Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
and including, 2.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f0cb666b-bfab-492f-a74e-11dc9b171136?source=cve - https://plugins.trac.wordpress.org/browser/ht-contactform/trunk/admin/Includes/Services/FileManager.php#L86 - https://plugins.trac.wordpress.org/changeset/3326887/ht-contactform/trunk/admin/Includes/Services/FileManager.php?contextall=1&old=3316109&old_path=%2Fht-contactform%2Ftrunk%2Fadmin%2FIncludes%2FServices%2FFileManager.php
CVE ID: CVE-2025-7341 State: PUBLISHED Published: 2025-07-15T04:23:40.839Z Last Updated: 2025-07-15T13:35:24.727Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: htplugins Products: HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. Problem Types: CWE-269 Description: The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the temp_file_delete() function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the ser
s up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/32da04ba-bee3-4fd3-b91b-57e588d5f4e4?source=cve - https://plugins.trac.wordpress.org/browser/ht-contactform/trunk/admin/Includes/Services/FileManager.php#L107 - https://plugins.trac.wordpress.org/changeset/3326887/ht-contactform/trunk/admin/Includes/Ajax.php?contextall=1&old=3316109&old_path=%2Fht-contactform%2Ftrunk%2Fadmin%2FIncludes%2FAjax.php
CVE ID: CVE-2025-7342 State: PUBLISHED Published: 2025-08-17T23:03:56.571Z Last Updated: 2025-11-04T21:14:52.844Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Kubernetes Products: Image Builder Problem Types: CWE-798 Description: A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the Windows image build process when using the Nutanix or VMware OVA providers. These credentials, which allow root access, are disabled at the conclusion of the build. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project and the vulnerability was exploited during the build
if their nodes use VM images created via the Image Builder project and the vulnerability was exploited during the build process, which requires an attacker to access the build VM and modify the image while the build is in progress. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://groups.google.com/g/kubernetes-security-announce/c/tuEsLUQu_PA - https://github.com/kubernetes/kubernetes/issues/133115
CVE ID: CVE-2025-7343 State: PUBLISHED Published: 2025-07-21T06:48:18.831Z Last Updated: 2025-07-21T12:33:12.861Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Digiwin Products: SFT Problem Types: CWE-89 Description: The SFT developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10270-83d95-1.html - https://www.twcert.org.tw/en/cp-139-10271-25ea9-2.html - https://www.digiwin.com/tw/news/3568.html
CVE ID: CVE-2025-7344 State: PUBLISHED Published: 2025-07-21T06:55:35.216Z Last Updated: 2025-07-21T15:27:50.375Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Digiwin Products: EAI Problem Types: CWE-648 Description: The EAI developed by Digiwin has a Privilege Escalation vulnerability, allowing remote attackers with regular privileges to elevate their privileges to administrator level via a specific API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-10272-5b691-1.html - https://www.twcert.org.tw/en/cp-139-10273-ce2ed-2.html - https://www.digiwin.com/tw/news/3567.html
CVE ID: CVE-2025-7345 State: PUBLISHED Published: 2025-07-08T13:39:07.949Z Last Updated: 2025-11-07T18:35:10.479Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services
e Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 6 Problem Types: CWE-120 Description: A flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c). When proc
dk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c). When processing maliciously crafted JPEG images, a heap buffer overflow can occur during Base64 encoding, allowing out-of-bounds reads from heap memory, potentially causing application crashes or arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:12841 - https://access.redhat.com/errata/RHSA-2025:12862 - https://access.redhat.com/errata/RHSA-2025:13315 - https://access.redhat.com/errata/RHSA-2025:14574 - https://access.redhat.com/errata/RHSA-2025:14575 - https://access.redhat.
s://access.redhat.com/errata/RHSA-2025:14574 - https://access.redhat.com/errata/RHSA-2025:14575 - https://access.redhat.com/errata/RHSA-2025:14576 - https://access.redhat.com/errata/RHSA-2025:14585 - https://access.redhat.com/errata/RHSA-2025:14618 - https://access.redhat.com/errata/RHSA-2025:14646 - https://access.redhat.com/errata/RHSA-2025:14647 - https://access.redhat.com/errata/RHSA-2025:14683 - https://access.redhat.com/security/cve/CVE-2025-7345 - https://bugzilla.redhat.com/show_bug.cgi?id=2377063 - https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/249
CVE ID: CVE-2025-7346 State: PUBLISHED Published: 2025-07-08T07:05:11.861Z Last Updated: 2025-07-08T14:14:15.199Z Vendors: Pyload Products: Pyload Problem Types: CWE-281 Description: Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pyload/pyload/security/advisories/GHSA-x698-5hjm-w2m5
CVE ID: CVE-2025-7350 State: PUBLISHED Published: 2025-09-09T12:53:17.801Z Last Updated: 2025-09-09T13:21:03.185Z Vendors: Rockwell Automation Products: Stratix IOS Problem Types: CWE-74 Description: A security issue affecting multiple Cisco devices also directly impacts Stratix® 5410, 5700, and 8000 devices. This can lead to remote code execution by uploading and running malicious configurations without authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1745.html
CVE ID: CVE-2025-7353 State: PUBLISHED Published: 2025-08-14T13:23:26.940Z Last Updated: 2025-08-15T03:55:58.371Z Vendors: Rockwell Automation Products: 1756-EN2T/D, 1756-EN2F/C, 1756-EN2TR/C, 1756-EN3TR/B, 1756-EN2TP/A Problem Types: CWE-1188 Description: A security issue exists due to the web-based debugger agent enabled on Rockwell Automation ControlLogix® Ethernet Modules. If a specific IP address is used to connect to the WDB agent, it can allow remote attackers to perform memory dumps, modify memory, and control execution flow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1732.html
CVE ID: CVE-2025-7354 State: PUBLISHED Published: 2025-07-21T07:23:25.369Z Last Updated: 2025-07-21T11:07:53.742Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gn_themes Products: WP Shortcodes Plugin — Shortcodes Ultimate Problem Types: CWE-79 Description: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages
possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/62d32cda-bb6d-4ffa-82b9-f2f6e8d4346f?source=cve - https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.2/includes/shortcodes/members.php#L79 - https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.2/includes/shortcodes/button.php#L408 - https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.2/includes/shortcodes/expand.php#L130 - https://p
ttps://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.2/includes/shortcodes/expand.php#L130 - https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.2/includes/shortcodes/user.php#L95 - https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.2/includes/shortcodes/post.php#L116 - https://plugins.trac.wordpress.org/changeset/3328729/
CVE ID: CVE-2025-7355 State: PUBLISHED Published: 2025-09-16T12:49:41.870Z Last Updated: 2025-09-16T13:46:32.393Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Beefull Energy Technologies Products: Beefull App Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Beefull Energy Technologies Beefull App allows Exploitation of Trusted Identifiers.This issue affects Beefull App: before 24.07.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0255
CVE ID: CVE-2025-7356 State: REJECTED Published: N/A Last Updated: 2025-07-30T22:19:03.437Z Description: No description available.
CVE ID: CVE-2025-7357 State: PUBLISHED Published: 2025-07-16T15:56:33.623Z Last Updated: 2025-07-18T14:38:53.584Z Vendors: LITEON Products: IC48A EV Charger, IC80A EV Charger Problem Types: CWE-256 Description: LITEON IC48A firmware versions prior to 01.00.19r and LITEON IC80A firmware versions prior to 01.01.12e store FTP-server-access-credentials in cleartext in their system logs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-196-03
CVE ID: CVE-2025-7359 State: PUBLISHED Published: 2025-07-16T06:40:41.216Z Last Updated: 2025-07-16T14:40:48.546Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) Vendors: danielriera Products: Counter live visitors for WooCommerce Problem Types: CWE-22 Description: The Counter live visitors for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wcvisitor_get_block function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server. NOTE: This particular vulnerability deletes all the files in a targeted arbitrary directory
bitrary files on the server. NOTE: This particular vulnerability deletes all the files in a targeted arbitrary directory rather than a specified arbitrary file, which can lead to loss of data or a denial of service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ae13dc61-c4bf-4b17-8055-98c80a853a2a?source=cve - https://plugins.trac.wordpress.org/browser/counter-visitor-for-woocommerce/tags/1.3.6/woo-counter-visitor.php#L378
CVE ID: CVE-2025-7360 State: PUBLISHED Published: 2025-07-15T04:23:41.923Z Last Updated: 2025-07-15T13:32:00.345Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: htplugins Products: HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. Problem Types: CWE-22 Description: The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation in the handle_files_upload() function in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to move arbitrary files on the serve
s up to, and including, 2.2.1. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dd42c83c-c51c-45a5-8ad5-0df2c0cc411d?source=cve - https://wordpress.org/plugins/ht-contactform/ - https://plugins.trac.wordpress.org/changeset/3326887/ht-contactform/trunk/admin/Includes/Api/Endpoints/Submission.php?contextall=1&old=3316109&old_path=%2Fht-contactform%2Ftrunk%2Fadmin%2FIncludes%2FApi%2FEndpoints%2FSubmission.php
CVE ID: CVE-2025-7361 State: PUBLISHED Published: 2025-07-29T21:19:28.118Z Last Updated: 2025-08-02T03:55:46.530Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NI Products: LabVIEW Problem Types: CWE-94 Description: A code injection vulnerability due to an improper initialization check exists in NI LabVIEW that may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI using a CIN node. This vulnerability affects 32-bit NI LabVIEW 2025 Q1 and prior versions. LabVIEW 64-bit versions do not support CIN nodes and are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References
it versions do not support CIN nodes and are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/code-injection-vulnerability-in-ni-labview-using-cin-nodes.html
CVE ID: CVE-2025-7362 State: PUBLISHED Published: 2025-07-08T17:22:35.364Z Last Updated: 2025-07-10T13:19:38.972Z Vendors: Wikimedia Foundation Products: Mediawiki - MsUpload extension Problem Types: CWE-79 Description: The MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitization. The vulnerability occurs in the file upload UI when the same filename is uploaded twice. This issue affects Mediawiki - MsUpload extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.o
m 1.43.X before 1.43.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T394864 - https://gerrit.wikimedia.org/r/q/Icf4c0a5a936926ea887ca2e48c3a7bd297201d9f
CVE ID: CVE-2025-7363 State: PUBLISHED Published: 2025-07-08T17:27:17.643Z Last Updated: 2025-07-10T14:07:16.818Z Vendors: Wikimedia Foundation Products: Mediawiki - TitleIcon extension Problem Types: CWE-79 Description: The TitleIcon extension for MediaWiki is vulnerable to stored XSS through the #titleicon_unicode parser function. User input passed to this function is wrapped in an HtmlArmor object without sanitization and rendered directly into the page header, allowing attackers to inject arbitrary JavaScript. This issue affects Mediawiki - TitleIcon extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2. Additional Analyst Notes: - CISA ADP Vulnrichm
9.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T394721 - https://gerrit.wikimedia.org/r/q/I107ab638fecbf52b5bec3f02726ed24b1ae74429 - https://gerrit.wikimedia.org/r/q/I2e8c73445172679634f6ec64d37cf82507dfa110
CVE ID: CVE-2025-7365 State: PUBLISHED Published: 2025-07-10T14:20:45.775Z Last Updated: 2025-11-07T18:35:14.280Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: Red Hat Products: Red Hat build of Keycloak 26, Red Hat build of Keycloak 26.0, Red Hat build of Keycloak 26.2 Problem Types: CWE-346 Description: A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider (IdP) login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email address to match that of a victim's account, triggering a ver
is vulnerability allows the attacker to modify their email address to match that of a victim's account, triggering a verification email sent to the victim's email address. The attacker's email address is not present in the verification email content, making it a potential phishing opportunity. If the victim clicks the verification link, the attacker can gain access to the victim's account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:11986 - https://access.redhat.com/errata/RHSA-2025:11987 - https://access.redhat.com/errata/RHSA-2025:12015 - https://access.redhat.com/errata/RHSA-2025:12016 - https://access.redhat.com/security/cve
t.com/errata/RHSA-2025:12015 - https://access.redhat.com/errata/RHSA-2025:12016 - https://access.redhat.com/security/cve/CVE-2025-7365 - https://bugzilla.redhat.com/show_bug.cgi?id=2378852
CVE ID: CVE-2025-7366 State: PUBLISHED Published: 2025-09-06T01:45:16.846Z Last Updated: 2025-09-08T14:05:58.454Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: sizam Products: REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme Problem Types: CWE-94 Description: The The REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 19.9.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arb
operly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4f726479-c170-4e84-a5a7-2a82d0f62ad0?source=cve - https://themeforest.net/item/rehub-directory-multi-vendor-shop-coupon-affiliate-theme/7646339#item-description__19-9-8-15-augl-2025
CVE ID: CVE-2025-7367 State: PUBLISHED Published: 2025-07-15T04:23:41.525Z Last Updated: 2025-07-15T13:33:32.938Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpchill Products: Strong Testimonials Problem Types: CWE-79 Description: The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Custom Fields in all versions up to, and including, 3.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional A
bove, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/65395034-0b20-462c-93ee-e755e5c888a4?source=cve - https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.2.11/includes/functions-template.php#L532 - https://plugins.trac.wordpress.org/browser/strong-testimonials/tags/3.2.11/includes/functions-template.php#L317
CVE ID: CVE-2025-7368 State: PUBLISHED Published: 2025-09-06T01:45:17.560Z Last Updated: 2025-09-08T14:05:52.519Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: sizam Products: REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme Problem Types: CWE-200 Description: The REHub - Price Comparison, Multi Vendor Marketplace Wordpress Theme theme for WordPress is vulnerable to Information Exposure in all versions up to, and including, 19.9.7 via the 'ajax_action_re_getfullcontent' function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected post
posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected posts that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5f24313e-c246-44f8-b144-d95c55e71456?source=cve - https://themeforest.net/item/rehub-directory-multi-vendor-shop-coupon-affiliate-theme/7646339#item-description__19-9-8-15-augl-2025
CVE ID: CVE-2025-7369 State: PUBLISHED Published: 2025-07-21T07:23:25.011Z Last Updated: 2025-07-21T17:42:04.985Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: gn_themes Products: WP Shortcodes Plugin — Shortcodes Ultimate Problem Types: CWE-352 Description: The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. This is due to missing or incorrect nonce validation on the preview function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes via a forged request, granted they can trick a site administrator into performing an
rs to execute arbitrary shortcodes via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. In combination with CVE-2025-7354, it leads to Reflected Cross-Site Scripting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5934d1c8-1553-4908-aaab-89d2189eb4cd?source=cve - https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/tags/7.4.2/inc/core/generator.php#L339 - https://plugins.trac.wordpress.org/changeset/3328729/
CVE ID: CVE-2025-7370 State: REJECTED Published: 2025-07-10T14:11:29.409Z Last Updated: 2025-07-15T21:05:43.581Z Description: No description available.