Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-26519 State: PUBLISHED Published: 2025-02-14T00:00:00.000Z Last Updated: 2025-02-14T17:02:39.470Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L) Vendors: musl-libc Products: musl Problem Types: CWE-787 Description: musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.musl-libc.org/cgit/musl/commit/?id=e5adcd97b5196e29991b524237381a0202a60659 - https://www.openwall.com/lists/oss-security/2025/02/13/2 - https://git.musl-libc.org/cgit/musl/com
24237381a0202a60659 - https://www.openwall.com/lists/oss-security/2025/02/13/2 - https://git.musl-libc.org/cgit/musl/commit/?id=c47ad25ea3b484e10326f933e927c0bc8cded3da
CVE ID: CVE-2025-26520 State: PUBLISHED Published: 2025-02-12T00:00:00.000Z Last Updated: 2025-02-12T16:02:53.876Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Cacti Products: Cacti Problem Types: CWE-89 Description: Cacti through 1.2.29 allows SQL injection in the template function in host_templates.php via the graph_template parameter. NOTE: this issue exists because of an incomplete fix for CVE-2024-54146. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Cacti/cacti/pull/6096 - https://github.com/Cacti/cacti/commit/7fa60c03ad4a69c701ac6b77c85a8927df7acd51
CVE ID: CVE-2025-26521 State: PUBLISHED Published: 2025-06-10T23:08:48.602Z Last Updated: 2025-06-14T03:56:16.937Z Vendors: Apache Software Foundation Products: Apache CloudStack Problem Types: CWE-200 Description: When an Apache CloudStack user-account creates a CKS-based Kubernetes cluster in a project, the API key and the secret key of the 'kubeadmin' user of the caller account are used to create the secret config in the CKS-based Kubernetes cluster. A member of the project who can access the CKS-based Kubernetes cluster, can also access the API key and secret key of the 'kubeadmin' user of the CKS cluster's creator's account. An attacker who's a member of the project can exploit this to
'kubeadmin' user of the CKS cluster's creator's account. An attacker who's a member of the project can exploit this to impersonate and perform privileged actions that can result in complete compromise of the confidentiality, integrity, and availability of resources owned by the creator's account. CKS users are recommended to upgrade to version 4.19.3.0 or 4.20.1.0, which fixes this issue.Updating Existing Kubernetes Clusters in ProjectsA service account should be created for each project to provide limited access specifically for Kubernetes cluster providers and autoscaling. Follow the steps below to create a new service account, update the secret inside the cluster, and regenerate existing
g. Follow the steps below to create a new service account, update the secret inside the cluster, and regenerate existing API and service keys:1. Create a New Service AccountCreate a new account using the role "Project Kubernetes Service Role" with the following details: Account Name kubeadmin-<FIRST_EIGHT_CHARACTERS_OF_PROJECT_ID> First Name Kubernetes Last Name Service User Account Type 0 (Normal User) Role ID <ID_OF_SERVICE_ROLE> 2. Add the Service Account to the ProjectAdd this account to the project where the Kubernetes cluster(s) are hosted. 3. Generate API and Secret KeysGenerate API Key and Secret Key for the default user of this account. 4. Update the CloudStack Secret in the Kuberne
KeysGenerate API Key and Secret Key for the default user of this account. 4. Update the CloudStack Secret in the Kubernetes ClusterCreate a temporary file `/tmp/cloud-config` with the following data: api-url = <API_URL> # For example: <MS_URL>/client/api api-key = <SERVICE_USER_API_KEY> secret-key = <SERVICE_USER_SECRET_KEY> project-id = <PROJECT_ID> Delete the existing secret using kubectl and Kubernetes cluster config: ./kubectl --kubeconfig kube.conf -n kube-system delete secret cloudstack-secret Create a new secret using kubectl and Kubernetes cluster config: ./kubectl --kubeconfig kube.conf -n kube-system create secret generic cloudstack-secret --from-file=/tmp/cloud-config Remove the t
--kubeconfig kube.conf -n kube-system create secret generic cloudstack-secret --from-file=/tmp/cloud-config Remove the temporary file: rm /tmp/cloud-config5. Regenerate API and Secret KeysRegenerate the API and secret keys for the original user account that was used to create the Kubernetes cluster. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0/ - https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-19-3-0-and-4-20-1-0/ - https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60
CVE ID: CVE-2025-26522 State: PUBLISHED Published: 2025-02-14T11:24:17.326Z Last Updated: 2025-02-14T16:33:17.339Z Vendors: Rupeeseed Technology Ventures Products: RupeeWeb Problem Types: CWE-302 Description: This vulnerability exists in RupeeWeb trading platform due to improper implementation of OTP validation mechanism in certain API endpoints. A remote attacker with valid credentials could exploit this vulnerability by manipulating API responses. Successful exploitation of this vulnerability could allow the attacker to bypass Two-Factor Authentication (2FA) for other user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?p
r accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0020
CVE ID: CVE-2025-26523 State: PUBLISHED Published: 2025-02-14T11:32:30.662Z Last Updated: 2025-02-14T15:05:58.825Z Vendors: Rupeeseed Technology Ventures Products: RupeeWeb Problem Types: CWE-266 Description: This vulnerability exists in RupeeWeb trading platform due to insufficient authorization controls on certain API endpoints handling addition and deletion operations. Successful exploitation of this vulnerability could allow an authenticated remote attacker to modify information belonging to other user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0020
CVE ID: CVE-2025-26524 State: PUBLISHED Published: 2025-02-14T11:36:48.329Z Last Updated: 2025-02-14T16:27:38.618Z Vendors: Rupeeseed Technology Ventures Products: RupeeWeb Problem Types: CWE-799 Description: This vulnerability exists in RupeeWeb trading platform due to missing rate limiting on OTP requests in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoints which could lead to the OTP bombing/ flooding on the targeted system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0020
CVE ID: CVE-2025-26525 State: PUBLISHED Published: 2025-02-24T19:31:43.881Z Last Updated: 2025-02-24T20:10:27.216Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Moodle Project Products: moodle Problem Types: CWE-552 Description: Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available (such as those with TeX Live installed). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=466141 - https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84136
CVE ID: CVE-2025-26526 State: PUBLISHED Published: 2025-02-24T19:39:23.646Z Last Updated: 2025-02-24T20:11:24.973Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Moodle Project Products: moodle Problem Types: CWE-863 Description: Separate Groups mode restrictions were not factored into permission checks before allowing viewing or deletion of responses in Feedback activities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=466142 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79976
CVE ID: CVE-2025-26527 State: PUBLISHED Published: 2025-02-24T19:44:06.228Z Last Updated: 2025-02-24T20:12:14.116Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Moodle Project Products: moodle Problem Types: CWE-1230 Description: Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=466143 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-83941
CVE ID: CVE-2025-26528 State: PUBLISHED Published: 2025-02-24T19:50:11.812Z Last Updated: 2025-02-24T20:13:02.785Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: Moodle Project Products: moodle Problem Types: CWE-79 Description: The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=466144 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-82896
CVE ID: CVE-2025-26529 State: PUBLISHED Published: 2025-02-24T19:52:48.821Z Last Updated: 2025-02-24T20:14:08.198Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Moodle Project Products: moodle Problem Types: CWE-79 Description: Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=466145 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84145
CVE ID: CVE-2025-26530 State: PUBLISHED Published: 2025-02-24T19:56:14.586Z Last Updated: 2025-02-24T20:06:40.986Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Moodle Project Products: moodle Problem Types: CWE-79 Description: The question bank filter required additional sanitizing to prevent a reflected XSS risk. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=466146 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84146
CVE ID: CVE-2025-26531 State: PUBLISHED Published: 2025-02-24T20:02:57.732Z Last Updated: 2025-02-25T14:19:51.530Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Moodle Project Products: moodle Problem Types: CWE-863 Description: Insufficient capability checks made it possible to disable badges a user does not have permission to access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=466148 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84239
CVE ID: CVE-2025-26532 State: PUBLISHED Published: 2025-02-24T20:05:21.153Z Last Updated: 2025-02-25T14:19:13.124Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Moodle Project Products: moodle Problem Types: CWE-863 Description: Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=466149 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84003
CVE ID: CVE-2025-26533 State: PUBLISHED Published: 2025-02-24T20:07:44.582Z Last Updated: 2025-02-25T14:35:34.040Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Moodle Project Products: moodle Problem Types: CWE-89 Description: An SQL injection risk was identified in the module list filter within course search. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=466150 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84271
CVE ID: CVE-2025-26534 State: PUBLISHED Published: 2025-03-03T13:30:27.779Z Last Updated: 2025-03-03T15:49:36.169Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: NotFound Products: Helloprint Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NotFound Helloprint allows Path Traversal. This issue affects Helloprint: from n/a through 2.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/helloprint/vulnerability/wordpress-helloprint-plugin-2-0-7-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2025-26535 State: PUBLISHED Published: 2025-03-03T13:30:27.941Z Last Updated: 2025-03-03T15:48:35.451Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: NotFound Products: Bitcoin / AltCoin Payment Gateway for WooCommerce Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Bitcoin / AltCoin Payment Gateway for WooCommerce allows Blind SQL Injection. This issue affects Bitcoin / AltCoin Payment Gateway for WooCommerce: from n/a through 1.7.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/
.7.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woo-altcoin-payment-gateway/vulnerability/wordpress-bitcoin-altcoin-payment-gateway-for-woocommerce-multivendor-store-shop-plugin-1-7-6-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-26536 State: PUBLISHED Published: 2025-03-26T14:24:17.908Z Last Updated: 2025-03-26T15:31:39.873Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Yendif Player Products: Another Events Calendar Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yendif Player Another Events Calendar allows Reflected XSS. This issue affects Another Events Calendar: from n/a through 1.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/another-events-calendar/vulnerability/wordpress-another-events-calendar-plugin
/patchstack.com/database/wordpress/plugin/another-events-calendar/vulnerability/wordpress-another-events-calendar-plugin-1-7-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26537 State: PUBLISHED Published: 2025-03-26T14:24:18.188Z Last Updated: 2025-03-26T17:25:22.108Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: GDPR Tools Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound GDPR Tools allows Stored XSS. This issue affects GDPR Tools: from n/a through 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gdpr-tools/vulnerability/wordpress-gdpr-tools-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26538 State: PUBLISHED Published: 2025-02-13T13:53:08.575Z Last Updated: 2025-02-18T19:49:30.581Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Dan Rossiter Products: Prezi Embedder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Prezi Embedder allows Stored XSS. This issue affects Prezi Embedder: from n/a through 2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/prezi-embedder/vulnerability/wordpress-prezi-embedder-plugin-2-1-cross-site-scripting-xss-vulnerability?_s_id=
ss/plugin/prezi-embedder/vulnerability/wordpress-prezi-embedder-plugin-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26539 State: PUBLISHED Published: 2025-02-13T13:53:09.254Z Last Updated: 2025-02-18T19:49:20.833Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: petkivim Products: Embed Google Map Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in petkivim Embed Google Map allows Stored XSS. This issue affects Embed Google Map: from n/a through 3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/embed-google-map/vulnerability/wordpress-embed-google-map-plugin-3-2-cross-site-scripting-xss-vulnerability?_s_i
/plugin/embed-google-map/vulnerability/wordpress-embed-google-map-plugin-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26540 State: PUBLISHED Published: 2025-03-03T13:30:28.132Z Last Updated: 2025-03-03T15:47:49.516Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: NotFound Products: Helloprint Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in NotFound Helloprint allows Path Traversal. This issue affects Helloprint: from n/a through 2.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/helloprint/vulnerability/wordpress-helloprint-plugin-2-0-7-arbitrary-file-deletion-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-26541 State: PUBLISHED Published: 2025-03-26T14:24:18.426Z Last Updated: 2025-03-26T17:22:42.511Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: CodeSolz Products: Bitcoin / AltCoin Payment Gateway for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerce allows Reflected XSS. This issue affects Bitcoin / AltCoin Payment Gateway for WooCommerce: from n/a through 1.7.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woo-altcoi
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woo-altcoin-payment-gateway/vulnerability/wordpress-bitcoin-altcoin-payment-gateway-for-woocommerce-plugin-1-7-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26542 State: PUBLISHED Published: 2025-03-26T14:24:18.616Z Last Updated: 2025-03-26T15:31:32.772Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Zalo Live Chat Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Zalo Live Chat allows Reflected XSS. This issue affects Zalo Live Chat: from n/a through 1.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/zalo-live-chat/vulnerability/wordpress-zalo-live-chat-plugin-1-1-0-reflected-cross-site-scripting-xss-vulnerability
ugin/zalo-live-chat/vulnerability/wordpress-zalo-live-chat-plugin-1-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26543 State: PUBLISHED Published: 2025-02-13T13:52:48.843Z Last Updated: 2025-02-18T17:20:25.320Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Pukhraj Suthar Products: Simple Responsive Menu Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Pukhraj Suthar Simple Responsive Menu allows Stored XSS. This issue affects Simple Responsive Menu: from n/a through 2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-responsive-menu/vulnerability/wordpress-simple-responsive-menu-plugin-2-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26544 State: PUBLISHED Published: 2025-03-26T14:24:18.777Z Last Updated: 2025-03-26T15:31:25.721Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: UTM tags tracking for Contact Form 7 Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound UTM tags tracking for Contact Form 7 allows Reflected XSS. This issue affects UTM tags tracking for Contact Form 7: from n/a through 2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cf7-utm-tracking/vulnerability/wordpressutm-tags-la
ment: References: - https://patchstack.com/database/wordpress/plugin/cf7-utm-tracking/vulnerability/wordpressutm-tags-landing-page-plugin-1-4-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26545 State: PUBLISHED Published: 2025-02-13T13:52:49.572Z Last Updated: 2025-02-18T19:53:48.554Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: shisuh Products: Related Posts Line-up-Exactly by Milliard Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in shisuh Related Posts Line-up-Exactly by Milliard allows Stored XSS. This issue affects Related Posts Line-up-Exactly by Milliard: from n/a through 0.0.22. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/related-posts-line-up-exactry-by-milliard/vulnerability/wordpress-related-posts-line-up-ex
com/database/wordpress/plugin/related-posts-line-up-exactry-by-milliard/vulnerability/wordpress-related-posts-line-up-exactly-by-milliard-plugin-0-0-22-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26546 State: PUBLISHED Published: 2025-03-26T14:24:18.929Z Last Updated: 2025-03-26T15:31:17.111Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Cookies Pro Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Cookies Pro allows Reflected XSS. This issue affects Cookies Pro: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cookies-pro/vulnerability/wordpress-cookies-pro-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26547 State: PUBLISHED Published: 2025-02-13T13:52:50.182Z Last Updated: 2025-02-18T19:53:40.131Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: nagarjunsonti Products: My Login Logout Plugin Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in nagarjunsonti My Login Logout Plugin allows Stored XSS. This issue affects My Login Logout Plugin: from n/a through 2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/my-loginlogout/vulnerability/wordpress-my-login-logout-plugin-plugin-2-4-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve
CVE ID: CVE-2025-26548 State: PUBLISHED Published: 2025-03-15T21:57:00.466Z Last Updated: 2025-03-17T16:50:56.449Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Random Image Selector Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Random Image Selector allows Reflected XSS. This issue affects Random Image Selector: from n/a through 2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/random-image-selector/vulnerability/wordpress-random-image-selector-plugin-1-5-6-reflected-cross
tabase/wordpress/plugin/random-image-selector/vulnerability/wordpress-random-image-selector-plugin-1-5-6-reflected-cross-site-scripting-vulnerability?_s_id=cve