Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-28940 State: PUBLISHED Published: 2025-03-11T21:01:17.414Z Last Updated: 2025-03-12T13:48:06.081Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: arkapravamajumder Products: Back To Top Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in arkapravamajumder Back To Top allows Cross Site Request Forgery. This issue affects Back To Top: from n/a through 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/backtotop/vulnerability/wordpress-back-to-top-plugin-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-28941 State: PUBLISHED Published: 2025-03-11T21:01:18.173Z Last Updated: 2025-03-12T14:24:28.532Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ohtan Products: Spam Byebye Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ohtan Spam Byebye allows Cross Site Request Forgery. This issue affects Spam Byebye: from n/a through 2.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/spam-byebye/vulnerability/wordpress-spam-bybye-plugin-2-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-28942 State: PUBLISHED Published: 2025-03-26T14:24:25.967Z Last Updated: 2025-03-26T14:54:06.656Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: Trust Payments Products: Trust Payments Gateway for WooCommerce Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Trust Payments Trust Payments Gateway for WooCommerce allows SQL Injection. This issue affects Trust Payments Gateway for WooCommerce: from n/a through 1.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/trust-payments-hosted-payme
tes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/trust-payments-hosted-payment-pages-integration/vulnerability/wordpress-trust-payments-gateway-for-woocommerce-plugin-1-1-4-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-28943 State: PUBLISHED Published: 2025-03-11T21:01:18.833Z Last Updated: 2025-03-12T14:17:57.505Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: mylo2h2s Products: DP ALTerminator - Missing ALT manager Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mylo2h2s DP ALTerminator - Missing ALT manager allows Stored XSS. This issue affects DP ALTerminator - Missing ALT manager: from n/a through 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/dp-alterminator-missing-alt-manager/vulnerabili
richment: References: - https://patchstack.com/database/wordpress/plugin/dp-alterminator-missing-alt-manager/vulnerability/wordpress-dp-alterminator-missing-alt-manager-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-28944 State: PUBLISHED Published: 2025-06-09T15:56:52.076Z Last Updated: 2025-06-09T17:22:11.961Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: snstheme Products: Avaz Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Avaz allows PHP Local File Inclusion. This issue affects Avaz: from n/a through 2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/snsavaz/vulnerability/wordpress-avaz-2-8-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-28945 State: PUBLISHED Published: 2025-06-09T15:56:51.055Z Last Updated: 2025-06-09T17:22:18.229Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: snstheme Products: Valen - Sport, Fashion WooCommerce WordPress Theme Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Valen - Sport, Fashion WooCommerce WordPress Theme allows PHP Local File Inclusion. This issue affects Valen - Sport, Fashion WooCommerce WordPress Theme: from n/a through 2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/datab
eme: from n/a through 2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/valen/vulnerability/wordpress-valen-sport-fashion-woocommerce-wordpress-theme-2-4-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-28946 State: PUBLISHED Published: 2025-06-27T11:52:44.803Z Last Updated: 2025-06-27T14:06:51.097Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: BZOTheme Products: PrintXtore Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme PrintXtore allows PHP Local File Inclusion. This issue affects PrintXtore: from n/a through 1.7.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/bw-printxtore/vulnerability/wordpress-printxtore-1-7-5-local-file-inclusion-vulnerability?_s_id=cv
abase/wordpress/theme/bw-printxtore/vulnerability/wordpress-printxtore-1-7-5-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-28947 State: PUBLISHED Published: 2025-06-27T11:52:44.192Z Last Updated: 2025-06-27T14:06:58.287Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: snstheme Products: MBStore - Digital WooCommerce WordPress Theme Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme MBStore - Digital WooCommerce WordPress Theme allows PHP Local File Inclusion. This issue affects MBStore - Digital WooCommerce WordPress Theme: from n/a through 2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/t
hrough 2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/mbstore/vulnerability/wordpress-mbstore-digital-woocommerce-wordpress-theme-2-3-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-28948 State: PUBLISHED Published: 2025-06-06T12:54:35.489Z Last Updated: 2025-06-06T14:52:58.356Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: codedraft Products: Mediabay - WordPress Media Library Folders Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in codedraft Mediabay - WordPress Media Library Folders allows Reflected XSS. This issue affects Mediabay - WordPress Media Library Folders: from n/a through 1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mediabay/vulnerability/wordpress-mediabay-wordpress-media-library-folders-plugin-
tchstack.com/database/wordpress/plugin/mediabay/vulnerability/wordpress-mediabay-wordpress-media-library-folders-plugin-1-4-csrf-to-reflected-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-28950 State: PUBLISHED Published: 2025-06-06T12:54:35.051Z Last Updated: 2025-06-06T14:57:25.181Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: David Shabtai Products: Post Author Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in David Shabtai Post Author allows Stored XSS. This issue affects Post Author: from n/a through 1.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/post-author/vulnerability/wordpress-post-author-1-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-28951 State: PUBLISHED Published: 2025-07-04T08:42:11.196Z Last Updated: 2025-07-08T17:38:55.180Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: CreedAlly Products: Bulk Featured Image Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in CreedAlly Bulk Featured Image allows Upload a Web Shell to a Web Server. This issue affects Bulk Featured Image: from n/a through 1.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bulk-featured-image/vulnerability/wordpress-bulk-featured-image-plugin-1-2-1-arbitrary-file-upload-vulnerabil
ess/plugin/bulk-featured-image/vulnerability/wordpress-bulk-featured-image-plugin-1-2-1-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-28952 State: PUBLISHED Published: 2025-06-06T12:54:34.612Z Last Updated: 2025-06-06T14:57:47.533Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Jonathan Lau Products: CubePoints Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Jonathan Lau CubePoints allows Cross Site Request Forgery. This issue affects CubePoints: from n/a through 3.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cubepoints/vulnerability/wordpress-cubepoints-3-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-28953 State: PUBLISHED Published: 2025-11-06T15:53:18.852Z Last Updated: 2025-11-13T10:33:39.999Z Vendors: axiomthemes Products: smart SEO Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in axiomthemes smart SEO smartSEO allows SQL Injection.This issue affects smart SEO: from n/a through <= 4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/smartSEO/vulnerability/wordpress-smart-seo-4-0-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-28954 State: PUBLISHED Published: 2025-06-06T12:54:34.160Z Last Updated: 2025-06-06T14:59:58.428Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: wphobby Products: Backwp Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in wphobby Backwp allows Path Traversal. This issue affects Backwp: from n/a through 2.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/backwp/vulnerability/wordpress-backwp-plugin-2-0-2-csrf-to-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2025-28955 State: PUBLISHED Published: 2025-07-16T11:28:13.092Z Last Updated: 2025-07-16T13:23:44.574Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: FWDesign Products: Easy Video Player Wordpress & WooCommerce Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in FWDesign Easy Video Player Wordpress & WooCommerce allows Path Traversal. This issue affects Easy Video Player Wordpress & WooCommerce: from n/a through 10.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/fwdevp/vulnerability/wordpress-easy-video
DP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/fwdevp/vulnerability/wordpress-easy-video-player-wordpress-woocommerce-10-0-arbitrary-file-download-vulnerability?_s_id=cve
CVE ID: CVE-2025-28956 State: PUBLISHED Published: 2025-06-27T11:52:43.614Z Last Updated: 2025-06-27T13:00:46.321Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: wphobby Products: Backwp Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphobby Backwp allows Reflected XSS. This issue affects Backwp: from n/a through 2.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/backwp/vulnerability/wordpress-backwp-plugin-2-0-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-28957 State: PUBLISHED Published: 2025-07-04T08:42:12.148Z Last Updated: 2025-07-08T17:38:50.089Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: OwnerRez Products: OwnerRez Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OwnerRez OwnerRez allows Stored XSS. This issue affects OwnerRez: from n/a through 1.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ownerrez/vulnerability/wordpress-ownerrez-plugin-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-28958 State: PUBLISHED Published: 2025-06-06T12:54:33.704Z Last Updated: 2025-06-06T15:00:42.703Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Vadim Bogaiskov Products: Bg Orthodox Calendar Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Vadim Bogaiskov Bg Orthodox Calendar allows Stored XSS. This issue affects Bg Orthodox Calendar: from n/a through 0.13.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bg-orthodox-calendar/vulnerability/wordpress-bg-orthodox-calendar-plugin-0-13-10-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-28959 State: PUBLISHED Published: 2025-07-16T11:28:12.621Z Last Updated: 2025-07-16T13:17:13.278Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: Md Yeasin Ul Haider Products: URL Shortener Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Md Yeasin Ul Haider URL Shortener allows SQL Injection. This issue affects URL Shortener: from n/a through 3.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/exact-links/vulnerability/wordpress-url-shortener-3-0-7-sql-injection-vulnerability?_s_id=cv
m/database/wordpress/plugin/exact-links/vulnerability/wordpress-url-shortener-3-0-7-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-28960 State: PUBLISHED Published: 2025-06-27T11:52:43.019Z Last Updated: 2025-06-27T13:04:22.413Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: regibaer Products: Evangelische Termine Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in regibaer Evangelische Termine allows Reflected XSS. This issue affects Evangelische Termine: from n/a through 3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/evangtermine/vulnerability/wordpress-evangelische-termine-3-3-cross-site-scripting-xss-vulnerabilit
ase/wordpress/plugin/evangtermine/vulnerability/wordpress-evangelische-termine-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-28961 State: PUBLISHED Published: 2025-07-16T11:28:12.145Z Last Updated: 2025-07-16T13:19:58.705Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Md Yeasin Ul Haider Products: URL Shortener Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Md Yeasin Ul Haider URL Shortener allows Object Injection. This issue affects URL Shortener: from n/a through 3.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/exact-links/vulnerability/wordpress-url-shortener-3-0-7-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-28962 State: PUBLISHED Published: 2025-08-14T10:34:34.593Z Last Updated: 2025-08-14T19:47:51.804Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: stefanoai Products: Advanced Google Universal Analytics Problem Types: CWE-862 Description: Missing Authorization vulnerability in stefanoai Advanced Google Universal Analytics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Advanced Google Universal Analytics: from n/a through 1.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/advanced-google-universal-analytics/vulnerability/wordpress
ferences: - https://patchstack.com/database/wordpress/plugin/advanced-google-universal-analytics/vulnerability/wordpress-advanced-google-universal-analytics-plugin-1-0-3-broken-access-control-to-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-28963 State: PUBLISHED Published: 2025-07-04T08:42:13.146Z Last Updated: 2025-07-07T18:08:47.632Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: Md Yeasin Ul Haider Products: URL Shortener Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Md Yeasin Ul Haider URL Shortener allows Server Side Request Forgery. This issue affects URL Shortener: from n/a through 3.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/exact-links/vulnerability/wordpress-url-shortener-plugin-3-0-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-28964 State: PUBLISHED Published: 2025-06-06T12:54:33.252Z Last Updated: 2025-06-06T15:01:15.002Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: mangup Products: Personal Favicon Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in mangup Personal Favicon allows Stored XSS. This issue affects Personal Favicon: from n/a through 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/personal-favicon/vulnerability/wordpress-personal-favicon-plugin-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-28965 State: PUBLISHED Published: 2025-07-16T11:28:11.680Z Last Updated: 2025-07-16T13:32:55.280Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: Md Yeasin Ul Haider Products: URL Shortener Problem Types: CWE-862 Description: Missing Authorization vulnerability in Md Yeasin Ul Haider URL Shortener allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects URL Shortener: from n/a through 3.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/exact-links/vulnerability/wordpress-url-shortener-3-0-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-28966 State: PUBLISHED Published: 2025-06-06T12:54:32.790Z Last Updated: 2025-06-06T15:01:38.834Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: dilemma123 Products: Recent Posts Slider Responsive Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in dilemma123 Recent Posts Slider Responsive allows Stored XSS. This issue affects Recent Posts Slider Responsive: from n/a through 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/recent-posts-slider-responsive/vulnerability/wordpress-recent-posts-slider-responsive-plugin-1-0-1-cross-site-reques
gin/recent-posts-slider-responsive/vulnerability/wordpress-recent-posts-slider-responsive-plugin-1-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-28967 State: PUBLISHED Published: 2025-07-04T08:42:14.131Z Last Updated: 2025-07-07T18:05:06.858Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: Steve Truman Products: Contact Us page - Contact people LITE Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Steve Truman Contact Us page - Contact people LITE allows SQL Injection. This issue affects Contact Us page - Contact people LITE: from n/a through 3.7.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/contact-us-page-contact-people/vulnera
ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/contact-us-page-contact-people/vulnerability/wordpress-contact-us-page-contact-people-lite-plugin-3-7-4-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-28968 State: PUBLISHED Published: 2025-07-04T11:18:10.219Z Last Updated: 2025-07-07T14:58:26.131Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Vladimir Prelovac Products: WP Wall Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladimir Prelovac WP Wall allows Reflected XSS. This issue affects WP Wall: from n/a through 1.7.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-wall/vulnerability/wordpress-wp-wall-plugin-1-7-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-28969 State: PUBLISHED Published: 2025-07-04T08:42:15.118Z Last Updated: 2025-07-07T18:04:42.974Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: cybio Products: Gallery Widget Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cybio Gallery Widget allows SQL Injection. This issue affects Gallery Widget: from n/a through 1.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gallery-widget/vulnerability/wordpress-gallery-widget-plugin-1-2-1-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-28970 State: PUBLISHED Published: 2025-06-27T11:52:42.396Z Last Updated: 2025-06-27T13:04:58.357Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: pep.vn Products: WP Optimize By xTraffic Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in pep.vn WP Optimize By xTraffic allows Object Injection. This issue affects WP Optimize By xTraffic: from n/a through 5.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-optimize-by-xtraffic/vulnerability/wordpress-wp-optimize-by-xtraffic-5-1-6-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-28971 State: PUBLISHED Published: 2025-07-04T08:42:16.120Z Last Updated: 2025-07-07T18:01:44.734Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: CWD Web Designer Products: Easy Elements Hider Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CWD Web Designer Easy Elements Hider allows Stored XSS. This issue affects Easy Elements Hider: from n/a through 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/easy-elements-hider/vulnerability/wordpress-easy-elements-hider-plugin-2-0-cross-site-s
ck.com/database/wordpress/plugin/easy-elements-hider/vulnerability/wordpress-easy-elements-hider-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-28972 State: PUBLISHED Published: 2025-06-17T15:01:40.024Z Last Updated: 2025-06-17T17:37:15.457Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Suhas Surse Products: WP Employee Attendance System Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Suhas Surse WP Employee Attendance System allows Blind SQL Injection. This issue affects WP Employee Attendance System: from n/a through 3.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-employee-attendance-system/vulnerability/wordpress-wp-emp