Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-65497 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T18:26:23.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSL_get_SSL_CTX() to return NULL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/obgm/libcoap/issues/1745 - https://github.com/obgm/libcoap/pull/1750
CVE ID: CVE-2025-65498 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T18:26:02.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSL_get_SSL_CTX() to return NULL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/obgm/libcoap/issues/1746 - https://github.com/obgm/libcoap/pull/1750
CVE ID: CVE-2025-65499 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T18:27:33.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: Array index error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSL_get_ex_data_X509_STORE_CTX_idx() to return -1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/obgm/libcoap/issues/1747 - https://github.com/obgm/libcoap/pull/1750
CVE ID: CVE-2025-65500 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T18:28:00.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSL_get_SSL_CTX() to return NULL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/obgm/libcoap/issues/1746 - https://github.com/obgm/libcoap/pull/1750
CVE ID: CVE-2025-65501 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T18:28:32.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: Null pointer dereference in coap_dtls_info_callback() in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a DTLS handshake where SSL_get_app_data() returns NULL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/obgm/libcoap/issues/1748 - https://github.com/obgm/libcoap/pull/1750
CVE ID: CVE-2025-65502 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T18:29:36.744Z Vendors: n/a Products: n/a Problem Types: n/a Description: Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initialization where SSL_CTX_get_cert_store() returns NULL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cesanta/mongoose/issues/3306 - https://github.com/cesanta/mongoose/pull/3307
CVE ID: CVE-2025-65503 State: PUBLISHED Published: 2025-11-24T00:00:00.000Z Last Updated: 2025-11-24T18:20:27.884Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use after free in endpoint destructors in Redboltz async_mqtt 10.2.5 allows local users to cause a denial of service via triggering SSL initialization failure that results in incorrect destruction order between io_context and endpoint objects. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/redboltz/async_mqtt/issues/436 - https://github.com/redboltz/async_mqtt/pull/437
CVE ID: CVE-2025-65933 State: REJECTED Published: N/A Last Updated: 2025-11-19T03:55:09.100Z Description: No description available.
CVE ID: CVE-2025-65934 State: REJECTED Published: N/A Last Updated: 2025-11-19T03:55:08.638Z Description: No description available.
CVE ID: CVE-2025-65935 State: REJECTED Published: N/A Last Updated: 2025-11-19T03:55:08.167Z Description: No description available.
CVE ID: CVE-2025-65936 State: REJECTED Published: N/A Last Updated: 2025-11-19T03:55:07.684Z Description: No description available.
CVE ID: CVE-2025-65937 State: REJECTED Published: N/A Last Updated: 2025-11-19T03:55:07.224Z Description: No description available.
CVE ID: CVE-2025-65938 State: REJECTED Published: N/A Last Updated: 2025-11-19T03:55:06.765Z Description: No description available.
CVE ID: CVE-2025-65939 State: REJECTED Published: N/A Last Updated: 2025-11-19T03:55:06.293Z Description: No description available.
CVE ID: CVE-2025-65940 State: REJECTED Published: N/A Last Updated: 2025-11-19T03:55:05.821Z Description: No description available.
CVE ID: CVE-2025-65941 State: REJECTED Published: N/A Last Updated: 2025-11-19T03:55:05.295Z Description: No description available.
CVE ID: CVE-2025-65944 State: PUBLISHED Published: 2025-11-25T00:23:53.215Z Last Updated: 2025-11-25T00:23:53.215Z Vendors: getsentry Products: sentry-javascript Problem Types: CWE-201 Description: Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the Sentry SDK has sendDefaultPii: true it is possible to inadvertently send certain sensitive HTTP headers, including the Cookie header, to Sentry. Those headers would be stored within a Sentry organization as part of the associated trace. A person with access to the Sentry organization could then view and use these sensitive values to impersonate or escalate their
n with access to the Sentry organization could then view and use these sensitive values to impersonate or escalate their privileges within the application. This issue has been patched in version 10.27.0. References: - https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-6465-jgvq-jhgp - https://github.com/getsentry/sentry-javascript/pull/17475 - https://github.com/getsentry/sentry-javascript/commit/a820fa2891fdcf985b834a5b557edf351ec54539 - https://github.com/getsentry/sentry-javascript/releases/tag/10.11.0
CVE ID: CVE-2025-65946 State: PUBLISHED Published: 2025-11-21T22:11:12.163Z Last Updated: 2025-11-21T22:11:12.163Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: RooCodeInc Products: Roo-Code Problem Types: CWE-77, CWE-20 Description: Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it was possible for Roo to automatically execute commands that did not match the allow list prefixes. This issue has been patched in version 3.26.7. References: - https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-hwm7-w97p-4h8p - https://github.com/RooCodeInc/Roo-Code/pull/7667 - ht
.com/RooCodeInc/Roo-Code/security/advisories/GHSA-hwm7-w97p-4h8p - https://github.com/RooCodeInc/Roo-Code/pull/7667 - https://github.com/RooCodeInc/Roo-Code/commit/b50104cc5987ce64f5154309d967ae8c74cfd1f3
CVE ID: CVE-2025-65947 State: PUBLISHED Published: 2025-11-21T22:15:30.181Z Last Updated: 2025-11-24T14:56:27.822Z Vendors: jzeuzs Products: thread-amount Problem Types: CWE-400, CWE-772 Description: thread-amount is a tool that gets the amount of threads in the current process. Prior to version 0.2.2, there are resource leaks when querying thread counts on Windows and Apple platforms. In Windows platforms, the thread_amount function calls CreateToolhelp32Snapshot but fails to close the returned HANDLE using CloseHandle. Repeated calls to this function will cause the handle count of the process to grow indefinitely, eventually leading to system instability or process termination when the han
count of the process to grow indefinitely, eventually leading to system instability or process termination when the handle limit is reached. In Apple platforms, the thread_amount function calls task_threads (via Mach kernel APIs) which allocates memory for the thread list. The function fails to deallocate this memory using vm_deallocate. Repeated calls will result in a steady memory leak, eventually causing the process to be killed by the OOM (Out of Memory) killer. This issue has been patched in version 0.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jzeuzs/thread-amount/security/advisories/GHSA-jf9p-2fv9-2jp2 - https://github.com/jzeuzs/thread-am
- https://github.com/jzeuzs/thread-amount/security/advisories/GHSA-jf9p-2fv9-2jp2 - https://github.com/jzeuzs/thread-amount/pull/29 - https://github.com/jzeuzs/thread-amount/commit/28860d4a38286609cb884c13b5b7941edc2390e5
CVE ID: CVE-2025-65951 State: PUBLISHED Published: 2025-11-25T00:30:14.735Z Last Updated: 2025-11-25T00:30:14.735Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: mescuwa Products: entropy-derby Problem Types: CWE-200, CWE-327 Description: Inside Track / Entropy Derby is a research-grade horse-racing betting engine. Prior to commit 2d38d2f, the VDF-based timelock encryption system fails to enforce sequential delay against the betting operator. Bettors pre-compute the entire Wesolowski VDF and include vdfOutputHex in their encrypted bet ticket, allowing the house to decrypt immediately using fast proof verification instead of expensive VDF evaluation. This issu
, allowing the house to decrypt immediately using fast proof verification instead of expensive VDF evaluation. This issue has been patched via commit 2d38d2f. References: - https://github.com/mescuwa/entropy-derby/security/advisories/GHSA-pm54-f847-w4mh - https://github.com/mescuwa/entropy-derby/commit/2d38d2f16bbb3b4240698148f80d8c5202725c77
CVE ID: CVE-2025-65998 State: PUBLISHED Published: 2025-11-24T13:47:03.979Z Last Updated: 2025-11-24T15:36:14.583Z Vendors: Apache Software Foundation Products: Apache Syncope Problem Types: CWE-321 Description: Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option. When AES is configured, the default key value, hard-coded in the source code, is always used. This allows a malicious attacker, once obtained access to the internal database content, to reconstruct the original cleartext password values. This is not affecting encrypted plain attributes, whose values are also stored using AES encryptio
text password values. This is not affecting encrypted plain attributes, whose values are also stored using AES encryption. Users are recommended to upgrade to version 3.0.15 / 4.0.3, which fix this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/fjh0tb0d1xkbphc5ogdsc348ppz88cts
CVE ID: CVE-2025-66053 State: PUBLISHED Published: 2025-11-21T12:29:53.446Z Last Updated: 2025-11-21T14:25:54.171Z Vendors: Kriesi Products: Enfold Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold enfold allows Stored XSS.This issue affects Enfold: from n/a through <= 7.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/enfold/vulnerability/wordpress-enfold-theme-7-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-66055 State: PUBLISHED Published: 2025-11-21T12:29:53.666Z Last Updated: 2025-11-21T14:26:56.725Z Vendors: Icegram Products: Email Subscribers & Newsletters Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Icegram Email Subscribers & Newsletters email-subscribers allows Object Injection.This issue affects Email Subscribers & Newsletters: from n/a through <= 5.9.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/email-subscribers/vulnerability/wordpress-email-subscribers-newsletters-plugin-5-9-10-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-66056 State: PUBLISHED Published: 2025-11-21T12:29:54.000Z Last Updated: 2025-11-21T14:27:35.265Z Vendors: Uncanny Owl Products: Uncanny Automator Problem Types: CWE-497 Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Retrieve Embedded Sensitive Data.This issue affects Uncanny Automator: from n/a through < 6.10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/uncanny-automator/vulnerability/wordpress-uncanny-automator-plugin-6-10-0-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-66057 State: PUBLISHED Published: 2025-11-21T12:29:54.209Z Last Updated: 2025-11-21T14:43:27.151Z Vendors: boldthemes Products: Bold Page Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows DOM-Based XSS.This issue affects Bold Page Builder: from n/a through <= 5.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/bold-page-builder/vulnerability/wordpress-bold-page-builder-plugin-5-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-66059 State: PUBLISHED Published: 2025-11-21T12:29:54.426Z Last Updated: 2025-11-21T14:44:29.176Z Vendors: Craig Hewitt Products: Seriously Simple Podcasting Problem Types: CWE-497 Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Retrieve Embedded Sensitive Data.This issue affects Seriously Simple Podcasting: from n/a through <= 3.13.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/seriously-simple-podcasting/vulnerability/wordpress-seriously-simple-podcasting-plugin-3-13-0-
database/Wordpress/Plugin/seriously-simple-podcasting/vulnerability/wordpress-seriously-simple-podcasting-plugin-3-13-0-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-66060 State: PUBLISHED Published: 2025-11-21T12:29:54.618Z Last Updated: 2025-11-21T15:47:08.974Z Vendors: Craig Hewitt Products: Seriously Simple Podcasting Problem Types: CWE-862 Description: Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through <= 3.13.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/seriously-simple-podcasting/vulnerability/wordpress-seriously-simple-podcasting-plugin-3-13-0-broken-access-control
ugin/seriously-simple-podcasting/vulnerability/wordpress-seriously-simple-podcasting-plugin-3-13-0-broken-access-control-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-66061 State: PUBLISHED Published: 2025-11-21T12:29:54.807Z Last Updated: 2025-11-21T16:21:18.999Z Vendors: Craig Hewitt Products: Seriously Simple Podcasting Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Cross Site Request Forgery.This issue affects Seriously Simple Podcasting: from n/a through <= 3.13.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/seriously-simple-podcasting/vulnerability/wordpress-seriously-simple-podcasting-plugin-3-13-0-cross-site-request-forgery-csrf-vulnerability?_
asting/vulnerability/wordpress-seriously-simple-podcasting-plugin-3-13-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-66062 State: PUBLISHED Published: 2025-11-21T12:29:54.981Z Last Updated: 2025-11-21T16:29:14.850Z Vendors: Frank Goossens Products: WP YouTube Lyte Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Frank Goossens WP YouTube Lyte wp-youtube-lyte allows Phishing.This issue affects WP YouTube Lyte: from n/a through <= 1.7.28. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wp-youtube-lyte/vulnerability/wordpress-wp-youtube-lyte-plugin-1-7-28-open-redirection-vulnerability?_s_id=cve
CVE ID: CVE-2025-66063 State: PUBLISHED Published: 2025-11-21T12:29:55.169Z Last Updated: 2025-11-21T16:24:13.033Z Vendors: jgwhite33 Products: WP Google Review Slider Problem Types: CWE-862 Description: Missing Authorization vulnerability in jgwhite33 WP Google Review Slider wp-google-places-review-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Google Review Slider: from n/a through <= 17.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wp-google-places-review-slider/vulnerability/wordpress-wp-google-review-slider-plugin-17-4-broken-access-control-vulnerability?_s_id
aces-review-slider/vulnerability/wordpress-wp-google-review-slider-plugin-17-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66064 State: PUBLISHED Published: 2025-11-21T12:29:55.338Z Last Updated: 2025-11-21T18:46:19.123Z Vendors: Syed Balkhi Products: Giveaways and Contests by RafflePress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Cross Site Request Forgery.This issue affects Giveaways and Contests by RafflePress: from n/a through <= 1.12.20. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/rafflepress/vulnerability/wordpress-giveaways-and-contests-by-rafflepress-plugin-1-12-20-cross-site-request-forgery-csrf-vulnera
ess/vulnerability/wordpress-giveaways-and-contests-by-rafflepress-plugin-1-12-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-66065 State: PUBLISHED Published: 2025-11-21T12:29:55.513Z Last Updated: 2025-11-21T21:36:49.027Z Vendors: Jegstudio Products: Gutenverse Problem Types: CWE-862 Description: Missing Authorization vulnerability in Jegstudio Gutenverse gutenverse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse: from n/a through <= 3.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/gutenverse/vulnerability/wordpress-gutenverse-plugin-3-2-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66066 State: PUBLISHED Published: 2025-11-21T12:29:55.680Z Last Updated: 2025-11-21T21:51:56.919Z Vendors: EnvoThemes Products: Envo Extra Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvoThemes Envo Extra envo-extra allows Stored XSS.This issue affects Envo Extra: from n/a through <= 1.9.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/envo-extra/vulnerability/wordpress-envo-extra-plugin-1-9-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-66067 State: PUBLISHED Published: 2025-11-21T12:29:55.849Z Last Updated: 2025-11-21T18:32:47.725Z Vendors: FunnelKit Products: Funnel Builder by FunnelKit Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Funnel Builder by FunnelKit funnel-builder allows DOM-Based XSS.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.13.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/funnel-builder/vulnerability/wordpress-funnel-builder-by-funnelkit-plugin-3-13-1-2-cross-site-scripting-xss-vulnerability
unnel-builder/vulnerability/wordpress-funnel-builder-by-funnelkit-plugin-3-13-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-66069 State: PUBLISHED Published: 2025-11-21T12:29:56.025Z Last Updated: 2025-11-21T16:40:54.471Z Vendors: Themeisle Products: PPOM for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PPOM for WooCommerce: from n/a through <= 33.0.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/woocommerce-product-addon/vulnerability/wordpress-ppom-for-woocommerce-plugin-33-0-16-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66071 State: PUBLISHED Published: 2025-11-21T12:29:56.210Z Last Updated: 2025-11-24T18:01:16.243Z Vendors: tychesoftwares Products: Custom Order Numbers for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in tychesoftwares Custom Order Numbers for WooCommerce custom-order-numbers-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Order Numbers for WooCommerce: from n/a through <= 1.11.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/custom-order-numbers-for-woocommerce/vulnerability/wordpress-custom-order-n
vdp.patchstack.com/database/Wordpress/Plugin/custom-order-numbers-for-woocommerce/vulnerability/wordpress-custom-order-numbers-for-woocommerce-plugin-1-11-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66072 State: PUBLISHED Published: 2025-11-21T12:29:56.382Z Last Updated: 2025-11-24T18:02:16.086Z Vendors: Stiofan Products: UsersWP Problem Types: CWE-862 Description: Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through <= 1.2.47. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/userswp/vulnerability/wordpress-userswp-plugin-1-2-47-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-66073 State: PUBLISHED Published: 2025-11-21T12:29:56.667Z Last Updated: 2025-11-21T21:48:09.434Z Vendors: Cozmoslabs Products: WP Webhooks Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Object Injection.This issue affects WP Webhooks: from n/a through <= 3.3.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wp-webhooks/vulnerability/wordpress-wp-webhooks-plugin-3-3-8-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-66075 State: PUBLISHED Published: 2025-11-21T12:29:56.896Z Last Updated: 2025-11-21T16:34:57.814Z Vendors: WP Legal Pages Products: WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Problem Types: CWE-862 Description: Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 4.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/gdpr-cookie-consent/vulnerability/wordpress-wp-cook
: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/gdpr-cookie-consent/vulnerability/wordpress-wp-cookie-notice-for-gdpr-ccpa-eprivacy-consent-plugin-4-0-3-broken-access-control-vulnerability?_s_id=cve