Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-12336 State: PUBLISHED Published: 2025-10-28T00:02:07.098Z Last Updated: 2025-10-28T13:50:03.435Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Retro Basketball Shoes Online Store Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_index.php. Such manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
it is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330123 - https://vuldb.com/?ctiid.330123 - https://vuldb.com/?submit.674490 - https://github.com/HYLCXH/CVE/issues/14 - https://www.campcodes.com/
CVE ID: CVE-2025-12337 State: PUBLISHED Published: 2025-10-28T00:02:09.929Z Last Updated: 2025-10-28T13:39:10.694Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Retro Basketball Shoes Online Store Problem Types: CWE-89, CWE-74 Description: A security flaw has been discovered in Campcodes Retro Basketball Shoes Online Store 1.0. This affects an unknown part of the file /admin/admin_feature.php. Performing manipulation of the argument pid results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vul
eleased to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330124 - https://vuldb.com/?ctiid.330124 - https://vuldb.com/?submit.674491 - https://github.com/HYLCXH/CVE/issues/15 - https://www.campcodes.com/
CVE ID: CVE-2025-12338 State: PUBLISHED Published: 2025-10-28T00:32:06.361Z Last Updated: 2025-10-28T14:23:27.048Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Retro Basketball Shoes Online Store Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in Campcodes Retro Basketball Shoes Online Store 1.0. This vulnerability affects unknown code of the file /admin/admin_product.ph. Executing manipulation of the argument pid can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
en made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330125 - https://vuldb.com/?ctiid.330125 - https://vuldb.com/?submit.674492 - https://github.com/HYLCXH/CVE/issues/16 - https://www.campcodes.com/
CVE ID: CVE-2025-12339 State: PUBLISHED Published: 2025-10-28T00:32:09.124Z Last Updated: 2025-10-28T14:19:46.571Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Campcodes Products: Retro Basketball Shoes Online Store Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in Campcodes Retro Basketball Shoes Online Store 1.0. This issue affects some unknown processing of the file /admin/admin_football.php. The manipulation of the argument pid leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330126 - https://vuldb.com/?ctiid.330126 - https://vuldb.com/?submit.674493 - https://github.com/HYLCXH/CVE/issues/17 - https://www.campcodes.com/
CVE ID: CVE-2025-12341 State: PUBLISHED Published: 2025-10-28T01:02:05.100Z Last Updated: 2025-10-28T14:14:47.465Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: ermig1979 Products: AntiDupl Problem Types: CWE-59 Description: A vulnerability was detected in ermig1979 AntiDupl up to 2.3.12. Impacted is an unknown function of the file AntiDupl.NET.WinForms.exe of the component Delete Duplicate Image Handler. The manipulation results in link following. The attack is only possible with local access. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
bout this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330127 - https://vuldb.com/?ctiid.330127 - https://vuldb.com/?submit.674515 - https://drive.google.com/file/d/19jwaqUji6O3U6EAeUMixBM58QTc4qNMQ/view?usp=sharing
CVE ID: CVE-2025-12342 State: PUBLISHED Published: 2025-10-28T01:02:07.616Z Last Updated: 2025-10-28T14:10:58.342Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Serdar Bayram Products: Ghost Hot Spot Problem Types: CWE-89, CWE-74 Description: A flaw has been found in Serdar Bayram Ghost Hot Spot up to 20251014. The affected element is an unknown function of the file /Auth.php of the component Login. This manipulation causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vul
endor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330128 - https://vuldb.com/?ctiid.330128 - https://vuldb.com/?submit.674378 - https://drive.proton.me/urls/BKHV097YXC#sQCrH9wl3fqC
CVE ID: CVE-2025-12344 State: PUBLISHED Published: 2025-10-28T01:32:05.689Z Last Updated: 2025-10-28T14:07:12.828Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: Yonyou Products: U8 Cloud Problem Types: CWE-434, CWE-284 Description: A vulnerability has been found in Yonyou U8 Cloud up to 5.1sp. The impacted element is an unknown function of the file /service/NCloudGatewayServlet of the component Request Header Handler. Such manipulation of the argument ts/sign leads to unrestricted upload. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respo
has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330129 - https://vuldb.com/?ctiid.330129 - https://vuldb.com/?submit.674532 - https://github.com/IceSc0rpion/CVE/issues/1
CVE ID: CVE-2025-12346 State: PUBLISHED Published: 2025-10-28T02:02:09.037Z Last Updated: 2025-10-28T19:54:35.900Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: MaxSite Products: CMS Problem Types: CWE-434, CWE-284 Description: A vulnerability was detected in MaxSite CMS up to 109. This vulnerability affects unknown code of the file application/maxsite/admin/plugins/auto_post/uploads-require-maxsite.php of the component HTTP Header Handler. Performing manipulation of the argument X-Requested-FileName/X-Requested-FileUpDir results in unrestricted upload. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was co
cted upload. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330136 - https://vuldb.com/?ctiid.330136 - https://vuldb.com/?submit.674551 - https://note-hxlab.wetolink.com/share/8QmDZCddHvyR
CVE ID: CVE-2025-12347 State: PUBLISHED Published: 2025-10-28T02:02:13.123Z Last Updated: 2025-10-28T20:00:38.998Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: MaxSite Products: CMS Problem Types: CWE-434, CWE-284 Description: A flaw has been found in MaxSite CMS up to 109. This issue affects some unknown processing of the file application/maxsite/admin/plugins/editor_files/save-file-ajax.php. Executing manipulation of the argument file_path/content can lead to unrestricted upload. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additiona
ublished and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.330137 - https://vuldb.com/?ctiid.330137 - https://vuldb.com/?submit.674552 - https://note-hxlab.wetolink.com/share/lIWZkTHQPSVh
CVE ID: CVE-2025-12349 State: PUBLISHED Published: 2025-11-19T04:28:18.783Z Last Updated: 2025-11-19T20:10:33.978Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: icegram Products: Email Subscribers & Newsletters – Powerful Email Marketing, Post Notification & Newsletter Plugin for WordPress & WooCommerce Problem Types: CWE-306 Description: The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Authorization in versions up to, and including, 5.9.10. This is due to the plugin not properly verifying that a user is authorized to perform an action in the `trigger_mailing_queue_sending` function. This m
roperly verifying that a user is authorized to perform an action in the `trigger_mailing_queue_sending` function. This makes it possible for unauthenticated attackers to force immediate email sending, bypass the schedule, increase server load, and change plugin state (e.g., last-cron-hit), enabling abuse or DoS-like effects. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0b4cbe21-9f1b-425b-8141-ae075baaf717?source=cve - https://plugins.trac.wordpress.org/browser/email-subscribers/tags/5.9.4/lite/includes/classes/class-es-queue.php#L54 - https://plugins.trac.wordpress.org/browser/email-subscribers/tags/5.9.4/lite/incl
ludes/classes/class-es-queue.php#L54 - https://plugins.trac.wordpress.org/browser/email-subscribers/tags/5.9.4/lite/includes/classes/class-es-queue.php#L1132 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3394838%40email-subscribers%2Ftrunk&old=3393565%40email-subscribers%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12350 State: PUBLISHED Published: 2025-11-04T04:27:14.553Z Last Updated: 2025-11-04T20:59:31.623Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: domiinodev Products: DominoKit Problem Types: CWE-862 Description: The DominoKit plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wp_ajax_nopriv_dominokit_option_admin_action AJAX endpoint in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to update plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1c8de019-4ec1-49
Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1c8de019-4ec1-49fd-9b0b-c2b1b6908ba8?source=cve - https://wordpress.org/plugins/dominokit/
CVE ID: CVE-2025-12351 State: PUBLISHED Published: 2025-10-27T15:03:57.602Z Last Updated: 2025-10-27T16:04:11.466Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Honeywell Products: S35 3M/5M/8M/Pinhole/Kit Camera, S35 AI Fisheye&Dual Sensor/Micro Dome/Full Color Eyeball&Bullet Camera, S35 Thermal Camera Problem Types: CWE-639, CWE-668 Description: Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerability, leading to Privilege Escalation to admin privileged functionalities . Honeywell also recommends updating to the most recent version of this product, se
to admin privileged functionalities . Honeywell also recommends updating to the most recent version of this product, service or offering (S35 Pinhole/Kit Camera to version 2025.08.28, S35 AI Fisheye & Dual Sensor/Micro Dome/Full Color Eyeball & Bullet Camera to version 2025.08.22, S35 Thermal Camera to version 2025.08.26). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.honeywell.com/us/en/product-security
CVE ID: CVE-2025-12352 State: PUBLISHED Published: 2025-11-07T04:28:53.882Z Last Updated: 2025-11-07T17:41:19.665Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Gravity Forms Products: Gravity Forms Problem Types: CWE-434 Description: The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the copy_post_image() function in all versions up to, and including, 2.9.20. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. This only impacts sites that have allow_url_fopen set to `On`, the post crea
ch may make remote code execution possible. This only impacts sites that have allow_url_fopen set to `On`, the post creation form enabled along with a file upload field for the post Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/42525101-6196-40b9-90e7-c7f1886ef247?source=cve - https://github.com/pronamic/gravityforms/blob/06de1b7e169e4f073e9d0d491e17b89365b48c20/includes/fields/class-gf-field-fileupload.php#L306 - https://github.com/pronamic/gravityforms/blob/06de1b7e169e4f073e9d0d491e17b89365b48c20/forms_model.php#L5451C26-L5451C41
CVE ID: CVE-2025-12353 State: PUBLISHED Published: 2025-11-08T03:27:47.222Z Last Updated: 2025-11-10T19:58:32.337Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: getwpfunnels Products: Easy WordPress Funnel Builder To Collect Leads And Increase Sales – WPFunnels Problem Types: CWE-639 Description: The WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 3.6.2. This is due to the plugin relying on a user controlled value 'optin_allow_registration' to determine if user registration is allowed, instead o
in relying on a user controlled value 'optin_allow_registration' to determine if user registration is allowed, instead of the site-specific setting. This makes it possible for unauthenticated attackers to register new user accounts, even when user registration is disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4e376c96-47a8-419f-ab45-f7c46510c767?source=cve - https://plugins.trac.wordpress.org/changeset/3389604/wpfunnels/trunk/public/class-wpfnl-public.php
CVE ID: CVE-2025-12357 State: PUBLISHED Published: 2025-10-31T15:33:48.343Z Last Updated: 2025-11-03T19:01:59.520Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: ISO 15118-2 Network and Application Protocol Requirements Products: EV Car Chargers Problem Types: CWE-923 Description: By manipulating the Signal Level Attenuation Characterization (SLAC) protocol with spoofed measurements, an attacker can stage a man-in-the-middle attack between an electric vehicle and chargers that comply with the ISO 15118-2 part. This vulnerability may be exploitable wirelessly, within close proximity, via electromagnetic induction. Additional Analyst Notes: - CISA ADP Vulnrichm
itable wirelessly, within close proximity, via electromagnetic induction. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.iec.ch/contact?id=40499 - https://www.cisa.gov/news-events/ics-advisories/icsa-25-303-01 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-303-01.json
CVE ID: CVE-2025-12359 State: PUBLISHED Published: 2025-11-19T05:45:14.684Z Last Updated: 2025-11-19T20:32:11.323Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: dfactory Products: Responsive Lightbox & Gallery Problem Types: CWE-918 Description: The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.3 via the 'get_image_size_by_url' function. This is due to insufficient validation of user-supplied URLs when determining image dimensions for gallery items. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitr
. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7f4c0bd6-f289-4a52-ac11-345076c32d84?source=cve - https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.5.3/includes/class-frontend.php#L1531 - https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.5.3/includes/class-fast-image.php#L25 - https://plugins.trac.wordpress.org/browser/responsive-lightbox
e-lightbox/tags/2.5.3/includes/class-fast-image.php#L25 - https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.5.3/includes/functions.php#L108 - https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.5.3/includes/class-galleries.php#L3648 - https://research.cleantalk.org/cve-2025-12359 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3397940%40responsive-lightbox%2Ftrunk&old=3358021%40responsive-lightbox%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12360 State: PUBLISHED Published: 2025-11-06T07:27:05.431Z Last Updated: 2025-11-06T14:51:40.221Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: codesolz Products: Better Find and Replace – AI-Powered Suggestions Problem Types: CWE-285 Description: The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to unauthorized API usage due to a missing capability check on the rtafar_ajax() function in all versions up to, and including, 1.7.7. This makes it possible for authenticated attackers, with Subscriber-level access, to trigger OpenAI API key usage resulting in quota consumption potentially incurring cost. Add
Subscriber-level access, to trigger OpenAI API key usage resulting in quota consumption potentially incurring cost. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/757e41dd-d72f-4e87-a087-c5c38bd727e5?source=cve - https://plugins.trac.wordpress.org/browser/real-time-auto-find-and-replace/trunk/core/actions/RTAFAR_CustomAjax.php#L31 - https://plugins.trac.wordpress.org/changeset/3389979/real-time-auto-find-and-replace/trunk/core/actions/RTAFAR_CustomAjax.php?contextall=1&old=3343531&old_path=%2Freal-time-auto-find-and-replace%2Ftrunk%2Fcore%2Factions%2FRTAFAR_CustomAjax.php
CVE ID: CVE-2025-12363 State: PUBLISHED Published: 2025-10-27T18:04:44.909Z Last Updated: 2025-10-27T18:21:58.672Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-200 Description: Email Password Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12364 State: PUBLISHED Published: 2025-10-27T18:09:07.677Z Last Updated: 2025-10-27T18:19:59.291Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-521 Description: Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12365 State: PUBLISHED Published: 2025-10-27T18:12:35.604Z Last Updated: 2025-10-27T18:37:18.986Z Vendors: Azure Access Technology Products: BLU-IC2, BLU-IC4 Problem Types: CWE-209 Description: Error Messages Wrapped In HTTP Header.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://azure-access.com/security-advisories
CVE ID: CVE-2025-12366 State: PUBLISHED Published: 2025-11-13T03:27:37.361Z Last Updated: 2025-11-13T14:34:35.676Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: softaculous Products: Page Builder: Pagelayer – Drag and Drop website builder Problem Types: CWE-639 Description: The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.5 via the pagelayer_replace_page function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to replace media files belonging t
is makes it possible for authenticated attackers, with Author-level access and above, to replace media files belonging to other users, including administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2216d82c-29ae-4355-8118-6ebc49726c12?source=cve - https://plugins.trac.wordpress.org/browser/pagelayer/tags/2.0.4/main/replace-media.php#L31 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3394407%40pagelayer%2Ftrunk&old=3384061%40pagelayer%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2025-12367 State: PUBLISHED Published: 2025-11-01T03:34:36.429Z Last Updated: 2025-11-03T15:46:46.785Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: softaculous Products: SiteSEO – SEO Simplified Problem Types: CWE-285 Description: The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.3.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Author-level access and above, to enable or disable arbitrary SiteSEO features that they should not have access to. Additional Analyst N
ess and above, to enable or disable arbitrary SiteSEO features that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/54535bef-23c3-4045-bb37-ba28ae5461b1?source=cve - https://plugins.trac.wordpress.org/browser/siteseo/tags/1.3.1/main/ajax.php#L340 - https://plugins.trac.wordpress.org/changeset/3387094/siteseo/trunk/main/ajax.php?contextall=1
CVE ID: CVE-2025-12369 State: PUBLISHED Published: 2025-11-04T04:27:17.014Z Last Updated: 2025-11-04T16:47:34.277Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: hupe13 Products: Extensions for Leaflet Map Problem Types: CWE-79 Description: The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `geojsonmarker` shortcode in all versions up to, and including, 4.7. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute wh