Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-9100 State: PUBLISHED Published: 2025-08-18T01:32:06.042Z Last Updated: 2025-08-18T13:10:57.795Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R) Vendors: zhenfeng13 Products: My-Blog Problem Types: CWE-294, CWE-287 Description: A security flaw has been discovered in zhenfeng13 My-Blog 1.0.0. This vulnerability affects unknown code of the file /blog/comment of the component Frontend Blog Article Comment Handler. The manipulation leads to authentication bypass by capture-replay. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320422 - https://vuldb.com/?ctiid.320422 - https://vuldb.com/?submit.628097 - https://github.com/ZHENFENG13/My-Blog/issues/149 - https://github.com/ZHENFENG13/My-Blog/issues/149#issue-3265307853
CVE ID: CVE-2025-9101 State: PUBLISHED Published: 2025-08-18T02:02:06.065Z Last Updated: 2025-08-18T13:10:02.946Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: zhenfeng13 Products: My-Blog Problem Types: CWE-79, CWE-94 Description: A weakness has been identified in zhenfeng13 My-Blog up to 1.0.0. This issue affects some unknown processing of the file /admin/tags/save of the component Tag Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320423 - https://vuldb.com/?ctiid.
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320423 - https://vuldb.com/?ctiid.320423 - https://vuldb.com/?submit.628095 - https://github.com/ZHENFENG13/My-Blog/issues/147 - https://github.com/ZHENFENG13/My-Blog/issues/147#issue-3265306297
CVE ID: CVE-2025-9102 State: PUBLISHED Published: 2025-08-18T02:32:05.555Z Last Updated: 2025-08-18T13:08:52.483Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: 1&1 Mail & Media Products: mail.com App Problem Types: CWE-926 Description: A security vulnerability has been detected in 1&1 Mail & Media mail.com App 8.8.0 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component com.mail.mobile.android.mail. The manipulation leads to improper export of android application components. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was
le to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320424 - https://vuldb.com/?ctiid.320424 - https://vuldb.com/?submit.628264 - https://github.com/KMov-g/androidapps/blob/main/com.mail.mobile.android.mail.md - https://github.com/KMov-g/androidapps/blob/main/com.mail.mobile.android.mail.md#steps-to-reproduce
CVE ID: CVE-2025-9103 State: PUBLISHED Published: 2025-08-18T03:02:06.244Z Last Updated: 2025-08-18T13:07:54.670Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: n/a Products: ZenCart Problem Types: CWE-79, CWE-94 Description: A vulnerability was detected in ZenCart 2.1.0. Affected by this vulnerability is an unknown functionality of the component CKEditor. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor declares this as "intended behavior, allowed for authorized administrators". A
s still doubted at the moment. The vendor declares this as "intended behavior, allowed for authorized administrators". Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320425 - https://vuldb.com/?ctiid.320425 - https://vuldb.com/?submit.628298 - https://hkohi.ca/vulnerability/28 - https://gist.github.com/0xHamy/b2674eeffd1f73af96d29f152c47bcbd
CVE ID: CVE-2025-9104 State: PUBLISHED Published: 2025-08-18T03:32:05.598Z Last Updated: 2025-08-18T13:06:39.390Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Diario Problem Types: CWE-79, CWE-94 Description: A flaw has been found in Portabilis i-Diario up to 1.5.0. The affected element is an unknown function of the file /planos-de-aulas-por-disciplina/ of the component Informações Adicionais Page. This manipulation of the argument Parecer/Objeto de Conhecimento/Habilidades causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this
on of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320426 - https://vuldb.com/?ctiid.320426 - https://vuldb.com/?submit.627565 - https://github.com/marcelomulder/CVE/blob/main/i-diario/CVE-2025-9104.md - https://github.com/marcelomulder/CVE/blob/main/i-diario/Stored%20XSS%20endpoint%20planos-de-aulas-por-disciplina.(ID)%20in%20multiples%20parameters.md#poc
CVE ID: CVE-2025-9105 State: PUBLISHED Published: 2025-08-18T04:02:05.133Z Last Updated: 2025-08-18T12:51:23.251Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Diario Problem Types: CWE-79, CWE-94 Description: A vulnerability has been found in Portabilis i-Diario up to 1.5.0. The impacted element is an unknown function of the file /planos-de-ensino-por-areas-de-conhecimento/ of the component Informações Adicionais Page. Such manipulation of the argument Parecer/Conteúdos/Objetivos leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early
k can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320427 - https://vuldb.com/?ctiid.320427 - https://vuldb.com/?submit.627566 - https://github.com/marcelomulder/CVE/blob/main/i-diario/CVE-2025-9105.md - https://github.com/marcelomulder/CVE/blob/main/i-diario/Stored%20XSS%20endpoint%20planos-de-ensino-por-areas-de-conhecimento.(ID)%20in%20multiples%20parameters.md#poc
CVE ID: CVE-2025-9106 State: PUBLISHED Published: 2025-08-18T04:32:05.832Z Last Updated: 2025-08-18T12:48:44.562Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Diario Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Portabilis i-Diario up to 1.5.0. This affects an unknown function of the file /planos-de-ensino-por-disciplina/ of the component Informações Adicionais Page. Performing manipulation of the argument Parecer/Conteúdos/Objetivos results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this dis
carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320428 - https://vuldb.com/?ctiid.320428 - https://vuldb.com/?submit.627567 - https://github.com/marcelomulder/CVE/blob/main/i-diario/CVE-2025-9106%20.md - https://github.com/marcelomulder/CVE/blob/main/i-diario/Stored%20XSS%20endpoint%20planos-de-ensino-por-disciplina.(ID)%20in%20multiples%20parameters.md#poc
CVE ID: CVE-2025-9107 State: PUBLISHED Published: 2025-08-18T05:02:05.171Z Last Updated: 2025-08-18T12:47:54.073Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Diario Problem Types: CWE-79, CWE-94 Description: A vulnerability was determined in Portabilis i-Diario up to 1.5.0. This impacts an unknown function of the file /alunos/search_autocomplete. Executing manipulation of the argument q can lead to cross site scripting. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Not
be utilized. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320429 - https://vuldb.com/?ctiid.320429 - https://vuldb.com/?submit.627568 - https://github.com/marcelomulder/CVE/blob/main/i-diario/CVE-2025-9107.md - https://github.com/marcelomulder/CVE/blob/main/i-diario/Reflected%20XSS%20endpoint%20search_autocomplete%20parameter%20q.md#poc
CVE ID: CVE-2025-9108 State: PUBLISHED Published: 2025-08-18T05:32:05.169Z Last Updated: 2025-08-18T15:36:38.735Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Diario Problem Types: CWE-1021 Description: Affected is an unknown function of the component Login Page. The manipulation leads to improper restriction of rendered ui layers. It is possible to launch the attack remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320430 - https://vuldb.com/?ctiid.320430 - https://vuldb.com/?submit.627923
CVE ID: CVE-2025-9109 State: PUBLISHED Published: 2025-08-18T06:02:06.571Z Last Updated: 2025-08-18T15:34:02.189Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R) Vendors: Portabilis Products: i-Diario Problem Types: CWE-204, CWE-203 Description: A security flaw has been discovered in Portabilis i-Diario up to 1.5.0. Affected by this vulnerability is an unknown functionality of the file /password/email of the component Password Recovery Endpoint. The manipulation results in observable response discrepancy. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitation appears to be difficult. The exploit has
ck remotely. This attack is characterized by high complexity. The exploitation appears to be difficult. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320431 - https://vuldb.com/?ctiid.320431 - https://vuldb.com/?submit.627926
CVE ID: CVE-2025-9111 State: PUBLISHED Published: 2025-09-09T06:00:09.219Z Last Updated: 2025-11-13T20:57:08.301Z Vendors: Unknown Products: AI ChatBot for WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The AI ChatBot for WordPress WordPress plugin before 7.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5845bcff-beb8-45c8-b182-3dc9e209008b/
CVE ID: CVE-2025-9112 State: PUBLISHED Published: 2025-09-08T18:23:47.218Z Last Updated: 2025-09-08T19:44:36.229Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: dreamstechnologies Products: Doccure Problem Types: CWE-434 Description: The Doccure theme for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'doccure_temp_file_uploader' function in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA
ary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2f38498d-0560-4935-b1f5-1fdb62f49a5b?source=cve - https://themeforest.net/item/doccure-medical-wordpress-theme/34329202
CVE ID: CVE-2025-9113 State: PUBLISHED Published: 2025-09-08T18:23:47.771Z Last Updated: 2025-09-08T19:44:29.612Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: dreamstechnologies Products: Doccure Problem Types: CWE-434 Description: The Doccure theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'doccure_temp_upload_to_media' function in all versions up to, and including, 1.4.8. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6ff01c24-fa35-43bc-be60-f2bb37854681?source=cve - https://themeforest.net/item/doccure-medical-wordpress-theme/34329202
CVE ID: CVE-2025-9114 State: PUBLISHED Published: 2025-09-08T18:23:48.130Z Last Updated: 2025-09-08T19:44:19.751Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: dreamstechnologies Products: Doccure Problem Types: CWE-639 Description: The Doccure theme for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.4.8. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Additional Analyst Notes: - CISA ADP Vulnric
to change user passwords and potentially take over administrator accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8f8b1d8f-b2b6-415c-91f2-e5b98048258d?source=cve - https://themeforest.net/item/doccure-medical-wordpress-theme/34329202
CVE ID: CVE-2025-9115 State: PUBLISHED Published: 2025-09-22T06:00:13.333Z Last Updated: 2025-09-22T16:13:00.464Z Vendors: Unknown Products: Etsy Shop Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Etsy Shop WordPress plugin before 3.0.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/67721fa5-4d4f-468b-aa77-c406e68fcf17/
CVE ID: CVE-2025-9118 State: PUBLISHED Published: 2025-08-25T07:05:31.047Z Last Updated: 2025-08-25T13:48:40.821Z Vendors: Google Cloud Products: Dataform Problem Types: CWE-22 Description: A path traversal vulnerability in the NPM package installation process of Google Cloud Dataform allows a remote attacker to read and write files in other customers' repositories via a maliciously crafted package.json file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cloud.devsite.corp.google.com/dataform/docs/security-bulletins#gcp-2025-045
CVE ID: CVE-2025-9119 State: PUBLISHED Published: 2025-08-18T20:32:05.688Z Last Updated: 2025-08-18T20:40:32.927Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Netis Products: WF2419 Problem Types: CWE-79, CWE-94 Description: A vulnerability was determined in Netis WF2419 1.2.29433. This vulnerability affects unknown code of the file /index.htm of the component Wireless Settings Page. This manipulation of the argument SSID with the input <img/src/onerror=prompt(8)> causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did
he exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320456 - https://vuldb.com/?ctiid.320456 - https://vuldb.com/?submit.628410
CVE ID: CVE-2025-9123 State: PUBLISHED Published: 2025-09-11T07:25:01.785Z Last Updated: 2025-09-11T14:37:18.571Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: manchumahara Products: CBX Map for Google Map & OpenStreetMap Problem Types: CWE-79 Description: The CBX Map for Google Map & OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the popup heading and location address parameters in all versions up to, and including, 1.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that
ble for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ebad60ee-8596-46c8-9461-9caf6c6a3454?source=cve - https://wordpress.org/plugins/cbxgooglemap/
CVE ID: CVE-2025-9124 State: PUBLISHED Published: 2025-10-14T12:24:30.355Z Last Updated: 2025-10-14T18:49:54.803Z Vendors: Rockwell Automation Products: Compact GuardLogix® 5370 Problem Types: CWE-248 Description: A denial-of-service security issue in the affected product. The security issue stems from a fault occurring when a crafted CIP unconnected explicit message is sent. This can result in a major non-recoverable fault. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1755.html
CVE ID: CVE-2025-9126 State: PUBLISHED Published: 2025-09-06T03:22:35.311Z Last Updated: 2025-09-08T20:17:09.947Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: designful Products: Smart Table Builder Problem Types: CWE-79 Description: The Smart Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analys
to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/44e68e0c-1b21-411b-9ff7-6b6affc5988e?source=cve - https://plugins.trac.wordpress.org/browser/smart-table-builder/trunk/includes/Frontend.php#L28 - https://wordpress.org/plugins/smart-table-builder/#developers - https://github.com/DesignMike/smart-table-builder/commit/c9ca2adbb39fe4543e1eb56fc90cf1aeab558971 - https://plugins.trac.wordpress.org/changeset/3351768/smart-table-builder/trunk/includes/Frontend.php
CVE ID: CVE-2025-9128 State: PUBLISHED Published: 2025-09-11T07:25:00.605Z Last Updated: 2025-09-11T14:37:36.590Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: eideasy Products: eID Easy Problem Types: CWE-79 Description: The eID Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vuln
scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d8805e63-3750-49f8-81dd-bd3353f30c87?source=cve - https://plugins.trac.wordpress.org/browser/smart-id/trunk/smart-id.php#L240 - https://wordpress.org/plugins/smart-id/#developers
CVE ID: CVE-2025-9129 State: PUBLISHED Published: 2025-10-03T11:17:21.396Z Last Updated: 2025-10-03T13:58:15.917Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: odude Products: Flexi – Guest Submit Problem Types: CWE-79 Description: The Flexi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's flexi-form-tag shortcode in all versions up to, and including, 4.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user a
s, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ccfd4949-07ae-48b6-9aa2-82fd6b1bf692?source=cve - https://plugins.trac.wordpress.org/browser/flexi/trunk/includes/class-flexi-form.php#L572 - https://wordpress.org/plugins/flexi/#developers
CVE ID: CVE-2025-9130 State: PUBLISHED Published: 2025-10-03T11:17:08.101Z Last Updated: 2025-10-03T17:56:37.035Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: codeclouds Products: Unify Problem Types: CWE-79 Description: The Unify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's unify_checkout shortcode in all versions up to, and including, 3.4.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a
ontributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1703a5be-f399-4ea5-8d98-a2efda674aa6?source=cve - https://plugins.trac.wordpress.org/browser/unify/tags/3.4.7/Actions/PlatformApi.php#L379 - https://wordpress.org/plugins/unify/#developers
CVE ID: CVE-2025-9131 State: PUBLISHED Published: 2025-08-23T04:25:45.654Z Last Updated: 2025-08-25T17:37:48.908Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ogulo Products: Ogulo – 360° Tour Problem Types: CWE-79 Description: The Ogulo – 360° Tour plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slug’ parameter in all versions up to, and including, 1.0.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Not
nject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/05a9c77d-a8d6-41b6-a98e-f20638b959d6?source=cve - https://plugins.trac.wordpress.org/browser/ogulo-360-tour/tags/1.0.11/includes/class-ogulo-360-tour-shortcode.php#L62 - https://wordpress.org/plugins/ogulo-360-tour/#developers