Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-58626 State: PUBLISHED Published: 2025-09-03T14:36:53.033Z Last Updated: 2025-09-03T18:06:42.099Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: RumbleTalk Products: RumbleTalk Live Group Chat Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RumbleTalk RumbleTalk Live Group Chat allows Stored XSS. This issue affects RumbleTalk Live Group Chat: from n/a through 6.3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/rumbletalk-chat-a-chat-with-themes/vulnerability/wordpress-rumbletalk-live-g
://patchstack.com/database/wordpress/plugin/rumbletalk-chat-a-chat-with-themes/vulnerability/wordpress-rumbletalk-live-group-chat-plugin-6-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58627 State: PUBLISHED Published: 2025-11-06T15:54:23.943Z Last Updated: 2025-11-17T16:32:24.640Z Vendors: kamleshyadav Products: Miraculous Core Plugin Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous Core Plugin: from n/a through < 2.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/miraculouscore/vulnerability/wordpress-miraculous-core-plugin-plugin-2-0-9-insecure-direct-object-references-idor-vuln
n/miraculouscore/vulnerability/wordpress-miraculous-core-plugin-plugin-2-0-9-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE ID: CVE-2025-58628 State: PUBLISHED Published: 2025-09-05T16:17:55.088Z Last Updated: 2025-09-05T19:53:29.455Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: kamleshyadav Products: Miraculous Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Miraculous allows Blind SQL Injection. This issue affects Miraculous: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/miraculous/vulnerability/wordpress-miraculous-theme-2-0-9-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-58629 State: PUBLISHED Published: 2025-11-06T15:54:25.101Z Last Updated: 2025-11-17T16:32:17.054Z Vendors: kamleshyadav Products: Miraculous Problem Types: CWE-862 Description: Missing Authorization vulnerability in kamleshyadav Miraculous miraculous allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous: from n/a through < 2.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/miraculous/vulnerability/wordpress-miraculous-theme-2-0-9-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2025-58630 State: PUBLISHED Published: 2025-09-03T14:36:53.549Z Last Updated: 2025-09-03T17:48:45.088Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: rbaer Products: Simple Matomo Tracking Code Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rbaer Simple Matomo Tracking Code allows Stored XSS. This issue affects Simple Matomo Tracking Code: from n/a through 1.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-matomo-tracking-code/vulnerability/wordpress-simple-matomo-tracking-code-plu
hstack.com/database/wordpress/plugin/simple-matomo-tracking-code/vulnerability/wordpress-simple-matomo-tracking-code-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58631 State: PUBLISHED Published: 2025-09-03T14:36:54.067Z Last Updated: 2025-09-03T17:48:38.700Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: ZEEN101 Products: IssueM Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZEEN101 IssueM allows DOM-Based XSS. This issue affects IssueM: from n/a through 2.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/issuem/vulnerability/wordpress-issuem-plugin-2-9-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58632 State: PUBLISHED Published: 2025-09-03T14:36:54.634Z Last Updated: 2025-09-03T17:48:32.419Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Dadevarzan Products: Dadevarzan WordPress Common Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dadevarzan Dadevarzan WordPress Common allows Stored XSS. This issue affects Dadevarzan WordPress Common: from n/a through 2.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/dadevarzan-common/vulnerability/wordpress-dadevarzan-wordpress-common-plu
tps://patchstack.com/database/wordpress/plugin/dadevarzan-common/vulnerability/wordpress-dadevarzan-wordpress-common-plugin-2-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58633 State: PUBLISHED Published: 2025-09-03T14:36:55.164Z Last Updated: 2025-09-03T17:48:26.574Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Deetronix Products: Booking Ultra Pro Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Deetronix Booking Ultra Pro allows Stored XSS. This issue affects Booking Ultra Pro: from n/a through 1.1.21. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/booking-ultra-pro/vulnerability/wordpress-booking-ultra-pro-plugin-1-1-21-cross-site-scripting-xss-vulne
ordpress/plugin/booking-ultra-pro/vulnerability/wordpress-booking-ultra-pro-plugin-1-1-21-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58634 State: PUBLISHED Published: 2025-09-03T14:36:55.678Z Last Updated: 2025-09-03T17:48:19.564Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: peachpay Products: PeachPay Payments Problem Types: CWE-862 Description: Missing Authorization vulnerability in peachpay PeachPay Payments allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PeachPay Payments: from n/a through 1.117.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/peachpay-for-woocommerce/vulnerability/wordpress-peachpay-payments-plugin-1-117-4-broken-access-control-vulnerabi
plugin/peachpay-for-woocommerce/vulnerability/wordpress-peachpay-payments-plugin-1-117-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-58635 State: PUBLISHED Published: 2025-09-03T14:36:56.185Z Last Updated: 2025-09-03T17:48:13.493Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: PalsCode Products: Support Genix Problem Types: CWE-862 Description: Missing Authorization vulnerability in PalsCode Support Genix allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Support Genix: from n/a through 1.4.23. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/support-genix-lite/vulnerability/wordpress-support-genix-plugin-1-4-23-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-58636 State: PUBLISHED Published: 2025-11-06T15:54:26.970Z Last Updated: 2025-11-17T16:32:11.716Z Vendors: CRM Perks Products: WP Gravity Forms Keap/Infusionsoft Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Object Injection.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/gf-infusionsoft/vulnerability/wordpress-wp-gravity-forms-keap-infusionsoft-plugin-1-2-3-deserialization-of-untrusted-data-vulnerability?_s_id=cve
CVE ID: CVE-2025-58637 State: PUBLISHED Published: 2025-09-03T14:36:56.745Z Last Updated: 2025-09-03T18:11:03.187Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: immonex Products: immonex Kickstart Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in immonex immonex Kickstart allows PHP Local File Inclusion. This issue affects immonex Kickstart: from n/a through 1.11.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/immonex-kickstart/vulnerability/wordpress-immonex-kickstart-plugin-1-11-6-loc
//patchstack.com/database/wordpress/plugin/immonex-kickstart/vulnerability/wordpress-immonex-kickstart-plugin-1-11-6-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-58638 State: PUBLISHED Published: 2025-11-06T15:54:28.161Z Last Updated: 2025-11-17T16:32:06.501Z Vendors: e-plugins Products: Institutions Directory Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Institutions Directory institutions-directory allows Reflected XSS.This issue affects Institutions Directory: from n/a through <= 1.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/institutions-directory/vulnerability/wordpress-institutions-directory-plugin-1-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58639 State: PUBLISHED Published: 2025-09-03T14:36:57.355Z Last Updated: 2025-09-03T18:17:56.364Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Ali Khallad Products: Contact Form By Mega Forms Problem Types: CWE-862 Description: Missing Authorization vulnerability in Ali Khallad Contact Form By Mega Forms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Contact Form By Mega Forms: from n/a through 1.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mega-forms/vulnerability/wordpress-contact-form-by-mega-forms-plugin-1-6-1-broken-
chstack.com/database/wordpress/plugin/mega-forms/vulnerability/wordpress-contact-form-by-mega-forms-plugin-1-6-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-58640 State: PUBLISHED Published: 2025-09-03T14:36:57.946Z Last Updated: 2025-09-03T17:19:32.127Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: MatrixAddons Products: Document Engine Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MatrixAddons Document Engine allows Stored XSS. This issue affects Document Engine: from n/a through 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/document-engine/vulnerability/wordpress-document-engine-plugin-1-2-cross-site-scripting-xss-vulnerability?_
press/plugin/document-engine/vulnerability/wordpress-document-engine-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58641 State: PUBLISHED Published: 2025-09-03T14:36:58.536Z Last Updated: 2025-09-03T17:19:18.486Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: kamleshyadav Products: Exit Intent Popup Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in kamleshyadav Exit Intent Popup allows Server Side Request Forgery. This issue affects Exit Intent Popup: from n/a through 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/exitintentpopup/vulnerability/wordpress-exit-intent-popup-plugin-1-0-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-58642 State: PUBLISHED Published: 2025-09-03T14:36:59.117Z Last Updated: 2025-09-03T17:19:03.757Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: enituretechnology Products: LTL Freight Quotes – Day & Ross Edition Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes – Day & Ross Edition allows Object Injection. This issue affects LTL Freight Quotes – Day & Ross Edition: from n/a through 2.1.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ltl-freight-quotes-day-ross-edition/vulnerability/wordpress-ltl-frei
- https://patchstack.com/database/wordpress/plugin/ltl-freight-quotes-day-ross-edition/vulnerability/wordpress-ltl-freight-quotes-day-ross-edition-plugin-2-1-11-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-58643 State: PUBLISHED Published: 2025-09-03T14:36:59.652Z Last Updated: 2025-09-03T17:18:48.422Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: enituretechnology Products: LTL Freight Quotes – Daylight Edition Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes – Daylight Edition allows Object Injection. This issue affects LTL Freight Quotes – Daylight Edition: from n/a through 2.2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ltl-freight-quotes-daylight-edition/vulnerability/wordpress-ltl-freight-quo
s://patchstack.com/database/wordpress/plugin/ltl-freight-quotes-daylight-edition/vulnerability/wordpress-ltl-freight-quotes-daylight-edition-plugin-2-2-7-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-58644 State: PUBLISHED Published: 2025-09-03T14:37:00.218Z Last Updated: 2025-09-03T17:18:33.739Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: enituretechnology Products: LTL Freight Quotes - TQL Edition Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes - TQL Edition allows Object Injection. This issue affects LTL Freight Quotes - TQL Edition: from n/a through 1.2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ltl-freight-quotes-tql-edition/vulnerability/wordpress-ltl-freight-quotes-tql-edition-plug
com/database/wordpress/plugin/ltl-freight-quotes-tql-edition/vulnerability/wordpress-ltl-freight-quotes-tql-edition-plugin-1-2-6-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-58645 State: PUBLISHED Published: 2025-09-22T18:23:13.455Z Last Updated: 2025-09-23T14:12:32.774Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Gravitate Products: Gravitate Automated Tester Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gravitate Gravitate Automated Tester allows Stored XSS. This issue affects Gravitate Automated Tester: from n/a through 1.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gravitate-automated-tester/vulnerability/wordpress-gravitate-automated-tester-
/patchstack.com/database/wordpress/plugin/gravitate-automated-tester/vulnerability/wordpress-gravitate-automated-tester-plugin-1-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58646 State: PUBLISHED Published: 2025-09-22T18:23:12.752Z Last Updated: 2025-09-23T14:12:37.247Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: chtombleson Products: Mobi2Go Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chtombleson Mobi2Go allows Stored XSS. This issue affects Mobi2Go: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mobi2go/vulnerability/wordpress-mobi2go-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58647 State: PUBLISHED Published: 2025-09-22T18:23:12.067Z Last Updated: 2025-09-23T16:14:32.981Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Will.I.am Products: Simple Restaurant Menu Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Will.I.am Simple Restaurant Menu allows Stored XSS. This issue affects Simple Restaurant Menu: from n/a through 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-restaurant-menu/vulnerability/wordpress-simple-restaurant-menu-plugin-1-2-cross-site-
m/database/wordpress/plugin/simple-restaurant-menu/vulnerability/wordpress-simple-restaurant-menu-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58648 State: PUBLISHED Published: 2025-09-22T18:23:11.372Z Last Updated: 2025-09-23T16:14:38.507Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Nicu Micle Products: Simple JWT Login Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicu Micle Simple JWT Login allows Stored XSS. This issue affects Simple JWT Login: from n/a through 3.6.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-jwt-login/vulnerability/wordpress-simple-jwt-login-plugin-3-6-4-cross-site-scripting-xss-vulnerabil
dpress/plugin/simple-jwt-login/vulnerability/wordpress-simple-jwt-login-plugin-3-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58649 State: PUBLISHED Published: 2025-09-22T18:23:10.684Z Last Updated: 2025-09-23T16:14:44.462Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Syed Balkhi Products: All In One SEO Pack Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack allows Retrieve Embedded Sensitive Data. This issue affects All In One SEO Pack: from n/a through 4.8.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/all-in-one-seo-pack/vulnerability/wordpress-all-in-one-seo-pack-plugin-4-8-7-sensitive-data-exposure-vulner
press/plugin/all-in-one-seo-pack/vulnerability/wordpress-all-in-one-seo-pack-plugin-4-8-7-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-58650 State: PUBLISHED Published: 2025-09-22T18:23:09.950Z Last Updated: 2025-09-23T16:14:50.807Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Syed Balkhi Products: All In One SEO Pack Problem Types: CWE-862 Description: Missing Authorization vulnerability in Syed Balkhi All In One SEO Pack allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects All In One SEO Pack: from n/a through 4.8.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/all-in-one-seo-pack/vulnerability/wordpress-all-in-one-seo-pack-plugin-4-8-7-broken-access-control-vuln
wordpress/plugin/all-in-one-seo-pack/vulnerability/wordpress-all-in-one-seo-pack-plugin-4-8-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-58651 State: PUBLISHED Published: 2025-09-22T18:23:09.260Z Last Updated: 2025-09-23T16:14:56.749Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: PlayerJS Products: PlayerJS Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PlayerJS PlayerJS allows DOM-Based XSS. This issue affects PlayerJS: from n/a through 2.24. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/playerjs/vulnerability/wordpress-playerjs-plugin-2-24-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58652 State: PUBLISHED Published: 2025-09-22T18:23:08.515Z Last Updated: 2025-09-23T16:15:05.779Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Themepoints Products: Carousel Ultimate Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Carousel Ultimate allows Stored XSS. This issue affects Carousel Ultimate: from n/a through 1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/carousel/vulnerability/wordpress-carousel-ultimate-plugin-1-8-cross-site-scripting-xss-vulnerability-2?
wordpress/plugin/carousel/vulnerability/wordpress-carousel-ultimate-plugin-1-8-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-58653 State: PUBLISHED Published: 2025-09-22T18:23:07.787Z Last Updated: 2025-09-23T16:15:11.847Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: JS Morisset Products: JSM file_get_contents() Shortcode Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JS Morisset JSM file_get_contents() Shortcode allows Stored XSS. This issue affects JSM file_get_contents() Shortcode: from n/a through 2.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-file-get-contents/vulnerability/wordpress-jsm-file
nt: References: - https://patchstack.com/database/wordpress/plugin/wp-file-get-contents/vulnerability/wordpress-jsm-file-get-contents-shortcode-plugin-2-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58654 State: PUBLISHED Published: 2025-09-22T18:23:07.067Z Last Updated: 2025-09-23T16:15:17.775Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Michel - xiligroup dev Products: xili-language Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michel - xiligroup dev xili-language allows DOM-Based XSS. This issue affects xili-language: from n/a through 2.21.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/xili-language/vulnerability/wordpress-xili-language-plugin-2-21-3-cross-site-scripting-
ck.com/database/wordpress/plugin/xili-language/vulnerability/wordpress-xili-language-plugin-2-21-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58655 State: PUBLISHED Published: 2025-09-22T18:23:06.341Z Last Updated: 2025-09-23T16:15:23.784Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Mattia Roccoberton Products: Category Featured Images Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mattia Roccoberton Category Featured Images allows Stored XSS. This issue affects Category Featured Images: from n/a through 1.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/category-featured-images/vulnerability/wordpress-category-featured
s: - https://patchstack.com/database/wordpress/plugin/category-featured-images/vulnerability/wordpress-category-featured-images-plugin-1-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve