Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-48299 State: PUBLISHED Published: 2025-07-16T10:36:53.680Z Last Updated: 2025-07-16T20:15:52.663Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: YayCommerce Products: YayExtra Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YayExtra allows SQL Injection. This issue affects YayExtra: from n/a through 1.5.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/yayextra/vulnerability/wordpress-yayextra-plugin-1-5-5-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-48300 State: PUBLISHED Published: 2025-07-16T11:28:01.803Z Last Updated: 2025-07-16T14:10:01.749Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Adrian Tobey Products: Groundhogg Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Adrian Tobey Groundhogg allows Upload a Web Shell to a Web Server. This issue affects Groundhogg: from n/a through 4.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/groundhogg/vulnerability/wordpress-groundhogg-4-2-1-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-48301 State: PUBLISHED Published: 2025-07-16T10:36:53.201Z Last Updated: 2025-07-16T20:11:16.005Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: YayCommerce Products: SMTP for SendGrid – YaySMTP Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce SMTP for SendGrid – YaySMTP allows SQL Injection. This issue affects SMTP for SendGrid – YaySMTP: from n/a through 1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/smtp-sendgrid/vulnerability/wordpress-smtp-for-sendgrid-yaysmtp-plugin-1
ttps://patchstack.com/database/wordpress/plugin/smtp-sendgrid/vulnerability/wordpress-smtp-for-sendgrid-yaysmtp-plugin-1-5-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-48302 State: PUBLISHED Published: 2025-08-20T08:03:23.473Z Last Updated: 2025-08-20T17:44:25.664Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Roxnor Products: FundEngine Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Roxnor FundEngine allows PHP Local File Inclusion. This issue affects FundEngine: from n/a through 1.7.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-fundraising-donation/vulnerability/wordpress-fundengine-plugin-1-7-4-local-file-inclusion-vulnerab
e/wordpress/plugin/wp-fundraising-donation/vulnerability/wordpress-fundengine-plugin-1-7-4-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-48303 State: PUBLISHED Published: 2025-08-25T10:10:03.184Z Last Updated: 2025-08-25T11:26:29.344Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Kevin Langley Jr. Products: Post Type Converter Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Kevin Langley Jr. Post Type Converter allows Cross-Site Request Forgery.This issue affects Post Type Converter: from n/a through 0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/post-type-converter/vulnerability/wordpress-post-type-converter-plugin-0-6-cross-site-request-forgery-csrf-vulnerability
post-type-converter/vulnerability/wordpress-post-type-converter-plugin-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-48304 State: PUBLISHED Published: 2025-08-28T12:36:47.674Z Last Updated: 2025-08-28T14:11:39.280Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Gary Illyes Products: Google XML News Sitemap plugin Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Gary Illyes Google XML News Sitemap plugin allows Stored XSS. This issue affects Google XML News Sitemap plugin: from n/a through 0.02. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gn-xml-sitemap/vulnerability/wordpress-google-xml-news-sitemap-plugin-plugin-0-02-cross-site-request-forgery-csrf-t
ugin/gn-xml-sitemap/vulnerability/wordpress-google-xml-news-sitemap-plugin-plugin-0-02-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48305 State: PUBLISHED Published: 2025-08-28T12:36:48.279Z Last Updated: 2025-08-28T14:11:23.685Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: vikingjs Products: Goal Tracker for Patreon Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vikingjs Goal Tracker for Patreon allows Stored XSS. This issue affects Goal Tracker for Patreon: from n/a through 0.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/goal-tracker-for-patreon/vulnerability/wordpress-goal-tracker-for-patreon-plugin-0-4-6
ack.com/database/wordpress/plugin/goal-tracker-for-patreon/vulnerability/wordpress-goal-tracker-for-patreon-plugin-0-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48306 State: PUBLISHED Published: 2025-08-28T12:36:48.919Z Last Updated: 2025-08-28T13:56:19.700Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: developers savyour Products: Savyour Affiliate Partner Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in developers savyour Savyour Affiliate Partner allows Stored XSS. This issue affects Savyour Affiliate Partner: from n/a through 2.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/savyour-affiliate-partner/vulnerability/wordpress-savyour-affiliate-partner-plugin-2-1-4-csrf-to-stored-xss-vulnera
ugin/savyour-affiliate-partner/vulnerability/wordpress-savyour-affiliate-partner-plugin-2-1-4-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48307 State: PUBLISHED Published: 2025-08-28T12:36:49.558Z Last Updated: 2025-08-28T13:26:01.396Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: kasonzhao Products: SEO For Images Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in kasonzhao SEO For Images allows Stored XSS. This issue affects SEO For Images: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/seo-for-images/vulnerability/wordpress-seo-for-images-plugin-1-0-0-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48308 State: PUBLISHED Published: 2025-08-28T12:36:50.175Z Last Updated: 2025-08-28T13:25:49.052Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: nonletter Products: Newsletter subscription optin module Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in nonletter Newsletter subscription optin module allows Stored XSS. This issue affects Newsletter subscription optin module: from n/a through 1.2.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/newsletter-subscription-widget-for-sendblaster/vulnerability/wordpress-newsletter-subscription-optin
se/wordpress/plugin/newsletter-subscription-widget-for-sendblaster/vulnerability/wordpress-newsletter-subscription-optin-module-plugin-1-2-9-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48309 State: PUBLISHED Published: 2025-08-28T12:36:50.787Z Last Updated: 2025-08-28T14:47:39.360Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: web-able Products: BetPress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in web-able BetPress allows Stored XSS. This issue affects BetPress: from n/a through 1.0.1 Lite. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/betpress/vulnerability/wordpress-betpress-plugin-1-0-1-lite-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48310 State: PUBLISHED Published: 2025-08-28T12:36:51.433Z Last Updated: 2025-08-28T14:47:31.657Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: wptableeditor Products: Table Editor Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in wptableeditor Table Editor allows Cross Site Request Forgery. This issue affects Table Editor: from n/a through 1.6.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-table-editor/vulnerability/wordpress-table-editor-plugin-1-6-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-48311 State: PUBLISHED Published: 2025-08-28T12:36:52.053Z Last Updated: 2025-08-28T14:47:24.463Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: OffClicks Products: Invisible Optin Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in OffClicks Invisible Optin allows Stored XSS. This issue affects Invisible Optin: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/invisible-optin/vulnerability/wordpress-invisible-optin-plugin-1-0-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48312 State: PUBLISHED Published: 2025-08-28T12:36:52.634Z Last Updated: 2025-08-28T13:25:23.142Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: 文派翻译（WP Chinese Translation） Products: WPAvatar Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 文派翻译（WP Chinese Translation） WPAvatar allows Stored XSS. This issue affects WPAvatar: from n/a through 1.9.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpavatar/vulnerability/wordpress-wpavatar-plugin-1-9-3-cross-site-scripting-xss-vulnerability?
database/wordpress/plugin/wpavatar/vulnerability/wordpress-wpavatar-plugin-1-9-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48313 State: PUBLISHED Published: 2025-08-28T12:36:53.293Z Last Updated: 2025-08-28T14:47:15.194Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: kevin heath Products: Tripadvisor Shortcode Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kevin heath Tripadvisor Shortcode allows Stored XSS. This issue affects Tripadvisor Shortcode: from n/a through 2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/tripadvisor-shortcode/vulnerability/wordpress-tripadvisor-shortcode-plugin-2-2-cross-site-s
om/database/wordpress/plugin/tripadvisor-shortcode/vulnerability/wordpress-tripadvisor-shortcode-plugin-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48314 State: PUBLISHED Published: 2025-08-28T12:36:53.893Z Last Updated: 2025-08-28T14:47:05.923Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: salubrio Products: Add Code To Head Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salubrio Add Code To Head allows Stored XSS. This issue affects Add Code To Head: from n/a through 1.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/add-code-to-head/vulnerability/wordpress-add-code-to-head-plugin-1-17-cross-site-scripting-xss-vulnerability?_s
s/plugin/add-code-to-head/vulnerability/wordpress-add-code-to-head-plugin-1-17-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48315 State: PUBLISHED Published: 2025-08-28T12:36:54.491Z Last Updated: 2025-08-28T14:46:48.098Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: stanton119 Products: WordPress HTML Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stanton119 WordPress HTML allows Stored XSS. This issue affects WordPress HTML: from n/a through 0.51. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/custom-html-bodyhead/vulnerability/wordpress-wordpress-html-plugin-0-51-cross-site-scripting-xss-vulnerability?_s
plugin/custom-html-bodyhead/vulnerability/wordpress-wordpress-html-plugin-0-51-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48316 State: PUBLISHED Published: 2025-08-28T12:36:55.124Z Last Updated: 2025-08-28T14:46:40.893Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: ItayXD Products: Responsive Mobile-Friendly Tooltip Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ItayXD Responsive Mobile-Friendly Tooltip allows Stored XSS. This issue affects Responsive Mobile-Friendly Tooltip: from n/a through 1.6.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/responsive-mobile-friendly-tooltip/vulnerability/wordpress-r
erences: - https://patchstack.com/database/wordpress/plugin/responsive-mobile-friendly-tooltip/vulnerability/wordpress-responsive-mobile-friendly-tooltip-plugin-1-6-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48317 State: PUBLISHED Published: 2025-09-05T16:15:41.410Z Last Updated: 2025-09-09T13:45:33.091Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Stefan Keller Products: WooCommerce Payment Gateway for Saferpay Problem Types: CWE-35 Description: Path Traversal vulnerability in Stefan Keller WooCommerce Payment Gateway for Saferpay allows Path Traversal. This issue affects WooCommerce Payment Gateway for Saferpay: from n/a through 0.4.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woocommerce-payment-gateway-for-saferpay/vulnerability/wordpress-woocommerce-payment-gateway-for
tabase/wordpress/plugin/woocommerce-payment-gateway-for-saferpay/vulnerability/wordpress-woocommerce-payment-gateway-for-saferpay-plugin-0-4-9-path-traversal-vulnerability?_s_id=cve
CVE ID: CVE-2025-48318 State: PUBLISHED Published: 2025-08-28T12:36:55.685Z Last Updated: 2025-08-28T17:59:07.978Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: shen2 Products: 多说社会化评论框 Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in shen2 多说社会化评论框 allows Cross Site Request Forgery. This issue affects 多说社会化评论框: from n/a through 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/duoshuo/vulnerability/wordpress-plugin-1-2-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE ID: CVE-2025-48319 State: PUBLISHED Published: 2025-08-28T12:36:56.244Z Last Updated: 2025-08-28T17:54:18.167Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: gslauraspeck Products: Mesa Mesa Reservation Widget Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gslauraspeck Mesa Mesa Reservation Widget allows Stored XSS. This issue affects Mesa Mesa Reservation Widget: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mesa-mesa-reservation-widget/vulnerability/wordpress-mesa-mesa-res
s: - https://patchstack.com/database/wordpress/plugin/mesa-mesa-reservation-widget/vulnerability/wordpress-mesa-mesa-reservation-widget-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48320 State: PUBLISHED Published: 2025-08-28T12:36:56.810Z Last Updated: 2025-08-28T19:01:40.548Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: cuckoohello Products: 百度分享按钮 Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in cuckoohello 百度分享按钮 allows Stored XSS. This issue affects 百度分享按钮: from n/a through 1.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/baidushare-wp/vulnerability/wordpress-plugin-1-0-6-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48321 State: PUBLISHED Published: 2025-08-28T12:36:57.446Z Last Updated: 2025-08-28T14:46:34.016Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: dyiosah Products: Ultimate twitter profile widget Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in dyiosah Ultimate twitter profile widget allows Stored XSS. This issue affects Ultimate twitter profile widget: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ultimate-twitter-profile-widget/vulnerability/wordpress-ultimate-twitter-profile-widget-plugin-1-0-csrf-to-stored-xss-vul
ltimate-twitter-profile-widget/vulnerability/wordpress-ultimate-twitter-profile-widget-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48322 State: PUBLISHED Published: 2025-08-28T12:36:58.108Z Last Updated: 2025-08-28T14:46:26.741Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Finn Dohrn Products: Statify Widget Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Finn Dohrn Statify Widget allows Stored XSS. This issue affects Statify Widget: from n/a through 1.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/statify-widget/vulnerability/wordpress-statify-widget-plugin-1-4-6-cross-site-scripting-xss-vulnerability?_s_id=
/plugin/statify-widget/vulnerability/wordpress-statify-widget-plugin-1-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48323 State: PUBLISHED Published: 2025-08-28T12:36:58.705Z Last Updated: 2025-08-28T14:46:18.381Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Md Abunaser Khan Products: Advance Food Menu Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md Abunaser Khan Advance Food Menu allows Stored XSS. This issue affects Advance Food Menu: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/advance-food-menu/vulnerability/wordpress-advance-food-menu-plugin-1-0-cross-site-scripting-x
/database/wordpress/plugin/advance-food-menu/vulnerability/wordpress-advance-food-menu-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48324 State: PUBLISHED Published: 2025-08-28T12:36:59.287Z Last Updated: 2025-08-28T14:46:11.990Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: khashabawy Products: tli.tl auto Twitter poster Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in khashabawy tli.tl auto Twitter poster allows Stored XSS. This issue affects tli.tl auto Twitter poster: from n/a through 3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/tlitl-auto-twitter-poster/vulnerability/wordpress-tli-tl-auto-twitter-poster-p
/patchstack.com/database/wordpress/plugin/tlitl-auto-twitter-poster/vulnerability/wordpress-tli-tl-auto-twitter-poster-plugin-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48325 State: PUBLISHED Published: 2025-08-28T12:36:59.873Z Last Updated: 2025-08-28T14:46:05.332Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: shmish111 Products: WP Admin Theme Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in shmish111 WP Admin Theme allows Stored XSS. This issue affects WP Admin Theme: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-admin-theme/vulnerability/wordpress-wp-admin-theme-plugin-1-0-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48326 State: PUBLISHED Published: 2025-09-26T08:31:12.796Z Last Updated: 2025-09-26T14:00:15.538Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Acclectic Media Products: Acclectic Media Organizer Problem Types: CWE-862 Description: Missing Authorization vulnerability in Acclectic Media Acclectic Media Organizer allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Acclectic Media Organizer: from n/a through 1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/acclectic-media-organizer/vulnerability/wordpress-acclectic-media-organizer-plu
patchstack.com/database/wordpress/plugin/acclectic-media-organizer/vulnerability/wordpress-acclectic-media-organizer-plugin-1-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-48327 State: PUBLISHED Published: 2025-08-28T12:37:00.500Z Last Updated: 2025-08-28T13:25:08.992Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: inkthemes Products: WP Mailgun SMTP Problem Types: CWE-862 Description: Missing Authorization vulnerability in inkthemes WP Mailgun SMTP allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WP Mailgun SMTP: from n/a through 1.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-mailgun-smtp/vulnerability/wordpress-wp-mailgun-smtp-plugin-1-0-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-48328 State: PUBLISHED Published: 2025-06-06T11:37:51.862Z Last Updated: 2025-06-06T15:53:20.582Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Daman Jeet Products: Real Time Validation for Gravity Forms Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Daman Jeet Real Time Validation for Gravity Forms allows Cross Site Request Forgery.This issue affects Real Time Validation for Gravity Forms: from n/a through 1.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/real-time-validation-for-gravity-forms/vulnerability/wordpress-real-time-va
s://patchstack.com/database/wordpress/plugin/real-time-validation-for-gravity-forms/vulnerability/wordpress-real-time-validation-for-gravity-forms-plugin-1-7-0-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve