Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-47465 State: PUBLISHED Published: 2025-05-07T14:19:41.065Z Last Updated: 2025-05-07T18:21:34.319Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: CreativeThemes Products: Blocksy Problem Types: CWE-862 Description: Missing Authorization vulnerability in CreativeThemes Blocksy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Blocksy: from n/a through 2.0.97. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/blocksy/vulnerability/wordpress-blocksy-2-0-97-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-47466 State: PUBLISHED Published: 2025-05-07T14:19:41.585Z Last Updated: 2025-05-07T18:21:22.992Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Rustaurius Products: Ultimate WP Mail Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Ultimate WP Mail allows Cross Site Request Forgery. This issue affects Ultimate WP Mail: from n/a through 1.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ultimate-wp-mail/vulnerability/wordpress-ultimate-wp-mail-1-3-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-47467 State: PUBLISHED Published: 2025-05-07T14:19:42.133Z Last Updated: 2025-05-07T18:21:12.856Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GS Plugins Products: GS Testimonial Slider Problem Types: CWE-862 Description: Missing Authorization vulnerability in GS Plugins GS Testimonial Slider allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GS Testimonial Slider: from n/a through 3.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gs-testimonial/vulnerability/wordpress-gs-testimonial-slider-3-3-0-broken-access-control-vulnerabil
ase/wordpress/plugin/gs-testimonial/vulnerability/wordpress-gs-testimonial-slider-3-3-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-47468 State: PUBLISHED Published: 2025-05-07T14:19:42.668Z Last Updated: 2025-05-08T16:12:51.504Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: hashthemes Products: Hash Form Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in hashthemes Hash Form allows Cross Site Request Forgery. This issue affects Hash Form: from n/a through 1.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/hash-form/vulnerability/wordpress-hash-form-1-2-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-47469 State: PUBLISHED Published: 2025-05-07T14:19:43.203Z Last Updated: 2025-05-07T16:36:52.971Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: slui Products: Media Hygiene Problem Types: CWE-862 Description: Missing Authorization vulnerability in slui Media Hygiene allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Hygiene: from n/a through 4.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/media-hygiene/vulnerability/wordpress-media-hygiene-4-0-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-47470 State: PUBLISHED Published: 2025-05-07T14:19:43.736Z Last Updated: 2025-05-07T16:36:45.920Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: senols Products: GPT3 AI Content Writer Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in senols GPT3 AI Content Writer allows Cross Site Request Forgery. This issue affects GPT3 AI Content Writer: from n/a through 1.9.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gpt3-ai-content-generator/vulnerability/wordpress-gpt3-ai-content-writer-plugin-1-9-14-cross-site-request-forgery-csrf-to-prompt-
ontent-generator/vulnerability/wordpress-gpt3-ai-content-writer-plugin-1-9-14-cross-site-request-forgery-csrf-to-prompt-generation-vulnerability?_s_id=cve
CVE ID: CVE-2025-47471 State: PUBLISHED Published: 2025-05-07T14:19:44.249Z Last Updated: 2025-05-07T16:36:39.318Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: EnvoThemes Products: Envo Extra Problem Types: CWE-862 Description: Missing Authorization vulnerability in EnvoThemes Envo Extra allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Envo Extra: from n/a through 1.9.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/envo-extra/vulnerability/wordpress-envo-extra-1-9-9-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-47472 State: PUBLISHED Published: 2025-05-07T14:19:44.797Z Last Updated: 2025-05-07T16:36:31.916Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: codepeople Products: Music Player for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in codepeople Music Player for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Music Player for WooCommerce: from n/a through 1.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/music-player-for-woocommerce/vulnerability/wordpress-music-player-for-woocomme
/patchstack.com/database/wordpress/plugin/music-player-for-woocommerce/vulnerability/wordpress-music-player-for-woocommerce-1-5-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-47473 State: PUBLISHED Published: 2025-05-07T14:19:45.328Z Last Updated: 2025-05-07T16:36:25.746Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: pimwick Products: PW WooCommerce Bulk Edit Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in pimwick PW WooCommerce Bulk Edit allows Cross Site Request Forgery. This issue affects PW WooCommerce Bulk Edit: from n/a through 2.134. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/pw-bulk-edit/vulnerability/wordpress-pw-woocommerce-bulk-edit-2-134-cross-site-request-forgery-csrf-vulnerability?_s_id=cv
-bulk-edit/vulnerability/wordpress-pw-woocommerce-bulk-edit-2-134-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-47475 State: PUBLISHED Published: 2025-05-07T14:19:45.866Z Last Updated: 2025-05-07T16:36:18.449Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: artbees Products: JupiterX Core Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artbees JupiterX Core allows Stored XSS. This issue affects JupiterX Core: from n/a through 4.8.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jupiterx-core/vulnerability/wordpress-jupiterx-core-4-8-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-47476 State: PUBLISHED Published: 2025-05-07T14:19:46.405Z Last Updated: 2025-05-07T16:36:12.806Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: add-ons.org Products: Cost Calculator for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org Cost Calculator for Elementor allows DOM-Based XSS. This issue affects Cost Calculator for Elementor: from n/a through 1.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cost-calculator-for-elementor/vulnerability/wordpress-cost-cal
ences: - https://patchstack.com/database/wordpress/plugin/cost-calculator-for-elementor/vulnerability/wordpress-cost-calculator-for-elementor-1-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-47477 State: PUBLISHED Published: 2025-06-09T15:54:12.253Z Last Updated: 2025-06-10T13:56:39.517Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: revmakx Products: Backup and Staging by WP Time Capsule Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revmakx Backup and Staging by WP Time Capsule allows Reflected XSS. This issue affects Backup and Staging by WP Time Capsule: from n/a through 1.22.23. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-time-capsule/vulnerability/wordpress-backup
nrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-time-capsule/vulnerability/wordpress-backup-and-staging-by-wp-time-capsule-plugin-1-22-23-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-47478 State: PUBLISHED Published: 2025-05-23T12:43:35.084Z Last Updated: 2025-05-23T14:58:36.114Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: Metagauss Products: ProfileGrid Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid allows SQL Injection. This issue affects ProfileGrid : from n/a through 5.9.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/profilegrid-user-profiles-groups-and-communities/vulnerability/wordpress-profilegrid-5-9-5-0-sql-injection-vulnerabilit
/profilegrid-user-profiles-groups-and-communities/vulnerability/wordpress-profilegrid-5-9-5-0-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-47479 State: PUBLISHED Published: 2025-07-04T11:18:05.067Z Last Updated: 2025-07-07T16:24:34.303Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: AresIT Products: WP Compress Problem Types: CWE-1390 Description: Weak Authentication vulnerability in AresIT WP Compress allows Authentication Abuse. This issue affects WP Compress: from n/a through 6.30.30. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-compress-image-optimizer/vulnerability/wordpress-wp-compress-6-30-30-broken-authentication-vulnerability?_s_id=cve
CVE ID: CVE-2025-47480 State: PUBLISHED Published: 2025-05-07T14:19:46.919Z Last Updated: 2025-05-07T16:36:05.546Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Iqonic Design Products: Graphina Problem Types: CWE-862 Description: Missing Authorization vulnerability in Iqonic Design Graphina allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Graphina: from n/a through 3.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/graphina-elementor-charts-and-graphs/vulnerability/wordpress-graphina-3-0-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-47481 State: PUBLISHED Published: 2025-05-07T14:19:47.462Z Last Updated: 2025-05-08T16:12:30.602Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GS Plugins Products: GS Testimonial Slider Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in GS Plugins GS Testimonial Slider allows Code Injection. This issue affects GS Testimonial Slider: from n/a through 3.2.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gs-testimonial/vulnerability/wordpress-gs-testimonial-slider-plugin-3-2-9-content-injection-vulnerability?_s_id=cv
lugin/gs-testimonial/vulnerability/wordpress-gs-testimonial-slider-plugin-3-2-9-content-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-47482 State: PUBLISHED Published: 2025-05-07T14:19:47.987Z Last Updated: 2025-05-08T16:11:45.524Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: sonalsinha21 Products: SKT Skill Bar Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Skill Bar allows Stored XSS. This issue affects SKT Skill Bar: from n/a through 2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/skt-skill-bar/vulnerability/wordpress-skt-skill-bar-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-47483 State: PUBLISHED Published: 2025-05-07T14:19:48.533Z Last Updated: 2025-05-08T16:10:41.728Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Iulia Cazan Products: Easy Replace Image Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Iulia Cazan Easy Replace Image allows Server Side Request Forgery. This issue affects Easy Replace Image: from n/a through 3.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/easy-replace-image/vulnerability/wordpress-easy-replace-image-3-5-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-47484 State: PUBLISHED Published: 2025-05-07T14:19:49.070Z Last Updated: 2025-05-08T16:18:56.095Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Oliver Campion Products: Display Remote Posts Block Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Oliver Campion Display Remote Posts Block allows Server Side Request Forgery. This issue affects Display Remote Posts Block: from n/a through 1.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/display-remote-posts-block/vulnerability/wordpress-display-remote-posts-block-1-1-0-server-side-requ
se/wordpress/plugin/display-remote-posts-block/vulnerability/wordpress-display-remote-posts-block-1-1-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-47485 State: PUBLISHED Published: 2025-05-07T14:19:49.606Z Last Updated: 2025-05-08T16:18:31.711Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: CozyThemes Products: Cozy Blocks Problem Types: CWE-862 Description: Missing Authorization vulnerability in CozyThemes Cozy Blocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Cozy Blocks: from n/a through 2.1.22. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cozy-addons/vulnerability/wordpress-cozy-blocks-2-1-22-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-47486 State: PUBLISHED Published: 2025-05-07T14:19:50.173Z Last Updated: 2025-05-08T16:18:05.790Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: CyberChimps Products: Gutenberg & Elementor Templates Importer For Responsive Problem Types: CWE-862 Description: Missing Authorization vulnerability in CyberChimps Gutenberg & Elementor Templates Importer For Responsive allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Gutenberg & Elementor Templates Importer For Responsive: from n/a through 3.1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/res
9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/responsive-add-ons/vulnerability/wordpress-gutenberg-elementor-templates-importer-for-responsive-3-1-9-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-47487 State: PUBLISHED Published: 2025-06-09T15:54:11.431Z Last Updated: 2025-06-10T13:56:59.358Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: moreconvert Products: MC Woocommerce Wishlist Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moreconvert MC Woocommerce Wishlist allows Reflected XSS. This issue affects MC Woocommerce Wishlist: from n/a through 1.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/smart-wishlist-for-more-convert/vulnerability/wordpress-mc-woocommerce-wishlist-1-
chstack.com/database/wordpress/plugin/smart-wishlist-for-more-convert/vulnerability/wordpress-mc-woocommerce-wishlist-1-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-47488 State: PUBLISHED Published: 2025-05-07T14:19:50.895Z Last Updated: 2025-05-08T16:17:36.867Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: boldthemes Products: Bold Page Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder allows DOM-Based XSS. This issue affects Bold Page Builder: from n/a through 5.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bold-page-builder/vulnerability/wordpress-bold-page-builder-5-3-2-cross-site-scripting-xss-vulnerabi
se/wordpress/plugin/bold-page-builder/vulnerability/wordpress-bold-page-builder-5-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-47489 State: PUBLISHED Published: 2025-05-07T14:19:51.412Z Last Updated: 2025-05-08T16:17:04.738Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: markkinchin Products: Beds24 Online Booking Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markkinchin Beds24 Online Booking allows Stored XSS. This issue affects Beds24 Online Booking: from n/a through 2.0.29. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/beds24-online-booking/vulnerability/wordpress-beds24-online-booking-2-0-29-cross-site-sc
k.com/database/wordpress/plugin/beds24-online-booking/vulnerability/wordpress-beds24-online-booking-2-0-29-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-47490 State: PUBLISHED Published: 2025-05-07T14:19:51.954Z Last Updated: 2025-05-08T16:16:31.072Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: Rustaurius Products: Ultimate WP Mail Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rustaurius Ultimate WP Mail allows SQL Injection. This issue affects Ultimate WP Mail: from n/a through 1.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ultimate-wp-mail/vulnerability/wordpress-ultimate-wp-mail-1-3-4-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-47491 State: PUBLISHED Published: 2025-05-07T14:19:52.529Z Last Updated: 2025-05-08T16:16:02.226Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: A WP Life Products: Contact Form Widget Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget allows Cross Site Request Forgery. This issue affects Contact Form Widget: from n/a through 1.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/new-contact-form-widget/vulnerability/wordpress-contact-form-widget-1-4-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-47492 State: PUBLISHED Published: 2025-05-23T12:43:34.629Z Last Updated: 2025-05-23T14:58:56.512Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: add-ons.org Products: Drag and Drop File Upload for Elementor Forms Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms allows Path Traversal. This issue affects Drag and Drop File Upload for Elementor Forms: from n/a through 1.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/drag-and-drop-file-up
yst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/drag-and-drop-file-upload-for-elementor-forms/vulnerability/wordpress-drag-and-drop-file-upload-for-elementor-forms-1-4-3-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2025-47493 State: PUBLISHED Published: 2025-05-07T14:19:53.136Z Last Updated: 2025-05-07T16:35:59.609Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Ultimate Blocks Products: Ultimate Blocks Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Blocks Ultimate Blocks allows DOM-Based XSS. This issue affects Ultimate Blocks: from n/a through 3.2.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ultimate-blocks/vulnerability/wordpress-ultimate-blocks-3-2-9-cross-site-scripting-xss-vulnerabi
tabase/wordpress/plugin/ultimate-blocks/vulnerability/wordpress-ultimate-blocks-3-2-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-47494 State: PUBLISHED Published: 2025-05-07T14:19:53.669Z Last Updated: 2025-05-07T16:35:52.527Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ashan Perera Products: EventON Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ashan Perera EventON allows PHP Local File Inclusion. This issue affects EventON: from n/a through 2.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/eventon-lite/vulnerability/wordpress-eventon-2-4-1-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-47495 State: PUBLISHED Published: 2025-05-07T14:19:54.179Z Last Updated: 2025-05-07T16:35:47.504Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Blockspare Products: Blockspare Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blockspare Blockspare allows Stored XSS. This issue affects Blockspare: from n/a through 3.2.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/blockspare/vulnerability/wordpress-blockspare-3-2-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-47496 State: PUBLISHED Published: 2025-05-07T14:19:54.712Z Last Updated: 2025-05-07T16:35:39.109Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PublishPress Products: PublishPress Authors Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PublishPress PublishPress Authors allows PHP Local File Inclusion. This issue affects PublishPress Authors: from n/a through 4.7.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/publishpress-authors/vulnerability/wordpress-publishpress-a
ferences: - https://patchstack.com/database/wordpress/plugin/publishpress-authors/vulnerability/wordpress-publishpress-authors-4-7-5-local-file-inclusion-vulnerability?_s_id=cve