Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
o the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320068 - https://vuldb.com/?ctiid.320068 - https://vuldb.com/?submit.629562 - https://github.com/xiguala123/myCVE/issues/7 - https://phpgurukul.com/
CVE ID: CVE-2025-9018 State: PUBLISHED Published: 2025-09-11T11:15:03.487Z Last Updated: 2025-09-11T14:36:05.893Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: germanpearls Products: Time Tracker Problem Types: CWE-862 Description: The Time Tracker plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'tt_update_table_function' and 'tt_delete_record_function' functions in all versions up to, and including, 3.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update options such as user registration and default role, allowing anyone to register
criber-level access and above, to update options such as user registration and default role, allowing anyone to register as an Administrator, and to delete limited data from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2e840f76-1b46-452e-bd63-507cbab779b9?source=cve - https://plugins.trac.wordpress.org/browser/time-tracker/trunk/inc/function-tt-update-table.php#L25 - https://plugins.trac.wordpress.org/browser/time-tracker/trunk/inc/function-tt-delete-record.php#L22 - https://plugins.trac.wordpress.org/changeset/3359157/
CVE ID: CVE-2025-9019 State: PUBLISHED Published: 2025-08-15T07:02:10.548Z Last Updated: 2025-08-15T12:01:29.127Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C) Vendors: n/a Products: tcpreplay Problem Types: CWE-122, CWE-119 Description: A vulnerability has been found in tcpreplay 4.5.1. This vulnerability affects the function mask_cidr6 of the file cidr.c of the component tcpprep. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The researcher is able to reproduce t
ars to be difficult. The exploit has been disclosed to the public and may be used. The researcher is able to reproduce this with the latest official release 4.5.1 and the current master branch. The code maintainer cannot reproduce this for 4.5.2-beta1. In his reply the maintainer explains that "[i]n that case, this is a duplicate that was fixed in 4.5.2." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320080 - https://vuldb.com/?ctiid.320080 - https://vuldb.com/?submit.623635 - https://vuldb.com/?submit.623636 - https://vuldb.com/?submit.623637 - https://vuldb.com/?submit.623638 - https://vuldb.com/?submit.623639 - https://github.com/appneta/tcpreplay/
mit.623637 - https://vuldb.com/?submit.623638 - https://vuldb.com/?submit.623639 - https://github.com/appneta/tcpreplay/issues/958 - https://github.com/appneta/tcpreplay/issues/958#issuecomment-3124876035 - https://drive.google.com/file/d/13SQYVIb_YQoRfaJaaLf6iLtMiCRCHlBc/view?usp=sharing - https://github.com/appneta/tcpreplay/issues/959
CVE ID: CVE-2025-9020 State: PUBLISHED Published: 2025-08-15T07:32:07.425Z Last Updated: 2025-08-15T16:34:05.985Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C) Vendors: PX4 Products: PX4-Autopilot Problem Types: CWE-416, CWE-119 Description: A vulnerability was found in PX4 PX4-Autopilot up to 1.15.4. This issue affects the function MavlinkReceiver::handle_message_serial_control of the file src/modules/mavlink/mavlink_receiver.cpp of the component Mavlink Shell Closing Handler. The manipulation of the argument _mavlink_shell leads to use after free. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is
use after free. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The identifier of the patch is 4395d4f00c49b888f030f5b43e2a779f1fa78708. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320081 - https://vuldb.com/?ctiid.320081 - https://vuldb.com/?submit.624722 - https://github.com/PX4/PX4-Autopilot/issues/25046 - https://github.com/PX4/PX4-Autopilot/pull/25082 - https://github.com/PX4/PX4-Autopilot/pull/25082/commits/4395d4f00c49b888f030f5b43e2a779f1fa78708
CVE ID: CVE-2025-9021 State: PUBLISHED Published: 2025-08-15T08:02:06.373Z Last Updated: 2025-08-15T16:33:13.921Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Online Bank Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in SourceCodester Online Bank Management System up to 1.0. This vulnerability affects unknown code of the file /bank/transfer.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320086 - https://vuldb.com/?ctiid.320086 - https://vuldb.co
- CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320086 - https://vuldb.com/?ctiid.320086 - https://vuldb.com/?submit.631861 - https://www.sourcecodester.com/
CVE ID: CVE-2025-9022 State: PUBLISHED Published: 2025-08-15T08:02:08.450Z Last Updated: 2025-08-15T16:32:43.144Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: SourceCodester Products: Online Bank Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was identified in SourceCodester Online Bank Management System up to 1.0. This issue affects some unknown processing of the file /bank/statements.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320087 - https://vuldb.com/?ctiid.320087 - https://vul
tes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320087 - https://vuldb.com/?ctiid.320087 - https://vuldb.com/?submit.631862 - https://www.sourcecodester.com/
CVE ID: CVE-2025-9023 State: PUBLISHED Published: 2025-08-15T08:32:07.431Z Last Updated: 2025-08-15T16:01:28.497Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC7, AC18 Problem Types: CWE-120, CWE-119 Description: A vulnerability has been found in Tenda AC7 and AC18 15.03.05.19/15.03.06.44. Affected is the function formSetSchedLed of the file /goform/SetLEDCfg. The manipulation of the argument Time leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320088 - https://vuldb.com/?c
ed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320088 - https://vuldb.com/?ctiid.320088 - https://vuldb.com/?submit.629692 - https://vuldb.com/?submit.629696 - https://github.com/zezhifu1/cve_report/blob/main/AC7/formsetschedled.md - https://github.com/zezhifu1/cve_report/blob/main/AC18/formsetschedled.md - https://www.tenda.com.cn/
CVE ID: CVE-2025-9024 State: PUBLISHED Published: 2025-08-15T09:02:08.337Z Last Updated: 2025-08-15T15:56:30.429Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: PHPGurukul Products: Beauty Parlour Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this vulnerability is an unknown functionality of the file /book-appointment.php. The manipulation of the argument Message leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://v
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320089 - https://vuldb.com/?ctiid.320089 - https://vuldb.com/?submit.629773 - https://github.com/StrongDog23/myCVE/issues/4 - https://phpgurukul.com/
CVE ID: CVE-2025-9025 State: PUBLISHED Published: 2025-08-15T09:02:20.423Z Last Updated: 2025-08-15T15:48:14.665Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Simple Cafe Ordering System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in code-projects Simple Cafe Ordering System 1.0. Affected by this issue is some unknown functionality of the file /portal.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320090
e public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320090 - https://vuldb.com/?ctiid.320090 - https://vuldb.com/?submit.629790 - https://github.com/Find33-3/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-9026 State: PUBLISHED Published: 2025-08-15T09:32:06.504Z Last Updated: 2025-08-15T14:57:03.873Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR-860L Problem Types: CWE-78, CWE-77 Description: A vulnerability was identified in D-Link DIR-860L 2.04.B04. This affects the function ssdpcgi_main of the file htdocs/cgibin of the component Simple Service Discovery Protocol. The manipulation leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Ana
and may be used. This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320091 - https://vuldb.com/?ctiid.320091 - https://vuldb.com/?submit.629946 - https://github.com/i-Corner/cve/issues/17 - https://www.dlink.com/
CVE ID: CVE-2025-9027 State: PUBLISHED Published: 2025-08-15T10:02:06.072Z Last Updated: 2025-08-15T14:03:23.576Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Medicine Guide Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in code-projects Online Medicine Guide 1.0. This vulnerability affects unknown code of the file /addelivery.php. The manipulation of the argument deName leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320092 - https://vuldb.
be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320092 - https://vuldb.com/?ctiid.320092 - https://vuldb.com/?submit.630187 - https://github.com/Jackie1732/CVE/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-9028 State: PUBLISHED Published: 2025-08-15T10:32:06.405Z Last Updated: 2025-08-27T05:56:30.318Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Medicine Guide Problem Types: CWE-89, CWE-74 Description: A flaw has been found in code-projects Online Medicine Guide 1.0. This vulnerability affects unknown code of the file /adphar.php. Executing manipulation of the argument phuname can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320093 - https://vuldb.com/?ctiid.320093
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320093 - https://vuldb.com/?ctiid.320093 - https://vuldb.com/?submit.630188 - https://github.com/Jackie1732/CVE/issues/3 - https://code-projects.org/
CVE ID: CVE-2025-9029 State: PUBLISHED Published: 2025-10-04T02:24:38.389Z Last Updated: 2025-10-06T15:53:17.973Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: posimyththemes Products: WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder Problem Types: CWE-862 Description: The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to missing authorization via the wdkit_handle_review_submission function in versions less than, or equal to, 1.2.16. This is due to the plugin not properly verifying that a user is authorized to perform an acti
than, or equal to, 1.2.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to submit feedback data to external services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e89f0699-42be-403a-8cdb-31e214a85851?source=cve - https://plugins.trac.wordpress.org/browser/wdesignkit/tags/1.2.17/includes/admin/notices/class-wdkit-review-form.php#L117
CVE ID: CVE-2025-9030 State: PUBLISHED Published: 2025-10-04T02:24:37.996Z Last Updated: 2025-10-06T14:16:19.154Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: maneshtimilsina Products: Majestic Before After Image Problem Types: CWE-79 Description: The Majestic Before After Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_label' and 'after_label' parameters in versions less than, or equal to, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a
tackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e54f1a23-0b1f-4b0b-909e-e877e4ee2c86?source=cve - https://plugins.trac.wordpress.org/changeset/3358300/majestic-before-after-image
CVE ID: CVE-2025-9031 State: PUBLISHED Published: 2025-09-24T08:25:49.377Z Last Updated: 2025-09-24T14:04:08.007Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: DivvyDrive Information Technologies Inc. Products: DivvyDrive Web Problem Types: CWE-208, CWE-203 Description: Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive Web allows Cross-Domain Search Timing.This issue affects DivvyDrive Web: from 4.8.2.2 before 4.8.2.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0293
CVE ID: CVE-2025-9034 State: PUBLISHED Published: 2025-09-11T06:00:02.999Z Last Updated: 2025-09-11T14:42:03.335Z Vendors: Unknown Products: Wp Edit Password Protected Problem Types: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') Description: The Wp Edit Password Protected WordPress plugin before 1.3.5 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3cf79a0b-2731-47f8-a397-995f4de7067e/
CVE ID: CVE-2025-9035 State: PUBLISHED Published: 2025-09-22T09:15:15.858Z Last Updated: 2025-09-22T13:24:50.729Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) Vendors: Horato Internet Technologies Ind. and Trade Inc. Products: Virtual Library Platform Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Horato Internet Technologies Ind. And Trade Inc. Virtual Library Platform allows Reflected XSS.This issue affects Virtual Library Platform: before v202. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0284
CVE ID: CVE-2025-9036 State: PUBLISHED Published: 2025-08-14T13:39:19.020Z Last Updated: 2025-08-14T15:05:37.546Z Vendors: Rockwell Automation Products: FactoryTalk® Action Manager Problem Types: CWE-200 Description: A security issue in the runtime event system allows unauthenticated connections to receive a reusable API token. This token is broadcasted over a WebSocket and can be intercepted by any local client listening on the connection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1740.html
CVE ID: CVE-2025-9038 State: PUBLISHED Published: 2025-09-22T14:49:38.805Z Last Updated: 2025-09-24T13:31:23.806Z Vendors: GE Vernova Products: S1 Agile Configuration Software Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in GE Vernova S1 Agile Configuration Software on Windows allows Privilege Escalation.This issue affects S1 Agile Configuration Software: 3.1 and previous version. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gevernova.com/grid-solutions/sites/default/files/resources/products/support/ges-2025-001.pdf
CVE ID: CVE-2025-9039 State: PUBLISHED Published: 2025-08-14T16:15:19.103Z Last Updated: 2025-08-14T19:22:07.557Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Amazon Products: ECS Problem Types: CWE-277 Description: We identified an issue in the Amazon ECS agent where, under certain conditions, an introspection server could be accessed off-host by another instance if the instances are in the same security group or if their security groups allow incoming connections that include the port where the server is hosted. This issue does not affect instances where the option to allow off-host access to the introspection server is set to 'false'. This issue has be
ect instances where the option to allow off-host access to the introspection server is set to 'false'. This issue has been addressed in ECS agent version 1.97.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. If customers cannot update to the latest AMI, they can modify the Amazon EC2 security groups to restrict incoming access to the introspection server port (51678). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/aws/amazon-ecs-agent/releases/tag/v1.97.1 - https://aws.amazon.com/security/security-bulletins/AWS-2025-018/ - https://github.com/aws/amazon-ecs-agent/security/ad
- https://aws.amazon.com/security/security-bulletins/AWS-2025-018/ - https://github.com/aws/amazon-ecs-agent/security/advisories/GHSA-wm7x-ww72-r77q
CVE ID: CVE-2025-9041 State: PUBLISHED Published: 2025-08-14T14:17:37.447Z Last Updated: 2025-08-14T15:01:55.147Z Vendors: Rockwell Automation Products: FLEX 5000 I/O Problem Types: CWE-1287 Description: A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IF8 device. It causes the module to enter a fault state with the Module LED flashing red. Upon un-inhibiting, the module returns a connection fault (Code 16#0010), and the module cannot recover without a power cycle. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1737.html
CVE ID: CVE-2025-9042 State: PUBLISHED Published: 2025-08-14T14:23:58.491Z Last Updated: 2025-08-14T15:02:18.647Z Vendors: Rockwell Automation Products: FLEX 5000 I/O Problem Types: CWE-1287 Description: A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IY8 device. It causes the module to enter a fault state with the Module LED flashing red. Upon un-inhibiting, the module returns a connection fault (Code 16#0010), and the module cannot recover without a power cycle. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1737.html
CVE ID: CVE-2025-9043 State: PUBLISHED Published: 2025-08-14T16:27:05.364Z Last Updated: 2025-08-21T14:16:46.354Z Vendors: Seagate Products: Toolkit Problem Types: CWE-428 Description: The service executable path in Seagate Toolkit on Versions prior to 2.34.0.33 on Windows allows an attacker with Admin privileges to exploit a vulnerability as classified under CWE-428: Unquoted Search Path or Element. An attacker with write permissions to the root could place a malicious Program.exe file, which would execute with SYSTEM privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.seagate.com/support/software/toolkit/ - https://www.seagate.c
chment: - CVE Program Container: References: - https://www.seagate.com/support/software/toolkit/ - https://www.seagate.com/product-security/#security-advisories
CVE ID: CVE-2025-9044 State: PUBLISHED Published: 2025-09-26T03:25:34.873Z Last Updated: 2025-09-26T19:33:20.268Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mapster Products: Mapster WP Maps Problem Types: CWE-79 Description: The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple fields in versions up to, and including, 1.20.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CI
bitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b0f2c7f0-ff24-4489-9fb4-8a98ac6dc09a?source=cve - https://plugins.trac.wordpress.org/browser/mapster-wp-maps/tags/1.18.0/admin/includes/acf-map-fields.php#L15547 - https://plugins.trac.wordpress.org/browser/mapster-wp-maps/tags/1.18.0/admin/includes/acf-map-fields.php#L13932 - https://plugins.trac.wordpress.org/browser/mapster-wp-maps/tags/1.18.0/admin/includes/acf-map-fields.php#L13952 - https://plugins.trac.wordpress.org/browser/mapster-wp-maps/tags/1.18.0/admin/includes/acf-map-f
-map-fields.php#L13952 - https://plugins.trac.wordpress.org/browser/mapster-wp-maps/tags/1.18.0/admin/includes/acf-map-fields.php#L13972 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3363333%40mapster-wp-maps&new=3363333%40mapster-wp-maps&sfp_email=&sfph_mail=
CVE ID: CVE-2025-9045 State: PUBLISHED Published: 2025-10-03T11:17:06.706Z Last Updated: 2025-10-03T16:00:21.849Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: hashthemes Products: Easy Elementor Addons Problem Types: CWE-79 Description: The Easy Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in versions less than, or equal to, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additio