Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-58769 State: PUBLISHED Published: 2025-10-01T19:57:05.692Z Last Updated: 2025-10-01T20:09:45.900Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: auth0 Products: laravel-auth0 Problem Types: CWE-22, CWE-73 Description: auth0-PHP is an SDK for Auth0 Authentication and Management APIs. In versions 3.3.0 through 8.16.0, the Bulk User Import endpoint in applications built with the SDK does not validate the file-path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. The vulnerability affects any application that either directly uses the Auth0-PHP SDK (versions 3.3.0–8.16.0) or indirectly reli
erability affects any application that either directly uses the Auth0-PHP SDK (versions 3.3.0–8.16.0) or indirectly relies on those versions through the Auth0/symfony, Auth0/laravel-auth0, or Auth0/wordpress SDKs. This issue is fixed in version 8.17.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/auth0/laravel-auth0/security/advisories/GHSA-hjfh-5jmm-xr24 - https://github.com/auth0/auth0-PHP/security/advisories/GHSA-9mh6-g99m-ppcw - https://github.com/auth0/symfony/security/advisories/GHSA-7jp2-5h22-m432 - https://github.com/auth0/wordpress/security/advisories/GHSA-w22c-pw5m-482x - https://github.com/auth0/auth0-PHP/commit/9026da58f5c381cd4cb5932de829ef
press/security/advisories/GHSA-w22c-pw5m-482x - https://github.com/auth0/auth0-PHP/commit/9026da58f5c381cd4cb5932de829eff6eacbb65c - https://github.com/auth0/auth0-PHP/releases/tag/8.17.0
CVE ID: CVE-2025-58775 State: PUBLISHED Published: 2025-10-02T05:50:03.552Z Last Updated: 2025-10-02T17:59:59.045Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: KEYENCE CORPORATION Products: KV STUDIO, VT5-WX15/WX12 Problem Types: CWE-121 Description: KV STUDIO and VT5-WX15/WX12 contain a stack-based buffer overflow vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.keyence.com/kv_vulnerability2509301 - https://jvn.jp/en/vu/JVNVU97069449/
CVE ID: CVE-2025-58776 State: PUBLISHED Published: 2025-10-02T05:50:22.682Z Last Updated: 2025-10-02T17:59:12.033Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: KEYENCE CORPORATION Products: KV STUDIO Problem Types: CWE-121 Description: KV Studio versions 12.23 and prior contain a stack-based buffer overflow vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.keyence.com/kv_vulnerability2509302 - https://jvn.jp/en/vu/JVNVU97069449/
CVE ID: CVE-2025-58777 State: PUBLISHED Published: 2025-10-02T05:50:40.304Z Last Updated: 2025-10-02T17:58:25.822Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: KEYENCE CORPORATION Products: VT STUDIO Problem Types: CWE-824 Description: VT Studio versions 8.53 and prior contain an access of uninitialized pointer vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.keyence.com/vt_vulnerability250930 - https://jvn.jp/en/vu/JVNVU97069449/
CVE ID: CVE-2025-58778 State: PUBLISHED Published: 2025-10-16T06:04:43.115Z Last Updated: 2025-10-16T14:31:05.215Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ruijie Networks Co., Ltd. Products: RG-EST300 Problem Types: CWE-912 Description: Multiple versions of RG-EST300 provided by Ruijie Networks provide SSH server functionality. It is not documented in the manual, and enabled in the initial configuration. Anyone with the knowledge of the related credentials can log in to the affected device, leading to information disclosure, altering the system configurations, or causing a denial of service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrich
the system configurations, or causing a denial of service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ruijie.com.cn/gy/xw-aqtg-gw/929848/ - https://www.ruijie.com/en-global/support/productLifecycle - https://jvn.jp/en/jp/JVN72648885/
CVE ID: CVE-2025-58780 State: PUBLISHED Published: 2025-09-05T00:00:00.000Z Last Updated: 2025-09-08T20:44:05.246Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: ScienceLogic Products: SL1 Problem Types: CWE-89 Description: index.em7 in ScienceLogic SL1 before 12.1.1 allows SQL Injection via a parameter in a request. NOTE: this is disputed by the Supplier because it "inaccurately describes the vulnerability." Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.sciencelogic.com/release_notes_html/Content/12-1-1/12-1-1_release_notes.htm#New_Features_in_12-1-1 - https://github.com/SexyShoelessGodofWar/CVE-2025-58780
CVE ID: CVE-2025-58781 State: PUBLISHED Published: 2025-09-12T05:50:51.104Z Last Updated: 2025-09-12T16:30:11.420Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Wireless Tsukamoto Co., Ltd. Products: WTW-EAGLE App for iOS, WTW-EAGLE App for Android Problem Types: CWE-295 Description: WTW-EAGLE App does not properly validate server certificates, which may allow a man-in-the-middle attacker to monitor encrypted traffic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://apps.apple.com/jp/app/wtw-eagle/id1365998037?uo=4 - https://play.google.com/store/apps/details?id=com.generalcomp.wtw - https://jvn.jp/en/jp/JVN89109713/
CVE ID: CVE-2025-58782 State: PUBLISHED Published: 2025-09-08T08:53:15.818Z Last Updated: 2025-11-04T21:13:47.254Z Vendors: Apache Software Foundation Products: Apache Jackrabbit Core, Apache Jackrabbit JCR Commons Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Us
malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/t4wdrost6dh17dh406g792j9wq6xmy6v
CVE ID: CVE-2025-58783 State: PUBLISHED Published: 2025-09-05T13:44:54.238Z Last Updated: 2025-09-05T16:19:36.336Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: gutentor Products: Gutentor Problem Types: CWE-862 Description: Missing Authorization vulnerability in gutentor Gutentor allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Gutentor: from n/a through 3.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gutentor/vulnerability/wordpress-gutentor-plugin-3-5-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-58784 State: PUBLISHED Published: 2025-09-05T13:44:54.821Z Last Updated: 2025-09-05T16:19:17.229Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: arisoft Products: ARI Fancy Lightbox Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arisoft ARI Fancy Lightbox allows Stored XSS. This issue affects ARI Fancy Lightbox: from n/a through 1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ari-fancy-lightbox/vulnerability/wordpress-ari-fancy-lightbox-plugin-1-4-0-cross-site-scripting-xss-vulner
dpress/plugin/ari-fancy-lightbox/vulnerability/wordpress-ari-fancy-lightbox-plugin-1-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58785 State: PUBLISHED Published: 2025-09-05T13:44:55.462Z Last Updated: 2025-09-05T16:19:06.530Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: jbhovik Products: Ray Enterprise Translation Problem Types: CWE-862 Description: Missing Authorization vulnerability in jbhovik Ray Enterprise Translation allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ray Enterprise Translation: from n/a through 1.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lingotek-translation/vulnerability/wordpress-ray-enterprise-translation-plugin-1-7-1-broke
com/database/wordpress/plugin/lingotek-translation/vulnerability/wordpress-ray-enterprise-translation-plugin-1-7-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-58786 State: PUBLISHED Published: 2025-09-05T13:44:56.030Z Last Updated: 2025-09-08T16:46:02.640Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: VW THEMES Products: Ibtana – Ecommerce Product Addons Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VW THEMES Ibtana – Ecommerce Product Addons allows DOM-Based XSS. This issue affects Ibtana – Ecommerce Product Addons: from n/a through 0.4.7.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ibtana-ecommerce-product-addons/vulnerability/wordpr
ent: References: - https://patchstack.com/database/wordpress/plugin/ibtana-ecommerce-product-addons/vulnerability/wordpress-ibtana-ecommerce-product-addons-plugin-0-4-7-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58787 State: PUBLISHED Published: 2025-09-05T13:44:56.560Z Last Updated: 2025-09-08T16:46:24.582Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: themifyme Products: Themify Popup Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Popup allows Stored XSS. This issue affects Themify Popup: from n/a through 1.4.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/themify-popup/vulnerability/wordpress-themify-popup-plugin-1-4-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58788 State: PUBLISHED Published: 2025-09-05T13:44:57.285Z Last Updated: 2025-09-08T16:43:21.206Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Saad Iqbal Products: License Manager for WooCommerce Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal License Manager for WooCommerce allows Blind SQL Injection. This issue affects License Manager for WooCommerce: from n/a through 3.0.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/license-manager-for-woocommerce/vulnerability/wordpre
nt: References: - https://patchstack.com/database/wordpress/plugin/license-manager-for-woocommerce/vulnerability/wordpress-license-manager-for-woocommerce-plugin-3-0-12-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-58789 State: PUBLISHED Published: 2025-09-05T13:44:58.497Z Last Updated: 2025-09-08T16:43:02.533Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Themeisle Products: WP Full Stripe Free Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle WP Full Stripe Free allows SQL Injection. This issue affects WP Full Stripe Free: from n/a through 8.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-full-stripe-free/vulnerability/wordpress-wp-full-stripe-free-plugin-8-3-0-sql-injection-vulnera
base/wordpress/plugin/wp-full-stripe-free/vulnerability/wordpress-wp-full-stripe-free-plugin-8-3-0-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-58790 State: PUBLISHED Published: 2025-09-05T13:44:59.412Z Last Updated: 2025-09-05T15:34:42.878Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPKube Products: Kiwi Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKube Kiwi allows Stored XSS. This issue affects Kiwi: from n/a through 2.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/kiwi-social-share/vulnerability/wordpress-kiwi-plugin-2-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58791 State: PUBLISHED Published: 2025-09-05T13:45:00.737Z Last Updated: 2025-09-05T15:35:28.238Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Arjan Olsder Products: SEO Auto Linker Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arjan Olsder SEO Auto Linker allows Stored XSS. This issue affects SEO Auto Linker: from n/a through 1.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpa-seo-auto-linker/vulnerability/wordpress-seo-auto-linker-plugin-1-5-3-cross-site-scripting-xss-vulnera
rdpress/plugin/wpa-seo-auto-linker/vulnerability/wordpress-seo-auto-linker-plugin-1-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58792 State: PUBLISHED Published: 2025-09-05T13:45:01.955Z Last Updated: 2025-09-05T15:36:32.190Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WPKube Products: Authors List Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WPKube Authors List allows Cross Site Request Forgery. This issue affects Authors List: from n/a through 2.0.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/authors-list/vulnerability/wordpress-authors-list-plugin-2-0-6-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-58793 State: PUBLISHED Published: 2025-09-05T13:45:03.116Z Last Updated: 2025-09-05T15:37:16.866Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPBean Products: WPB Elementor Addons Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean WPB Elementor Addons allows Stored XSS. This issue affects WPB Elementor Addons: from n/a through 1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpb-elementor-addons/vulnerability/wordpress-wpb-elementor-addons-plugin-1-6-cross-site-scripting-xss-vu
ordpress/plugin/wpb-elementor-addons/vulnerability/wordpress-wpb-elementor-addons-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58794 State: PUBLISHED Published: 2025-09-05T13:45:03.746Z Last Updated: 2025-09-05T15:37:47.806Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: rainafarai Products: Notification for Telegram Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in rainafarai Notification for Telegram allows Cross Site Request Forgery. This issue affects Notification for Telegram: from n/a through 3.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/notification-for-telegram/vulnerability/wordpress-notification-for-telegram-plugin-3-4-6-cross-site-request-forge
plugin/notification-for-telegram/vulnerability/wordpress-notification-for-telegram-plugin-3-4-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-58795 State: PUBLISHED Published: 2025-09-05T13:45:04.492Z Last Updated: 2025-09-15T11:24:48.252Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Payoneer Inc. Products: Payoneer Checkout Problem Types: CWE-862 Description: Missing Authorization vulnerability in Payoneer Inc. Payoneer Checkout allows Content Spoofing.This issue affects Payoneer Checkout: from n/a through 3.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/payoneer-checkout/vulnerability/wordpress-payoneer-checkout-plugin-3-4-0-content-spoofing-vulnerability?_s_id=cve
CVE ID: CVE-2025-58796 State: PUBLISHED Published: 2025-09-05T13:45:05.107Z Last Updated: 2025-09-05T15:38:46.969Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: dudaster Products: Elementor Element Condition Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dudaster Elementor Element Condition allows Stored XSS. This issue affects Elementor Element Condition: from n/a through 1.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ele-conditions/vulnerability/wordpress-elementor-element-condition-plugin-1-0
//patchstack.com/database/wordpress/plugin/ele-conditions/vulnerability/wordpress-elementor-element-condition-plugin-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-58797 State: PUBLISHED Published: 2025-09-05T13:45:05.665Z Last Updated: 2025-09-05T15:39:23.825Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Mahmudul Hasan Arif Products: Ninja Charts Problem Types: CWE-497 Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Mahmudul Hasan Arif Ninja Charts allows Retrieve Embedded Sensitive Data. This issue affects Ninja Charts: from n/a through 3.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ninja-charts/vulnerability/wordpress-ninja-charts-plugin-3-3-2-sensitive-data-exposure-
ck.com/database/wordpress/plugin/ninja-charts/vulnerability/wordpress-ninja-charts-plugin-3-3-2-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-58798 State: PUBLISHED Published: 2025-09-05T13:45:06.214Z Last Updated: 2025-09-05T15:40:10.205Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Bjorn Manintveld Products: BCM Duplicate Menu Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Bjorn Manintveld BCM Duplicate Menu allows Cross Site Request Forgery. This issue affects BCM Duplicate Menu: from n/a through 1.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bcm-duplicate-menu/vulnerability/wordpress-bcm-duplicate-menu-plugin-1-1-2-cross-site-request-forgery-csrf-vulnerability?_
m-duplicate-menu/vulnerability/wordpress-bcm-duplicate-menu-plugin-1-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-58799 State: PUBLISHED Published: 2025-09-05T13:45:06.746Z Last Updated: 2025-09-05T15:40:57.221Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: themelocation Products: Custom WooCommerce Checkout Fields Editor Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in themelocation Custom WooCommerce Checkout Fields Editor allows Cross Site Request Forgery. This issue affects Custom WooCommerce Checkout Fields Editor: from n/a through 1.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/add-fields-to-checkout-page-woocommerce/vulnerability/wordp
ferences: - https://patchstack.com/database/wordpress/plugin/add-fields-to-checkout-page-woocommerce/vulnerability/wordpress-custom-woocommerce-checkout-fields-editor-plugin-1-3-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-58800 State: PUBLISHED Published: 2025-09-05T13:45:07.378Z Last Updated: 2025-09-08T15:26:48.371Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Steve Truman Products: WP Email Template Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Steve Truman WP Email Template allows Cross Site Request Forgery. This issue affects WP Email Template: from n/a through 2.8.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-email-template/vulnerability/wordpress-wp-email-template-plugin-2-8-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-58801 State: PUBLISHED Published: 2025-09-05T13:45:07.915Z Last Updated: 2025-09-08T16:43:36.833Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: KCS Products: Responder Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in KCS Responder allows Cross Site Request Forgery. This issue affects Responder: from n/a through 4.3.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/responder/vulnerability/wordpress-responder-plugin-4-3-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-58802 State: PUBLISHED Published: 2025-09-05T13:45:08.464Z Last Updated: 2025-09-08T15:02:18.822Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: michalzagdan Products: TrustMate.io – WooCommerce integration Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in michalzagdan TrustMate.io – WooCommerce integration allows Cross Site Request Forgery. This issue affects TrustMate.io – WooCommerce integration: from n/a through 1.14.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/trustmate-io-integration-for-woocommerce/vulnerability/wordpress-trus
- https://patchstack.com/database/wordpress/plugin/trustmate-io-integration-for-woocommerce/vulnerability/wordpress-trustmate-io-woocommerce-integration-plugin-1-14-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-58804 State: PUBLISHED Published: 2025-09-05T13:45:08.999Z Last Updated: 2025-09-08T15:02:37.121Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: brijrajs Products: WooCommerce Single Page Checkout Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in brijrajs WooCommerce Single Page Checkout allows Cross Site Request Forgery. This issue affects WooCommerce Single Page Checkout: from n/a through 1.2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woo-single-page-checkout/vulnerability/wordpress-woocommerce-single-page-checkout-plugin-1-2-7-c
tabase/wordpress/plugin/woo-single-page-checkout/vulnerability/wordpress-woocommerce-single-page-checkout-plugin-1-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve