Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ack.com/database/wordpress/plugin/zikzag-core/vulnerability/wordpress-zikzag-core-1-4-5-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-49887 State: PUBLISHED Published: 2025-08-14T10:34:06.810Z Last Updated: 2025-08-14T15:57:08.929Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: WPFactory Products: Product XML Feed Manager for WooCommerce Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in WPFactory Product XML Feed Manager for WooCommerce allows Remote Code Inclusion. This issue affects Product XML Feed Manager for WooCommerce: from n/a through 2.9.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/product-xml-feeds-for-woocommerce/vulnerability/wo
hment: References: - https://patchstack.com/database/wordpress/plugin/product-xml-feeds-for-woocommerce/vulnerability/wordpress-product-xml-feed-manager-for-woocommerce-plugin-2-9-3-remote-code-execution-rce-vulnerability?_s_id=cve
CVE ID: CVE-2025-49888 State: PUBLISHED Published: 2025-07-16T11:27:57.729Z Last Updated: 2025-07-16T20:23:09.553Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: pimwick Products: PW WooCommerce On Sale! Problem Types: CWE-862 Description: Missing Authorization vulnerability in pimwick PW WooCommerce On Sale! allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PW WooCommerce On Sale!: from n/a through 1.39. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/pw-woocommerce-on-sale/vulnerability/wordpress-pw-woocommerce-on-sale-1-39-broken-access-control-vulne
/wordpress/plugin/pw-woocommerce-on-sale/vulnerability/wordpress-pw-woocommerce-on-sale-1-39-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49889 State: PUBLISHED Published: 2025-08-20T08:03:38.918Z Last Updated: 2025-08-20T17:54:46.550Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: imaprogrammer Products: Custom Comment Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imaprogrammer Custom Comment allows Stored XSS. This issue affects Custom Comment: from n/a through 2.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/customcomment/vulnerability/wordpress-custom-comment-plugin-2-1-6-cross-site-scripting-xss-vulnerability?_
dpress/plugin/customcomment/vulnerability/wordpress-custom-comment-plugin-2-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49890 State: PUBLISHED Published: 2025-08-20T08:03:38.386Z Last Updated: 2025-08-20T17:54:03.571Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Jorge Garcia de Bustos Products: AWStats Script Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jorge Garcia de Bustos AWStats Script allows Stored XSS. This issue affects AWStats Script: from n/a through 0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/awstats-script/vulnerability/wordpress-awstats-script-plugin-0-3-cross-site-scripting-xss-
com/database/wordpress/plugin/awstats-script/vulnerability/wordpress-awstats-script-plugin-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49891 State: PUBLISHED Published: 2025-08-20T08:03:37.807Z Last Updated: 2025-08-20T17:52:54.804Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: riotweb Products: Contact Info Widget Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in riotweb Contact Info Widget allows Stored XSS. This issue affects Contact Info Widget: from n/a through 2.6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-contact-info-widget/vulnerability/wordpress-contact-info-widget-plugin-2-6-2-cross-site-scriptin
wordpress/plugin/simple-contact-info-widget/vulnerability/wordpress-contact-info-widget-plugin-2-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49892 State: PUBLISHED Published: 2025-08-20T08:03:37.294Z Last Updated: 2025-08-20T17:51:54.092Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: badasswp Products: Pending Order Bot Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in badasswp Pending Order Bot allows Stored XSS. This issue affects Pending Order Bot: from n/a through 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/pending-order-bot/vulnerability/wordpress-pending-order-bot-plugin-1-0-2-cross-site-scripting-xss-vulnerabi
press/plugin/pending-order-bot/vulnerability/wordpress-pending-order-bot-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49893 State: PUBLISHED Published: 2025-08-20T08:03:36.738Z Last Updated: 2025-08-20T17:50:36.142Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: liseperu Products: Elizaibots Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in liseperu Elizaibots allows Stored XSS. This issue affects Elizaibots: from n/a through 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/elizaibot-chatbots/vulnerability/wordpress-elizaibots-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49894 State: PUBLISHED Published: 2025-08-20T08:03:36.141Z Last Updated: 2025-08-20T14:02:54.032Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: rewish Products: WP Emmet Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rewish WP Emmet allows Stored XSS. This issue affects WP Emmet: from n/a through 0.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-emmet/vulnerability/wordpress-wp-emmet-plugin-0-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49895 State: PUBLISHED Published: 2025-08-16T02:34:50.784Z Last Updated: 2025-08-18T13:56:29.650Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: iThemes Products: ServerBuddy by PluginBuddy.com Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in iThemes ServerBuddy by PluginBuddy.Com allows Object Injection.This issue affects ServerBuddy by PluginBuddy.Com: from n/a through 1.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/serverbuddy-by-pluginbuddy/vulnerability/wordpress-serverbuddy-by-pluginbuddy-com-plugin-1-0-5-csrf-to-php-object-inj
in/serverbuddy-by-pluginbuddy/vulnerability/wordpress-serverbuddy-by-pluginbuddy-com-plugin-1-0-5-csrf-to-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49896 State: PUBLISHED Published: 2025-08-20T08:03:35.576Z Last Updated: 2025-08-20T14:04:48.421Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: wptasker Products: WP Discord Post Plus &#8211; Supports Unlimited Channels Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in wptasker WP Discord Post Plus &#8211; Supports Unlimited Channels allows Cross Site Request Forgery. This issue affects WP Discord Post Plus &#8211; Supports Unlimited Channels: from n/a through 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-discord-post-plus/vul
Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-discord-post-plus/vulnerability/wordpress-wp-discord-post-plus-supports-unlimited-channels-plugin-1-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-49897 State: PUBLISHED Published: 2025-08-15T15:13:13.206Z Last Updated: 2025-08-15T19:11:03.781Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: gopiplus Products: Vertical scroll slideshow gallery v2 Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Vertical scroll slideshow gallery v2 allows Blind SQL Injection. This issue affects Vertical scroll slideshow gallery v2: from n/a through 9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/vertical-scroll-slideshow-gallery-v2/vulnerab
lnrichment: References: - https://patchstack.com/database/wordpress/plugin/vertical-scroll-slideshow-gallery-v2/vulnerability/wordpress-vertical-scroll-slideshow-gallery-v2-plugin-9-1-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49898 State: PUBLISHED Published: 2025-08-15T15:41:55.857Z Last Updated: 2025-08-15T19:12:09.967Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Xolluteon Products: Dropshix Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xolluteon Dropshix allows DOM-Based XSS.This issue affects Dropshix: from n/a through 4.0.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/dropshipping-xox/vulnerability/wordpress-dropshix-plugin-4-0-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49899 State: PUBLISHED Published: 2025-10-22T14:32:09.852Z Last Updated: 2025-11-13T10:33:40.604Z Vendors: jjlemstra Products: Whydonate Problem Types: CWE-862 Description: Missing Authorization vulnerability in jjlemstra Whydonate wp-whydonate allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Whydonate: from n/a through <= 4.0.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wp-whydonate/vulnerability/wordpress-whydonate-plugin-4-0-15-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49900 State: PUBLISHED Published: 2025-11-06T15:53:54.586Z Last Updated: 2025-11-13T10:33:40.686Z Vendors: bPlugins Products: Advanced scrollbar Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in bPlugins Advanced scrollbar advanced-scrollbar allows Privilege Escalation.This issue affects Advanced scrollbar: from n/a through <= 1.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/advanced-scrollbar/vulnerability/wordpress-advanced-scrollbar-plugin-1-1-8-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-49901 State: PUBLISHED Published: 2025-10-22T14:32:10.033Z Last Updated: 2025-11-13T10:33:40.691Z Vendors: quantumcloud Products: Simple Link Directory Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Authentication Abuse.This issue affects Simple Link Directory: from n/a through < 14.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/qc-simple-link-directory/vulnerability/wordpress-simple-link-directory-plugin-14-8-1-broken-authentication-vulnerability?_s_id=cve
CVE ID: CVE-2025-49903 State: PUBLISHED Published: 2025-10-22T14:32:10.215Z Last Updated: 2025-11-13T10:33:40.702Z Vendors: bdthemes Products: ZoloBlocks Problem Types: CWE-862 Description: Missing Authorization vulnerability in bdthemes ZoloBlocks zoloblocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ZoloBlocks: from n/a through <= 2.3.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/zoloblocks/vulnerability/wordpress-zoloblocks-plugin-2-3-11-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49904 State: PUBLISHED Published: 2025-11-06T15:53:55.162Z Last Updated: 2025-11-13T10:33:40.700Z Vendors: magepeopleteam Products: Booking and Rental Manager Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Reflected XSS.This issue affects Booking and Rental Manager: from n/a through <= 2.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/booking-and-rental-manager-for-woocommerce/vulnerability/wordpress-booking-and-rental-man
.com/database/Wordpress/Plugin/booking-and-rental-manager-for-woocommerce/vulnerability/wordpress-booking-and-rental-manager-plugin-2-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49905 State: PUBLISHED Published: 2025-11-06T15:53:55.700Z Last Updated: 2025-11-13T10:33:40.701Z Vendors: PluginsCafe Products: Range Slider Addon for Gravity Forms Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsCafe Range Slider Addon for Gravity Forms range-slider-addon-for-gravity-forms allows Reflected XSS.This issue affects Range Slider Addon for Gravity Forms: from n/a through <= 1.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/range-slider-addon-for-gravity-forms/vulnerability/wordpress-range-slid
s://vdp.patchstack.com/database/Wordpress/Plugin/range-slider-addon-for-gravity-forms/vulnerability/wordpress-range-slider-addon-for-gravity-forms-plugin-1-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49906 State: PUBLISHED Published: 2025-10-22T14:32:10.402Z Last Updated: 2025-11-13T10:33:40.700Z Vendors: StellarWP Products: WPComplete Problem Types: CWE-862 Description: Missing Authorization vulnerability in StellarWP WPComplete wpcomplete allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPComplete: from n/a through <= 2.9.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wpcomplete/vulnerability/wordpress-wpcomplete-plugin-2-9-5-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49907 State: PUBLISHED Published: 2025-10-22T14:32:10.614Z Last Updated: 2025-11-13T10:33:40.933Z Vendors: RealMag777 Products: MDTF Problem Types: CWE-862 Description: Missing Authorization vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MDTF: from n/a through <= 1.3.3.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wp-meta-data-filter-and-taxonomy-filter/vulnerability/wordpress-mdtf-plugin-1-3-3-9-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49908 State: PUBLISHED Published: 2025-10-22T14:32:10.858Z Last Updated: 2025-11-13T10:33:40.937Z Vendors: WPClever Products: WPC Countdown Timer for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPClever WPC Countdown Timer for WooCommerce wpc-countdown-timer allows Stored XSS.This issue affects WPC Countdown Timer for WooCommerce: from n/a through <= 3.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wpc-countdown-timer/vulnerability/wordpress-wpc-countdown-timer-for-woocommerce-plugin-3-1-4-cross-s
se/Wordpress/Plugin/wpc-countdown-timer/vulnerability/wordpress-wpc-countdown-timer-for-woocommerce-plugin-3-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49909 State: PUBLISHED Published: 2025-11-06T15:53:56.279Z Last Updated: 2025-11-13T10:33:40.982Z Vendors: PenciDesign Products: Penci Bookmark & Follow Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Bookmark & Follow penci-bookmark-follow allows Reflected XSS.This issue affects Penci Bookmark & Follow: from n/a through < 2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/penci-bookmark-follow/vulnerability/wordpress-penci-bookmark-follow-plugin-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49910 State: PUBLISHED Published: 2025-10-22T14:32:11.095Z Last Updated: 2025-11-13T10:33:40.956Z Vendors: AmentoTech Private Limited Products: WPGuppy Problem Types: CWE-862 Description: Missing Authorization vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPGuppy: from n/a through <= 1.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wpguppy-lite/vulnerability/wordpress-wpguppy-plugin-1-1-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49911 State: PUBLISHED Published: 2025-10-22T14:32:11.293Z Last Updated: 2025-11-13T10:33:41.002Z Vendors: wpinstinct Products: WooCommerce Vehicle Parts Finder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpinstinct WooCommerce Vehicle Parts Finder woo-vehicle-parts-finder allows Reflected XSS.This issue affects WooCommerce Vehicle Parts Finder: from n/a through <= 3.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/woo-vehicle-parts-finder/vulnerability/wordpress-woocommerce-vehicle-parts-finder-plugin-3-7-cross-
ase/Wordpress/Plugin/woo-vehicle-parts-finder/vulnerability/wordpress-woocommerce-vehicle-parts-finder-plugin-3-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49912 State: PUBLISHED Published: 2025-10-22T14:32:11.545Z Last Updated: 2025-11-13T10:33:41.019Z Vendors: Nks Products: Email Subscription Popup Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nks Email Subscription Popup email-subscribe allows Stored XSS.This issue affects Email Subscription Popup: from n/a through <= 1.2.26. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/email-subscribe/vulnerability/wordpress-email-subscription-popup-plugin-1-2-26-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49913 State: PUBLISHED Published: 2025-10-22T14:32:11.977Z Last Updated: 2025-11-13T10:33:41.025Z Vendors: CoSchedule Products: CoSchedule Problem Types: CWE-862 Description: Missing Authorization vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoSchedule: from n/a through <= 3.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/coschedule-by-todaymade/vulnerability/wordpress-coschedule-plugin-3-4-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49915 State: PUBLISHED Published: 2025-10-22T14:32:12.221Z Last Updated: 2025-11-13T10:33:41.016Z Vendors: Cozy Vision Products: SMS Alert Order Notifications Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows SQL Injection.This issue affects SMS Alert Order Notifications: from n/a through <= 3.8.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-plugin-3-8-5-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49916 State: PUBLISHED Published: 2025-10-22T14:32:12.420Z Last Updated: 2025-11-13T10:33:41.201Z Vendors: MultiVendorX Products: MultiVendorX Problem Types: CWE-862 Description: Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MultiVendorX: from n/a through <= 4.2.23. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/dc-woocommerce-multi-vendor/vulnerability/wordpress-multivendorx-plugin-4-2-23-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49917 State: PUBLISHED Published: 2025-10-22T14:32:12.630Z Last Updated: 2025-11-13T10:33:41.186Z Vendors: Icegram Products: Icegram Express Pro Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Icegram Icegram Express Pro email-subscribers-premium allows Server Side Request Forgery.This issue affects Icegram Express Pro: from n/a through <= 5.9.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/email-subscribers-premium/vulnerability/wordpress-icegram-express-pro-plugin-5-9-5-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-49920 State: PUBLISHED Published: 2025-10-22T14:32:12.844Z Last Updated: 2025-11-13T10:33:41.196Z Vendors: accessiBe Products: Web Accessibility By accessiBe Problem Types: CWE-862 Description: Missing Authorization vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Web Accessibility By accessiBe: from n/a through <= 2.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/accessibe/vulnerability/wordpress-web-accessibility-by-accessibe-plugin-2-10-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49921 State: PUBLISHED Published: 2025-10-22T14:32:13.059Z Last Updated: 2025-11-13T16:24:57.909Z Vendors: CrocoBlock Products: JetReviews Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CrocoBlock JetReviews jet-reviews allows PHP Local File Inclusion.This issue affects JetReviews: from n/a through <= 3.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/jet-reviews/vulnerability/wordpress-jetreviews-plugin-3-0-0-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-49922 State: PUBLISHED Published: 2025-10-22T14:32:13.367Z Last Updated: 2025-11-13T16:27:00.721Z Vendors: etruel Products: WPeMatico RSS Feed Fetcher Problem Types: CWE-862 Description: Missing Authorization vulnerability in etruel WPeMatico RSS Feed Fetcher wpematico allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPeMatico RSS Feed Fetcher: from n/a through <= 2.8.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wpematico/vulnerability/wordpress-wpematico-rss-feed-fetcher-plugin-2-8-3-broken-access-control-vulnerability?_s_id=cve