsonschema2pojo/issues/1672 - https://github.com/joelittlejohn/jsonschema2pojo/issues/1672#issue-2968446816
CVE ID: CVE-2025-3589 State: PUBLISHED Published: 2025-04-14T21:00:07.701Z Last Updated: 2025-04-14T21:14:34.968Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Music Class Enrollment System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in SourceCodester Music Class Enrollment System 1.0. Affected is an unknown function of the file /manage_class.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com
closed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304644 - https://vuldb.com/?ctiid.304644 - https://vuldb.com/?submit.550267 - https://github.com/byxs0x0/SQL/blob/main/SQL6.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-3590 State: PUBLISHED Published: 2025-04-14T21:31:04.736Z Last Updated: 2025-04-15T03:57:11.528Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Adianti Products: Framework Problem Types: CWE-502, CWE-20 Description: A vulnerability has been found in Adianti Framework up to 8.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 8.1 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: R
ss this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304645 - https://vuldb.com/?ctiid.304645 - https://vuldb.com/?submit.550296 - https://gist.github.com/mcdruid/8412cfb55f443a1344ff41af0ce1b215
CVE ID: CVE-2025-3591 State: PUBLISHED Published: 2025-04-14T22:00:09.469Z Last Updated: 2025-04-15T03:10:56.015Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: ZHENFENG13, code-projects Products: My-Blog-layui Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in ZHENFENG13/code-projects My-Blog-layui 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/v1/blog/edit. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Multiple parameters might be affected. The vendor was contacted early about this disclosure but di
blic and may be used. Multiple parameters might be affected. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304646 - https://vuldb.com/?ctiid.304646 - https://vuldb.com/?submit.550909 - https://github.com/buluorifu/Vulnerability-recurrence/blob/main/Refer/My-Blog-layui-xss-1.md
CVE ID: CVE-2025-3592 State: PUBLISHED Published: 2025-04-14T22:00:11.419Z Last Updated: 2025-04-15T03:09:51.714Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: ZHENFENG13, code-projects Products: My-Blog-layui Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in ZHENFENG13/code-projects My-Blog-layui 1.0. It has been classified as problematic. This affects an unknown part of the file /admin/v1/link/edit. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Multiple parameters might be affected. The vendor was contacted early about this disclosure but did no
and may be used. Multiple parameters might be affected. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304647 - https://vuldb.com/?ctiid.304647 - https://vuldb.com/?submit.550910 - https://github.com/buluorifu/Vulnerability-recurrence/blob/main/Refer/My-Blog-layui-xss-2.md
CVE ID: CVE-2025-3593 State: PUBLISHED Published: 2025-04-14T22:31:04.528Z Last Updated: 2025-04-15T03:07:55.446Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: ZHENFENG13, code-projects Products: My-Blog-layui Problem Types: CWE-434, CWE-284 Description: A vulnerability was found in ZHENFENG13/code-projects My-Blog-layui 1.0. It has been declared as critical. This vulnerability affects the function Upload of the file /admin/upload/authorImg/. The manipulation of the argument File leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respo
has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304648 - https://vuldb.com/?ctiid.304648 - https://vuldb.com/?submit.550912 - https://github.com/buluorifu/Vulnerability-recurrence/blob/main/Refer/My-Blog-layui-fileUpload.md
CVE ID: CVE-2025-3594 State: PUBLISHED Published: 2025-06-16T14:13:54.426Z Last Updated: 2025-08-22T03:55:47.029Z Vendors: Liferay Products: Portal, DXP Problem Types: CWE-22 Description: Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 34, and older unsupported versions allows remote attackers to (1) add files to arbitrary locations on the server and (2) download and execute arbitrary files from the download server via the `_com_liferay_server_admin_web_portlet_ServerAdminPortlet_jarName` parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lifer
et_ServerAdminPortlet_jarName` parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3594
CVE ID: CVE-2025-3597 State: PUBLISHED Published: 2025-05-12T06:00:02.515Z Last Updated: 2025-05-12T17:31:53.398Z Vendors: Unknown Products: Firelight Lightbox Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled. While this feature is meant to only be available to Pro version users, it can be activated in the free version too, making it theoretically exploitable there as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8bf5e107-6397-4946-aaee-
ditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8bf5e107-6397-4946-aaee-bf61d3e2dffd/
CVE ID: CVE-2025-3598 State: PUBLISHED Published: 2025-04-18T05:22:59.653Z Last Updated: 2025-04-18T12:00:53.188Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: elliotvs Products: Coupon Affiliates – Affiliate Plugin for WooCommerce Problem Types: CWE-79 Description: The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the commission_summary parameter in all versions up to, and including, .6.3.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successful
s it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2d6cf33c-ac40-4892-9345-64ebe61e6be6?source=cve - https://plugins.trac.wordpress.org/browser/woo-coupon-usage/tags/6.2.2/inc/functions/functions-all-time.php#L245
CVE ID: CVE-2025-3599 State: PUBLISHED Published: 2025-04-30T16:49:18.064Z Last Updated: 2025-04-30T17:27:30.872Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Symantec Products: Symantec Endpoint Protection Problem Types: CWE-367 Description: Symantec Endpoint Protection Windows Agent, running an ERASER Engine prior to 119.1.7.8, may be susceptible to an Elevation of Privilege vulnerability, which may allow an attacker to delete resources that are normally protected from an application or user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvis
chment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25659
CVE ID: CVE-2025-3600 State: PUBLISHED Published: 2025-05-14T13:21:40.770Z Last Updated: 2025-08-27T14:54:22.319Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Progress Software Products: Telerik UI for ASP.NET AJAX Problem Types: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') Description: In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may lead to an unhandled exception resulting in a crash of the hosting process and denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.telerik.com/products/aspnet-ajax/documentat
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-unsafe-reflection-cve-2025-3600
CVE ID: CVE-2025-3601 State: PUBLISHED Published: 2025-08-27T19:33:50.920Z Last Updated: 2025-08-27T19:54:21.123Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: CWE-770 Description: An issue has been discovered in GitLab CE/EE affecting all versions from 8.15 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that could have could have allowed an authenticated user to cause a Denial of Service (DoS) condition by submitting URLs that generate excessively large responses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/536034 - https://hackerone.com/re
: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/536034 - https://hackerone.com/reports/3050155
CVE ID: CVE-2025-3602 State: PUBLISHED Published: 2025-06-16T13:50:04.254Z Last Updated: 2025-06-16T14:30:21.750Z Vendors: Liferay Products: Portal, DXP Problem Types: CWE-400 Description: Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and 7.2 fix pack 8 through fix pack 20 does not limit the depth of a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing complex queries. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-3602
CVE ID: CVE-2025-3603 State: PUBLISHED Published: 2025-04-24T08:23:53.258Z Last Updated: 2025-04-24T13:06:15.552Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: v1rustyle Products: Flynax Bridge Problem Types: CWE-620 Description: The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account. Additi
o change arbitrary user's passwords, including administrators, and leverage that to gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fa8124db-ee6a-481d-88c6-4cc84fefcf1c?source=cve - https://plugins.trac.wordpress.org/browser/flynax-bridge/trunk/request.php
CVE ID: CVE-2025-3604 State: PUBLISHED Published: 2025-04-24T08:23:49.297Z Last Updated: 2025-04-24T13:56:54.288Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: v1rustyle Products: Flynax Bridge Problem Types: CWE-862 Description: The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gai
hange arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/935caa43-4c75-47ad-a631-63988e21f834?source=cve - https://plugins.trac.wordpress.org/browser/flynax-bridge/trunk/request.php
CVE ID: CVE-2025-3605 State: PUBLISHED Published: 2025-05-09T06:42:34.761Z Last Updated: 2025-05-09T15:43:02.560Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: arkenon Products: Frontend Login and Registration Blocks Problem Types: CWE-639 Description: The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.7. This is due to the plugin not properly validating a user's identity prior to updating their details like email via the flr_blocks_user_settings_handle_ajax_callback() function. This makes it possible for unauthenticated attackers to change a
r_blocks_user_settings_handle_ajax_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0c11668c-6dc3-4539-b2be-bf6528bed73e?source=cve - https://plugins.trac.wordpress.org/browser/frontend-login-and-registration-blocks/trunk/inc/class-flr-blocks-user-settings.php#L59
CVE ID: CVE-2025-3606 State: PUBLISHED Published: 2025-04-24T23:15:52.975Z Last Updated: 2025-04-25T16:02:38.056Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Vestel Products: AC Charger EVC04 Problem Types: CWE-497 Description: Vestel AC Charger version 3.75.0 contains a vulnerability that could enable an attacker to access files containing sensitive information, such as credentials which could be used to further compromise the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-03 - https://firebasestorage.googleapis.com/v0/b/vestel-shield.firebasestorage.app/o/PRODUCTION%2F1
visories/icsa-25-114-03 - https://firebasestorage.googleapis.com/v0/b/vestel-shield.firebasestorage.app/o/PRODUCTION%2F1%2FVSA-1_R2.pdf?alt=media&token=8201f299-5014-4720-9200-f1b335736ac1
CVE ID: CVE-2025-3607 State: PUBLISHED Published: 2025-04-24T08:23:49.815Z Last Updated: 2025-04-24T13:55:34.115Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: arkenon Products: Frontend Login and Registration Blocks Problem Types: CWE-620 Description: The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.7. This is due to the plugin not properly validating a user's identity prior to updating a password. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords, including adminis
authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b06ce1e4-5cfb-415d-ad09-db194d6b4354?source=cve - https://plugins.trac.wordpress.org/browser/frontend-login-and-registration-blocks/trunk/inc/class-flr-blocks-lost-password.php#L115
CVE ID: CVE-2025-3608 State: PUBLISHED Published: 2025-04-15T12:57:28.868Z Last Updated: 2025-04-18T14:43:41.037Z Vendors: Mozilla Products: Firefox Problem Types: Race condition in nsHttpTransaction could lead to memory corruption Description: A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability affects Firefox < 137.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1951554 - https://www.cve.org/CVERecord?id=CVE-2025-3608 - https://www.mozilla.org/security/advisories/mfsa2025-25/
CVE ID: CVE-2025-3609 State: PUBLISHED Published: 2025-05-06T01:42:44.208Z Last Updated: 2025-05-06T02:36:28.381Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: pixel_prime Products: Reales WP STPT Problem Types: CWE-863 Description: The Reales WP STPT plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 2.1.2. This is due to the 'reales_user_signup_form' AJAX action not verifying if user registration is enabled, prior to registering a user. This makes it possible for unauthenticated attackers to create new user accounts, which can be leveraged with CVE-XX to achieve privilege escalation. Additional Anal
tackers to create new user accounts, which can be leveraged with CVE-XX to achieve privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f9f3250f-39a1-4ba1-b9a2-222926635ca0?source=cve - https://themeforest.net/item/reales-wp-real-estate-wordpress-theme/10330568
CVE ID: CVE-2025-3610 State: PUBLISHED Published: 2025-05-06T01:42:43.628Z Last Updated: 2025-05-06T02:37:17.530Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: pixel_prime Products: Reales WP STPT Problem Types: CWE-639 Description: The Reales WP STPT plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.1.2. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's passwords and email addresses, including administrators
th subscriber-level access and above, to change arbitrary user's passwords and email addresses, including administrators, and leverage that to gain access to their account. This can be combined with CVE-2025-3609 to achieve remote code execution as an originally unauthenticated user with no account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/38c6b149-39d7-491a-9f3a-261087a52a03?source=cve - https://themeforest.net/item/reales-wp-real-estate-wordpress-theme/10330568
CVE ID: CVE-2025-3611 State: PUBLISHED Published: 2025-05-30T14:22:09.854Z Last Updated: 2025-05-30T14:37:42.109Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team endpoints, even when explicitly configured with 'No access' to Teams in the System Console. Additional Analyst Notes: - CISA ADP Vulnrichment
explicitly configured with 'No access' to Teams in the System Console. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-3612 State: PUBLISHED Published: 2025-04-15T03:00:06.701Z Last Updated: 2025-04-15T03:52:23.146Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Demtec Products: Graphytics Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, was found in Demtec Graphytics 5.0.7. This affects an unknown part of the file /visualization of the component HTTP GET Parameter Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst N
d may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304671 - https://vuldb.com/?ctiid.304671 - https://vuldb.com/?submit.551123 - https://github.com/HexC0d3/graphlytic-xss-exploits/blob/main/reflected_xss.md
CVE ID: CVE-2025-3613 State: PUBLISHED Published: 2025-04-15T03:00:08.958Z Last Updated: 2025-04-15T12:05:38.539Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Demtec Products: Graphytics Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in Demtec Graphytics 5.0.7 and classified as problematic. This vulnerability affects unknown code of the file /visualization. The manipulation of the argument description leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP V
vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.304672 - https://vuldb.com/?ctiid.304672 - https://vuldb.com/?submit.551172 - https://github.com/HexC0d3/graphlytic-xss-exploits/blob/main/stored_xss.md
CVE ID: CVE-2025-3614 State: PUBLISHED Published: 2025-07-24T22:23:36.960Z Last Updated: 2025-07-25T13:31:27.312Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: xpeedstudio Products: ElementsKit Elementor Addons and Templates Problem Types: CWE-79 Description: The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of a custom widget in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will ex