Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
bove, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/697f3432-63b7-42d6-b188-812165cd2020?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-addons-for-contact-form-7/trunk/admin/tf-options/classes/UACF7_Settings.php#L894-920 - https://plugins.trac.wordpress.org/changeset/3288584/ - https://github.com/d0n601/CVE-2025-6220 - https://ryankozak.com/posts/cve-2025-6220/
CVE ID: CVE-2025-6221 State: PUBLISHED Published: 2025-08-16T03:38:47.808Z Last Updated: 2025-08-18T13:47:50.782Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: luuptek Products: Embed Bokun Problem Types: CWE-79 Description: The Embed Bokun plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 0.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA
rary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2947a6e9-e357-4751-adfd-f9043bef75e9?source=cve - https://plugins.trac.wordpress.org/browser/embed-bokun/trunk/embed-bokun.php#L226 - https://wordpress.org/plugins/embed-bokun/#developers
CVE ID: CVE-2025-6222 State: PUBLISHED Published: 2025-07-18T05:23:56.741Z Last Updated: 2025-07-18T14:56:25.614Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WP Swings Products: WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet Problem Types: CWE-434 Description: The WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ced_rnx_order_exchange_attach_files' function in all versions up to, and including, 3.2.6. This makes it possible for unauthenticated attacker
_attach_files' function in all versions up to, and including, 3.2.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/35a7b5a1-b052-4390-8e08-f97aa9c16b29?source=cve - https://codecanyon.net/item/woocommerce-refund-and-exchange/17810207#item-description__changelog
CVE ID: CVE-2025-6224 State: PUBLISHED Published: 2025-07-01T10:39:34.322Z Last Updated: 2025-07-01T14:30:51.639Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Canonical Products: Juju utils Problem Types: CWE-312 Description: Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/juju/utils/security/advisories/GHSA-h34r-jxqm-qgpr
CVE ID: CVE-2025-6226 State: PUBLISHED Published: 2025-07-18T08:48:02.717Z Last Updated: 2025-08-07T09:53:06.698Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-306 Description: Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of recently created posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-6227 State: PUBLISHED Published: 2025-07-18T11:39:46.005Z Last Updated: 2025-07-18T13:44:00.998Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-522 Description: Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-6228 State: PUBLISHED Published: 2025-08-01T11:18:55.638Z Last Updated: 2025-08-01T13:43:56.210Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: shaonsina Products: Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates) Problem Types: CWE-79 Description: The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `Sina Posts`, `Sina Blog Post` and `Sina Ta
s) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `Sina Posts`, `Sina Blog Post` and `Sina Table` widgets in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fd929710-bdb4-42e1-b409-df41adc22392?source=cve - https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/tags/3.7.0/widgets/adva
f41adc22392?source=cve - https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/tags/3.7.0/widgets/advanced/sina-blogpost.php#L2066 - https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/tags/3.7.0/widgets/theme_builder/sina-posts.php#L1879 - https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/tags/3.7.0/widgets/basic/sina-table.php#L1659
CVE ID: CVE-2025-6230 State: PUBLISHED Published: 2025-07-17T19:19:12.097Z Last Updated: 2025-08-18T20:14:24.458Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Lenovo Products: Vantage, Commercial Vantage Problem Types: CWE-89 Description: A SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execute limited SQLite commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-196648
CVE ID: CVE-2025-6231 State: PUBLISHED Published: 2025-07-17T19:19:23.288Z Last Updated: 2025-07-17T20:12:27.411Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Vantage, Commercial Vantage Problem Types: CWE-88 Description: An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated permissions by modifying an application configuration file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-196648
CVE ID: CVE-2025-6232 State: PUBLISHED Published: 2025-07-17T19:19:32.565Z Last Updated: 2025-07-17T20:12:52.204Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Vantage, Commercial Vantage Problem Types: CWE-88 Description: An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated permissions by modifying specific registry locations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-196648
CVE ID: CVE-2025-6233 State: PUBLISHED Published: 2025-07-18T09:09:22.809Z Last Updated: 2025-07-18T12:30:35.494Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-22 Description: Mattermost versions 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to sanitize input paths of file attachments in the bulk import JSONL file, which allows a system admin to read arbitrary system files via path traversal. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-6234 State: PUBLISHED Published: 2025-07-10T06:00:02.897Z Last Updated: 2025-07-10T14:17:06.329Z Vendors: Unknown Products: Hostel Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Hostel WordPress plugin before 1.1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7447c4e1-81b9-4415-b425-27491ff692b2/
CVE ID: CVE-2025-6235 State: PUBLISHED Published: 2025-07-21T14:07:41.882Z Last Updated: 2025-07-21T20:03:49.151Z Vendors: Extreme Networks Products: ExtremeControl Problem Types: CWE-79 Description: In ExtremeControl before 25.5.12, a cross-site scripting (XSS) vulnerability was discovered in a login interface of the affected application. The issue stems from improper handling of user-supplied input within HTML attributes, allowing an attacker to inject script code that may execute in a user's browser under specific interaction conditions. Successful exploitation could lead to exposure of user data or unauthorized actions within the browser context. Additional Analyst Notes: - CISA ADP Vuln
d to exposure of user data or unauthorized actions within the browser context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://extreme-networks.my.site.com/ExtrArticleDetail?an=000128019
CVE ID: CVE-2025-6236 State: PUBLISHED Published: 2025-07-10T06:00:04.142Z Last Updated: 2025-07-10T14:18:40.730Z Vendors: Unknown Products: Hostel Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Hostel WordPress plugin before 1.1.5.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ff4d312b-a4d1-40cd-a555-a0a1b46f9959/
CVE ID: CVE-2025-6237 State: PUBLISHED Published: 2025-09-18T08:34:08.039Z Last Updated: 2025-09-18T13:31:31.235Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: invoke-ai Products: invoke-ai/invokeai Problem Types: CWE-73 Description: A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET /api/v1/images/download/{bulk_download_item_name} endpoint. By manipulating the filename arguments, attackers can read and delete any files on the server, including critical system files such as SSH keys, databases, and configuration files. This vulnerability results in high confidentialit
cal system files such as SSH keys, databases, and configuration files. This vulnerability results in high confidentiality, integrity, and availability impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/54ac9589-7c88-4fd4-8512-8b2f19fbaedf
CVE ID: CVE-2025-6238 State: PUBLISHED Published: 2025-07-04T01:44:02.327Z Last Updated: 2025-07-08T14:28:09.854Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: tigroumeow Products: AI Engine Problem Types: CWE-601 Description: The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' parameter is missing validation during the authorization flow. This makes it possible for unauthenticated attackers to intercept the authorization code and obtain an access token by redirecting the user to an attacker-controlled URI. Note: OAuth is disabled, the 'Meow_MWAI_Labs_OAuth'
access token by redirecting the user to an attacker-controlled URI. Note: OAuth is disabled, the 'Meow_MWAI_Labs_OAuth' class is not loaded in the plugin in the patched version 2.8.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1edc84fd-8cb5-4899-9444-1b6ae3144917?source=cve - https://plugins.trac.wordpress.org/browser/ai-engine/tags/2.8.4/labs/oauth.php - https://plugins.trac.wordpress.org/changeset/3321384/ai-engine/trunk/labs/mcp.php - https://plugins.trac.wordpress.org/changeset/3321384/ai-engine/trunk/labs/oauth.php
CVE ID: CVE-2025-6239 State: PUBLISHED Published: 2025-10-21T12:25:21.042Z Last Updated: 2025-10-21T13:18:28.413Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Zohocorp Products: ManageEngine Applications Manager Problem Types: CWE-200 Description: Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2025-6239.html
CVE ID: CVE-2025-6240 State: PUBLISHED Published: 2025-06-18T14:46:57.742Z Last Updated: 2025-06-18T14:58:20.460Z Vendors: Profisee Products: Profisee Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Profisee on Windows (filesystem modules) allows Path Traversal after authentication to the Profisee system.This issue affects Profisee: from 2020R1 before 2024R2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://profisee.com/security/vulnerabilities/detail/
CVE ID: CVE-2025-6241 State: PUBLISHED Published: 2025-07-27T00:46:41.118Z Last Updated: 2025-11-03T20:06:53.132Z Vendors: Lakeside Software Products: SysTrack Problem Types: CWE-427 Uncontrolled Search Path Element Description: LsiAgent.exe, a component of SysTrack from Lakeside Software, attempts to load several DLL files which are not present in the default installation. If a user-writable directory is present in the SYSTEM PATH environment variable, the user can write a malicious DLL to that directory with arbitrary code. This malicious DLL is executed in the context of NT AUTHORITY\SYSTEM upon service start or restart, due to the Windows default dynamic-link library search order, result
NT AUTHORITY\SYSTEM upon service start or restart, due to the Windows default dynamic-link library search order, resulting in local elevation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://documentation.lakesidesoftware.com/en/Content/Release%20Notes/Agent/10_10_0%20Hotfix%20Agent%20Release%20Notes%20On%20Premises.htm?tocpath=Release%20Notes%7CAgent%7C_____13
CVE ID: CVE-2025-6242 State: PUBLISHED Published: 2025-10-07T19:45:18.082Z Last Updated: 2025-10-17T11:03:08.400Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H) Vendors: Red Hat Products: Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The load_from_url and load_from_url_async methods fetch and process media from user-provided URLs without adequate restrictions on the target hosts. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network
n the target hosts. This allows an attacker to coerce the vLLM server into making arbitrary requests to internal network resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-6242 - https://bugzilla.redhat.com/show_bug.cgi?id=2373716
CVE ID: CVE-2025-6244 State: PUBLISHED Published: 2025-07-08T01:43:46.743Z Last Updated: 2025-07-08T16:13:00.670Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Popular Elementor Templates & Widgets Problem Types: CWE-79 Description: The Essential Addons for Elementor – Popular Elementor Templates and Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the via `Calendar` And `Business Reviews` Widgets attributes in all versions up to, and including, 6.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contribu
o insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/847a4fc7-3580-421e-8045-41b5a85f2d97?source=cve - https://plugins.trac.wordpress.org/changeset/3318211/
CVE ID: CVE-2025-6247 State: PUBLISHED Published: 2025-08-26T09:06:08.081Z Last Updated: 2025-08-26T15:38:49.090Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ValvePress Products: WordPress Automatic Plugin Problem Types: CWE-80 Description: The WordPress Automatic Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.118.0. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to update campaigns and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action suc
ect malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/95d68a5d-4d0b-4030-a80a-ada31b118af2?source=cve - https://codecanyon.net/item/wordpress-automatic-plugin/1904470
CVE ID: CVE-2025-6248 State: PUBLISHED Published: 2025-07-17T19:19:52.864Z Last Updated: 2025-07-17T20:08:01.388Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: Lenovo Products: Browser Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability was reported in the Lenovo Browser that could allow an attacker to obtain sensitive information if a user visits a web page with specially crafted content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/430154
CVE ID: CVE-2025-6249 State: PUBLISHED Published: 2025-07-17T19:20:01.009Z Last Updated: 2025-07-17T20:06:40.536Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: FileZ Client Problem Types: CWE-602 Description: An authentication bypass vulnerability was reported in FileZ client application that could allow a local attacker with elevated permissions access to application data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.filez.com/securityPolicy/3.html?1751965890
CVE ID: CVE-2025-6250 State: PUBLISHED Published: 2025-07-28T15:40:28.381Z Last Updated: 2025-07-28T17:22:45.226Z Vendors: BeyondTrust Products: Privilege Management for Windows Problem Types: CWE-424 Description: Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, the malicious user can add themselves to Administrators group and run any process with elevated permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.beyondtrust.com/trust-center/security-advisories/bt25-06
CVE ID: CVE-2025-6251 State: PUBLISHED Published: 2025-11-19T03:29:39.598Z Last Updated: 2025-11-19T20:07:58.746Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wproyal Products: Royal Addons for Elementor – Addons and Templates Kit for Elementor Problem Types: CWE-79 Description: The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via $item['field_id'] in all versions up to, and including, 1.7.1036 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will exe
authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ead108c4-ac09-42ea-95c5-e95dc514f1cb?source=cve - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/modules/form-builder/widgets/wpr-form-builder.php#L4023
CVE ID: CVE-2025-6252 State: PUBLISHED Published: 2025-06-28T04:21:32.752Z Last Updated: 2025-06-30T18:32:27.747Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: qodeinteractive Products: Qi Addons For Elementor Problem Types: CWE-79 Description: The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Add
ess and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0ef82a52-0a32-4dc4-b027-3d2098549404?source=cve - https://plugins.trac.wordpress.org/browser/qi-addons-for-elementor/trunk/assets/js/main.js - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3318746%40qi-addons-for-elementor%2Ftrunk&old=3308494%40qi-addons-for-elementor%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2025-6253 State: PUBLISHED Published: 2025-08-12T05:27:09.881Z Last Updated: 2025-08-12T13:54:49.905Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: uicore Products: UiCore Elements – Free Elementor widgets and templates Problem Types: CWE-862 Description: The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.3.0 via the prepare_template() function due to a missing capability check and insufficient controls on the filename specified. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which
fied. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c7cd6e44-bd78-4eb8-bab8-09e2af583222?source=cve - https://plugins.trac.wordpress.org/changeset/3314574/uicore-elements#file3