Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-49389 State: PUBLISHED Published: 2025-08-20T08:03:54.057Z Last Updated: 2025-08-20T13:40:53.840Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WEN Solutions Products: Notice Bar Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Solutions Notice Bar allows Stored XSS. This issue affects Notice Bar: from n/a through 3.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/notice-bar/vulnerability/wordpress-notice-bar-plugin-3-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49390 State: PUBLISHED Published: 2025-11-06T15:53:51.739Z Last Updated: 2025-11-13T10:33:40.560Z Vendors: christophrado Products: Cookie Notice & Consent Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in christophrado Cookie Notice & Consent cookie-notice-consent allows Stored XSS.This issue affects Cookie Notice & Consent: from n/a through <= 1.6.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/cookie-notice-consent/vulnerability/wordpress-cookie-notice-consent-plugin-1-6-4-cross-site-scripting-xss-vulnerability?_s_i
ie-notice-consent/vulnerability/wordpress-cookie-notice-consent-plugin-1-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49391 State: PUBLISHED Published: 2025-08-20T08:03:53.490Z Last Updated: 2025-08-20T13:32:03.792Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Fetch Designs Products: Sign-up Sheets Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Fetch Designs Sign-up Sheets allows Cross Site Request Forgery. This issue affects Sign-up Sheets: from n/a through 2.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/sign-up-sheets/vulnerability/wordpress-sign-up-sheets-plugin-2-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-49392 State: PUBLISHED Published: 2025-08-20T08:03:52.968Z Last Updated: 2025-08-20T13:36:55.981Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: themifyme Products: Themify Audio Dock Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Audio Dock allows Stored XSS. This issue affects Themify Audio Dock: from n/a through 2.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/themify-audio-dock/vulnerability/wordpress-themify-audio-dock-plugin-2-0-5-cross-site-scripting-xss-vu
/wordpress/plugin/themify-audio-dock/vulnerability/wordpress-themify-audio-dock-plugin-2-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49393 State: PUBLISHED Published: 2025-11-06T15:53:52.480Z Last Updated: 2025-11-13T10:33:40.558Z Vendors: Fetch Designs Products: Sign-up Sheets Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Object Injection.This issue affects Sign-up Sheets: from n/a through <= 2.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/sign-up-sheets/vulnerability/wordpress-sign-up-sheets-plugin-2-3-2-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49394 State: PUBLISHED Published: 2025-11-06T15:53:53.230Z Last Updated: 2025-11-13T10:33:40.558Z Vendors: bPlugins Products: Image Gallery block – Create and display photo gallery/photo album. Problem Types: CWE-862 Description: Missing Authorization vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Image Gallery block – Create and display photo gallery/photo album.: from n/a through <= 1.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/3d-image-gallery/vulner
tes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/3d-image-gallery/vulnerability/wordpress-image-gallery-block-create-and-display-photo-gallery-photo-album-plugin-1-0-7-broken-authentication-vulnerability?_s_id=cve
CVE ID: CVE-2025-49395 State: PUBLISHED Published: 2025-08-20T08:03:52.402Z Last Updated: 2025-08-20T13:40:33.250Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: themifyme Products: Themify Icons Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Icons allows Stored XSS. This issue affects Themify Icons: from n/a through 2.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/themify-icons/vulnerability/wordpress-themify-icons-plugin-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49396 State: PUBLISHED Published: 2025-08-20T08:03:51.751Z Last Updated: 2025-08-20T13:50:40.932Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: themifyme Products: Themify Builder Problem Types: CWE-862 Description: Missing Authorization vulnerability in themifyme Themify Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Themify Builder: from n/a through 7.6.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/themify-builder/vulnerability/wordpress-themify-builder-plugin-7-6-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49397 State: PUBLISHED Published: 2025-08-20T08:03:51.138Z Last Updated: 2025-08-20T13:51:45.481Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Noor Alam Products: Colorbox Lightbox Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Colorbox Lightbox allows Stored XSS. This issue affects Colorbox Lightbox: from n/a through 1.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-colorbox/vulnerability/wordpress-colorbox-lightbox-plugin-1-1-5-cross-site-scripting-xss-vulnerability
rdpress/plugin/wp-colorbox/vulnerability/wordpress-colorbox-lightbox-plugin-1-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49398 State: PUBLISHED Published: 2025-11-06T15:53:53.979Z Last Updated: 2025-11-13T10:33:40.603Z Vendors: Easy Appointments Products: Easy Appointments Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Easy Appointments Easy Appointments easy-appointments allows Code Injection.This issue affects Easy Appointments: from n/a through <= 3.12.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/easy-appointments/vulnerability/wordpress-easy-appointments-plugin-3-12-14-content-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49399 State: PUBLISHED Published: 2025-08-20T08:03:50.441Z Last Updated: 2025-08-20T18:07:13.150Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Basix Products: NEX-Forms Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Basix NEX-Forms allows Cross Site Request Forgery. This issue affects NEX-Forms: from n/a through 9.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/nex-forms-express-wp-form-builder/vulnerability/wordpress-nex-forms-plugin-9-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-49400 State: PUBLISHED Published: 2025-08-20T08:03:49.869Z Last Updated: 2025-08-20T18:06:44.033Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: osama.esh Products: WP Visitor Statistics (Real Time Traffic) Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) allows Stored XSS. This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 8.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-stats-manager/vulnerability/word
ISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-stats-manager/vulnerability/wordpress-wp-visitor-statistics-real-time-traffic-plugin-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49401 State: PUBLISHED Published: 2025-09-05T16:15:40.868Z Last Updated: 2025-09-09T13:47:21.653Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ExpressTech Systems Products: Quiz And Survey Master Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in ExpressTech Systems Quiz And Survey Master allows Object Injection. This issue affects Quiz And Survey Master: from n/a through 10.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-10-2-5-php-object-injection-vulnerabilit
s/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-10-2-5-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49402 State: PUBLISHED Published: 2025-08-28T12:37:14.405Z Last Updated: 2025-08-28T15:29:24.462Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: favethemes Products: Houzez CRM Problem Types: CWE-862 Description: Missing Authorization vulnerability in favethemes Houzez CRM allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Houzez CRM: from n/a through 1.4.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/houzez-crm/vulnerability/wordpress-houzez-crm-plugin-1-4-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49404 State: PUBLISHED Published: 2025-08-28T12:37:15.058Z Last Updated: 2025-08-28T19:05:52.158Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: purethemes Products: Listeo-Core Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in purethemes Listeo-Core allows SQL Injection. This issue affects Listeo-Core: from n/a through 1.9.32. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/listeo-core/vulnerability/wordpress-listeo-core-plugin-1-9-32-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49405 State: PUBLISHED Published: 2025-08-28T12:37:15.723Z Last Updated: 2025-08-30T01:45:12.603Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Favethemes Products: Houzez Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Favethemes Houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a before 4.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/houzez/vulnerability/wordpress-houzez-theme-4-1-1-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-49406 State: PUBLISHED Published: 2025-08-20T08:03:49.295Z Last Updated: 2025-08-20T18:06:08.989Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: favethemes Products: Houzez Problem Types: CWE-862 Description: Missing Authorization vulnerability in favethemes Houzez allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Houzez: from n/a through 4.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/houzez/vulnerability/wordpress-houzez-theme-4-1-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49407 State: PUBLISHED Published: 2025-08-28T12:37:16.404Z Last Updated: 2025-08-28T19:05:03.607Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: favethemes Products: Houzez Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/houzez/vulnerability/wordpress-houzez-theme-4-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49408 State: PUBLISHED Published: 2025-08-20T08:03:48.674Z Last Updated: 2025-08-20T18:05:34.402Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: WPDeveloper Products: Templately Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded Sensitive Data. This issue affects Templately: from n/a through 3.2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/templately/vulnerability/wordpress-templately-plugin-3-2-7-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-49409 State: PUBLISHED Published: 2025-08-20T08:03:46.507Z Last Updated: 2025-08-20T13:43:11.364Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: brewlabs Products: SensorPress Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brewlabs SensorPress allows Stored XSS. This issue affects SensorPress: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/sensorpress-uptime-monitoring/vulnerability/wordpress-sensorpress-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49410 State: PUBLISHED Published: 2025-08-20T08:03:45.980Z Last Updated: 2025-08-20T13:44:46.690Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Imran Emu Products: TC Testimonials Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC Testimonials allows Stored XSS. This issue affects TC Testimonials: from n/a through 1.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/tc-testimonial/vulnerability/wordpress-tc-testimonials-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_i
s/plugin/tc-testimonial/vulnerability/wordpress-tc-testimonials-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49411 State: PUBLISHED Published: 2025-08-20T08:03:45.380Z Last Updated: 2025-08-20T13:45:17.546Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Vikas Sharma Products: iFrame Block Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Sharma iFrame Block allows Stored XSS. This issue affects iFrame Block: from n/a through 0.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/iframe-block/vulnerability/wordpress-iframe-block-plugin-0-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49412 State: PUBLISHED Published: 2025-08-20T08:03:44.742Z Last Updated: 2025-08-20T13:46:00.975Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: numixtech Products: Page Transition Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in numixtech Page Transition allows Stored XSS. This issue affects Page Transition: from n/a through 1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/page-transition/vulnerability/wordpress-page-transition-plugin-1-3-cross-site-scripting-xss-vulnerability?_s_id=c
plugin/page-transition/vulnerability/wordpress-page-transition-plugin-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49413 State: PUBLISHED Published: 2025-08-20T08:03:44.211Z Last Updated: 2025-08-20T13:46:40.126Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Wishloop Products: Terms of Service &amp; Privacy Policy Generator Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wishloop Terms of Service &amp; Privacy Policy Generator allows Stored XSS. This issue affects Terms of Service &amp; Privacy Policy Generator: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/terms-of-service-an
alyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/terms-of-service-and-privacy-policy/vulnerability/wordpress-terms-of-service-privacy-policy-generator-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49414 State: PUBLISHED Published: 2025-07-04T11:17:49.681Z Last Updated: 2025-07-08T13:59:35.541Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Fastw3b LLC Products: FW Gallery Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Gallery allows Using Malicious Files. This issue affects FW Gallery: from n/a through 8.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/fw-gallery/vulnerability/wordpress-fw-gallery-8-0-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-49415 State: PUBLISHED Published: 2025-06-17T15:01:11.701Z Last Updated: 2025-06-26T17:50:02.683Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Fastw3b LLC Products: FW Gallery Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fastw3b LLC FW Gallery allows Path Traversal. This issue affects FW Gallery: from n/a through 8.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/fw-gallery/vulnerability/wordpress-fw-gallery-8-0-0-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2025-49416 State: PUBLISHED Published: 2025-06-27T11:52:10.067Z Last Updated: 2025-06-27T13:14:45.616Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Fastw3b LLC Products: FW Gallery Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fastw3b LLC FW Gallery allows PHP Local File Inclusion. This issue affects FW Gallery: from n/a through 8.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/fw-gallery/vulnerability/wordpress-fw-gallery-8-0-0-local-file-inclusion-vulnerability?_s_i
om/database/wordpress/plugin/fw-gallery/vulnerability/wordpress-fw-gallery-8-0-0-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-49417 State: PUBLISHED Published: 2025-07-04T11:17:49.191Z Last Updated: 2025-07-08T13:59:56.030Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: BestWpDeveloper Products: WooCommerce Product Multi-Action Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in BestWpDeveloper WooCommerce Product Multi-Action allows Object Injection. This issue affects WooCommerce Product Multi-Action: from n/a through 1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woo-product-multiaction/vulnerability/wordpress-woocommerce-product-multi-action-1-3-deseria
m/database/wordpress/plugin/woo-product-multiaction/vulnerability/wordpress-woocommerce-product-multi-action-1-3-deserialization-of-untrusted-data-vulnerability?_s_id=cve
CVE ID: CVE-2025-49418 State: PUBLISHED Published: 2025-07-04T11:17:48.696Z Last Updated: 2025-07-08T14:00:15.266Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: TeconceTheme Products: Allmart Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in TeconceTheme Allmart allows Server Side Request Forgery. This issue affects Allmart: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/allmart-core/vulnerability/wordpress-allmart-1-0-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-49419 State: PUBLISHED Published: 2025-06-06T12:54:52.214Z Last Updated: 2025-06-06T13:41:50.378Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: esigngenie Products: Foxit eSign for WordPress Problem Types: CWE-497 Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in esigngenie Foxit eSign for WordPress allows Retrieve Embedded Sensitive Data. This issue affects Foxit eSign for WordPress: from n/a through 2.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/esign-genie-for-wp/vulnerability/wordpress-foxit-esign-for-wordpre
s: - https://patchstack.com/database/wordpress/plugin/esign-genie-for-wp/vulnerability/wordpress-foxit-esign-for-wordpress-2-0-3-other-vulnerability-type-vulnerability?_s_id=cve
CVE ID: CVE-2025-49420 State: PUBLISHED Published: 2025-08-20T08:03:43.644Z Last Updated: 2025-08-20T13:47:35.297Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Pierre-Henri Lavigne Products: Markup Markdown Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre-Henri Lavigne Markup Markdown allows Stored XSS. This issue affects Markup Markdown: from n/a through 3.20.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/markup-markdown/vulnerability/wordpress-markup-markdown-plugin-3-20-6-cross-site-scripti
k.com/database/wordpress/plugin/markup-markdown/vulnerability/wordpress-markup-markdown-plugin-3-20-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49421 State: PUBLISHED Published: 2025-06-06T12:54:51.748Z Last Updated: 2025-06-06T13:44:11.350Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Andrei Filonov Products: WP Text Expander Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Andrei Filonov WP Text Expander allows SQL Injection. This issue affects WP Text Expander: from n/a through 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-text-expander/vulnerability/wordpress-wp-text-expander-1-0-1-sql-injection-vulnerability?_s_id
abase/wordpress/plugin/wp-text-expander/vulnerability/wordpress-wp-text-expander-1-0-1-sql-injection-vulnerability?_s_id=cve