Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ww.mozilla.org/security/advisories/mfsa2025-81/ - https://www.mozilla.org/security/advisories/mfsa2025-82/ - https://www.mozilla.org/security/advisories/mfsa2025-83/ - https://www.mozilla.org/security/advisories/mfsa2025-84/ - https://www.mozilla.org/security/advisories/mfsa2025-85/
CVE ID: CVE-2025-11712 State: PUBLISHED Published: 2025-10-14T12:27:35.544Z Last Updated: 2025-11-03T17:31:51.952Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Description: A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This could have contributed to an XSS on a site that unsafely serves files without a content-type header. This vulnerability affects Firefox < 144, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_
tional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1979536 - https://www.mozilla.org/security/advisories/mfsa2025-81/ - https://www.mozilla.org/security/advisories/mfsa2025-83/ - https://www.mozilla.org/security/advisories/mfsa2025-84/ - https://www.mozilla.org/security/advisories/mfsa2025-85/
CVE ID: CVE-2025-11713 State: PUBLISHED Published: 2025-10-14T12:27:35.913Z Last Updated: 2025-11-14T15:23:55.588Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Description: Insufficient escaping in the “Copy as cURL” feature could have been used to trick a user into executing unexpected code on Windows. This did not affect the application when running on other operating systems. This vulnerability affects Firefox < 144, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1986142 - https://www.mozilla.org/security/advisories/mfsa2025-81/ - https://www.mozi
gzilla.mozilla.org/show_bug.cgi?id=1986142 - https://www.mozilla.org/security/advisories/mfsa2025-81/ - https://www.mozilla.org/security/advisories/mfsa2025-83/ - https://www.mozilla.org/security/advisories/mfsa2025-84/ - https://www.mozilla.org/security/advisories/mfsa2025-85/
CVE ID: CVE-2025-11714 State: PUBLISHED Published: 2025-10-14T12:27:34.820Z Last Updated: 2025-11-03T17:32:01.391Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Description: Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 144, Firefox ESR < 115.29, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://b
Thunderbird < 140.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1973699%2C1989945%2C1990970%2C1991040%2C1992113 - https://www.mozilla.org/security/advisories/mfsa2025-81/ - https://www.mozilla.org/security/advisories/mfsa2025-82/ - https://www.mozilla.org/security/advisories/mfsa2025-83/ - https://www.mozilla.org/security/advisories/mfsa2025-84/ - https://www.mozilla.org/security/advisories/mfsa2025-85/
CVE ID: CVE-2025-11715 State: PUBLISHED Published: 2025-10-14T12:27:36.209Z Last Updated: 2025-11-03T17:32:03.369Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Description: Memory safety bugs present in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 144, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=198
tes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1983838%2C1987624%2C1988244%2C1988912%2C1989734%2C1990085%2C1991899 - https://www.mozilla.org/security/advisories/mfsa2025-81/ - https://www.mozilla.org/security/advisories/mfsa2025-83/ - https://www.mozilla.org/security/advisories/mfsa2025-84/ - https://www.mozilla.org/security/advisories/mfsa2025-85/
CVE ID: CVE-2025-11716 State: PUBLISHED Published: 2025-10-14T12:27:36.531Z Last Updated: 2025-10-30T16:13:47.442Z Vendors: Mozilla Products: Firefox, Thunderbird Description: Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability affects Firefox < 144 and Thunderbird < 144. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1818679 - https://www.mozilla.org/security/advisories/mfsa2025-81/ - https://www.mozilla.org/security/advisories/mfsa2025-84/
CVE ID: CVE-2025-11717 State: PUBLISHED Published: 2025-10-14T12:27:37.569Z Last Updated: 2025-10-30T16:13:50.048Z Vendors: Mozilla Products: Firefox Description: When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one being used. Prior to Firefox 144 the password edit screen was visible. This vulnerability affects Firefox < 144. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1872601 - https://www.mozilla.org/security/advisories/mfsa2025-81/
CVE ID: CVE-2025-11718 State: PUBLISHED Published: 2025-10-14T12:27:37.866Z Last Updated: 2025-10-30T16:13:52.906Z Vendors: Mozilla Products: Firefox Description: When the address bar was hidden due to scrolling on Android, a malicious page could create a fake address bar to fool the user in response to a visibilitychange event This vulnerability affects Firefox < 144. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1980808 - https://www.mozilla.org/security/advisories/mfsa2025-81/
CVE ID: CVE-2025-11719 State: PUBLISHED Published: 2025-10-14T12:27:36.841Z Last Updated: 2025-11-14T15:23:56.437Z Vendors: Mozilla Products: Firefox, Thunderbird Description: Starting in Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption. This vulnerability affects Firefox < 144 and Thunderbird < 144. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1991950 - https://www.mozilla.org/security/advisories/mfsa2025-81/ - https://www.mozilla.org/security/advisories/mfsa2025-84/
CVE ID: CVE-2025-11720 State: PUBLISHED Published: 2025-10-14T12:27:38.204Z Last Updated: 2025-10-30T16:13:59.755Z Vendors: Mozilla Products: Firefox Description: The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site. This vulnerability affects Firefox < 144. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1979534 - https://bugzilla.mozilla.org/show_bug.cgi?id=1984370 - https://www.mozilla.org/secur
zilla.org/show_bug.cgi?id=1979534 - https://bugzilla.mozilla.org/show_bug.cgi?id=1984370 - https://www.mozilla.org/security/advisories/mfsa2025-81/
CVE ID: CVE-2025-11721 State: PUBLISHED Published: 2025-10-14T12:27:37.218Z Last Updated: 2025-10-30T16:14:02.507Z Vendors: Mozilla Products: Firefox, Thunderbird Description: Memory safety bug present in Firefox 143 and Thunderbird 143. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox < 144 and Thunderbird < 144. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1986816 - https://www.mozilla.org/security/advisories/mfsa2025-81/ - https://www.mozilla.org/security/advisories/mfsa2025-84/
CVE ID: CVE-2025-11722 State: PUBLISHED Published: 2025-10-15T08:25:56.072Z Last Updated: 2025-10-15T14:43:16.924Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ikhodal Products: Woocommerce Category and Products Accordion Panel Problem Types: CWE-98 Description: The Woocommerce Category and Products Accordion Panel plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0 via the 'categoryaccordionpanel' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those fil
nd above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/55315ba1-cbb8-4ce1-96c6-30a02611ba47?source=cve - https://plugins.trac.wordpress.org/browser/accordion-panel-for-category-and-products/tags/1.0/include/categoryaccordionpanel.php#L87 - https://plugins.trac.wordpress.org/browser/accordion-panel-for-category-and-products/tags/1.0/include/abstract.php
L87 - https://plugins.trac.wordpress.org/browser/accordion-panel-for-category-and-products/tags/1.0/include/abstract.php#L256
CVE ID: CVE-2025-11724 State: PUBLISHED Published: 2025-11-04T04:27:18.321Z Last Updated: 2025-11-04T16:32:44.217Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: erinmorelli Products: EM Beer Manager Problem Types: CWE-434 Description: The EM Beer Manager plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in all versions up to, and including, 3.2.3. This is due to missing file type validation in the EMBM_Admin_Untappd_Import_image() function and missing authorization checks on the wp_ajax_embm-untappd-import action. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload a
d-import action. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files including PHP files and execute code on the server granted they can provide a mock HTTP server that responds with specific JSON data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/76b7a946-71ad-46da-95f6-a02703812938?source=cve - https://plugins.trac.wordpress.org/browser/em-beer-manager/tags/3.2.3/includes/admin/integrations/embm-integrations-untappd.php#L867 - https://plugins.trac.wordpress.org/browser/em-beer-manager/tags/3.2.3/includes/admin/integrations/embm-integrations-untappd
ps://plugins.trac.wordpress.org/browser/em-beer-manager/tags/3.2.3/includes/admin/integrations/embm-integrations-untappd.php#L899 - https://plugins.trac.wordpress.org/browser/em-beer-manager/tags/3.2.3/includes/admin/integrations/embm-integrations-untappd.php#L912 - https://plugins.trac.wordpress.org/browser/em-beer-manager/tags/3.2.3/includes/admin/embm-admin-actions.php#L393
CVE ID: CVE-2025-11728 State: PUBLISHED Published: 2025-10-15T08:26:03.227Z Last Updated: 2025-10-15T13:52:55.127Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: oceanpayment Products: Oceanpayment CreditCard Gateway Problem Types: CWE-306 Description: The Oceanpayment CreditCard Gateway plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'return_payment' and 'notice_payment' functions in all versions up to, and including, 6.0. This makes it possible for unauthenticated attackers to update WooCommerce orders to 'failed' status, and update transaction IDs. Addi
possible for unauthenticated attackers to update WooCommerce orders to 'failed' status, and update transaction IDs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c560bc33-d664-433e-bfd9-e4fa1776bb76?source=cve - https://plugins.trac.wordpress.org/browser/oceanpayment-creditcard-gateway/trunk/class-wc-oceancreditcard.php#L594 - https://plugins.trac.wordpress.org/browser/oceanpayment-creditcard-gateway/trunk/class-wc-oceancreditcard.php#L489
CVE ID: CVE-2025-11731 State: PUBLISHED Published: 2025-10-14T06:02:35.519Z Last Updated: 2025-11-21T07:09:20.167Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-843 Description: A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion
type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-11731 - https://bugzilla.redhat.com/show_bug.cgi?id=2403688 - https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/78
CVE ID: CVE-2025-11733 State: PUBLISHED Published: 2025-11-04T04:27:22.165Z Last Updated: 2025-11-04T15:10:40.025Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: lumiblog Products: Footnotes Made Easy Problem Types: CWE-79 Description: The Footnotes Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 3.0.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
t will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c6f6662f-1013-4de1-9091-1ac330260eed?source=cve - https://plugins.trac.wordpress.org/browser/footnotes-made-easy/tags/3.0.7/footnotes-made-easy.php#L112
CVE ID: CVE-2025-11734 State: PUBLISHED Published: 2025-11-18T09:27:35.134Z Last Updated: 2025-11-18T21:39:53.173Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: aioseo Products: Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links Problem Types: CWE-862 Description: The Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links plugin for WordPress is vulnerable to unauthorized post modification due to missing authorization in all versions up to, and including, 1.2.5. This is due to the plugin registering a REST API endpoint that only checks for a broad capability (aioseo_blc_broken_links_page) that is granted
registering a REST API endpoint that only checks for a broad capability (aioseo_blc_broken_links_page) that is granted to contributor level users, without verifying the user's permission to perform actions on the specific post being targeted. This makes it possible for authenticated attackers, with contributor level access and above, to trash arbitrary posts via the DELETE /wp-json/aioseoBrokenLinkChecker/v1/post endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0254cd1b-f8f6-400e-a48e-81bd553fe8d1?source=cve - https://plugins.trac.wordpress.org/changeset/3390304/broken-link-checker-seo
CVE ID: CVE-2025-11735 State: PUBLISHED Published: 2025-10-28T05:27:30.225Z Last Updated: 2025-10-28T13:33:05.054Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: realmag777 Products: HUSKY – Products Filter Professional for WooCommerce Problem Types: CWE-89 Description: The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the `phrase` parameter in all versions up to, and including, 1.3.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries
ration on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ebaec880-0d1c-4725-a746-530f48821279?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/by_text_2/index.php#L164
CVE ID: CVE-2025-11736 State: PUBLISHED Published: 2025-10-14T17:32:06.659Z Last Updated: 2025-10-14T17:49:04.672Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Online Examination System Problem Types: CWE-89, CWE-74 Description: A flaw has been found in itsourcecode Online Examination System 1.0. Affected by this issue is some unknown functionality of the file /index.php. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328220 - https://vul
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.328220 - https://vuldb.com/?ctiid.328220 - https://vuldb.com/?submit.671467 - https://github.com/iMayday-Yee/Vulnerability/issues/3 - https://itsourcecode.com/
CVE ID: CVE-2025-11738 State: PUBLISHED Published: 2025-10-18T05:41:55.159Z Last Updated: 2025-10-20T18:58:57.946Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: dglingren Products: Media Library Assistant Problem Types: CWE-73 Description: The Media Library Assistant plugin for WordPress is vulnerable to limited file reading in all versions up to, and including, 3.29 via the mla-stream-image.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary ai/eps/pdf/ps files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threa
sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/43d1264a-2265-4423-a643-7ef6436d3764?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379044%40media-library-assistant&new=3379044%40media-library-assistant&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379043%40media-library-assistant&new=3379043%40media-library-assistant&sfp_email=&sfph_mail=
CVE ID: CVE-2025-11740 State: PUBLISHED Published: 2025-11-01T05:40:24.041Z Last Updated: 2025-11-03T13:31:04.431Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: tomdever Products: wpForo Forum Problem Types: CWE-89 Description: The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the Subscriptions Manager in all versions up to, and including, 2.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used
with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aa1eaac2-a23b-4ef6-803a-15f7ec7e5728?source=cve - https://plugins.trac.wordpress.org/changeset/3386327/wpforo/tags/2.4.10/modules/subscriptions/Subscriptions.php?old=3380558&old_path=wpforo%2Ftags%2F2.4.9%2Fmodules%2Fsubscriptions%2FSubscriptions.php
CVE ID: CVE-2025-11741 State: PUBLISHED Published: 2025-10-18T06:42:44.576Z Last Updated: 2025-10-20T18:56:10.426Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: wpclever Products: WPC Smart Quick View for WooCommerce Problem Types: CWE-639 Description: The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.2.5 via the 'woosq_quickview' AJAX endpoint due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft products that they should not have access to. Addi
attackers to extract data from password protected, private, or draft products that they should not have access to. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/220487de-2a1c-47ec-ac65-db1af44aed3d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379189%40woo-smart-quick-view&new=3379189%40woo-smart-quick-view&sfp_email=&sfph_mail=
CVE ID: CVE-2025-11742 State: PUBLISHED Published: 2025-10-18T05:41:56.648Z Last Updated: 2025-10-20T19:00:15.871Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: wpclever Products: WPC Smart Wishlist for WooCommerce Problem Types: CWE-862 Description: The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wishlist_quickview' AJAX action in all versions up to, and including, 5.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user's wishlist data and information. Additional Analyst Notes: - CISA ADP Vulnrich
evel access and above, to view other user's wishlist data and information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/60d65c7e-5533-4ac0-b2f0-339342224581?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3378540%40woo-smart-wishlist&new=3378540%40woo-smart-wishlist&sfp_email=&sfph_mail=
CVE ID: CVE-2025-11745 State: PUBLISHED Published: 2025-11-05T11:24:40.781Z Last Updated: 2025-11-05T11:24:40.781Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: spacetime Products: Ad Inserter – Ad Manager & AdSense Ads Problem Types: CWE-80 Description: The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field through the plugin's 'adinserter' shortcode in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbi