Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-26841 State: PUBLISHED Published: 2025-05-12T00:00:00.000Z Last Updated: 2025-05-12T22:07:45.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in WPEVEREST Everest Forms before 3.0.9 allows an attacker to execute arbitrary code via a file upload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://everestforms.net - https://gist.github.com/knilkantha/71458e9a787157653d5603fe6880bc05
CVE ID: CVE-2025-26842 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-08T18:54:47.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Znuny through 7.1.3. If access to a ticket is not given, the content of S/MIME encrypted e-mail messages is visible to users with access to the CommunicationLog. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.znuny.org/en/advisories/zsa-2025-01
CVE ID: CVE-2025-26844 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-08T18:52:46.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Znuny through 7.1.3. A cookie is set without the HttpOnly flag. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.znuny.com - https://www.znuny.org/en/advisories/zsa-2025-05
CVE ID: CVE-2025-26845 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-08T18:48:11.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Eval Injection issue was discovered in Znuny through 7.1.3. A user with write access to the configuration file can use this to execute a command executed by the user running the backup.pl script. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.znuny.com - https://www.znuny.org/en/advisories/zsa-2025-03
CVE ID: CVE-2025-26846 State: PUBLISHED Published: 2025-05-12T00:00:00.000Z Last Updated: 2025-05-12T22:07:40.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Znuny before 7.1.4. Permissions are not checked properly when using the Generic Interface to update ticket metadata. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.znuny.com - https://www.znuny.org/en/advisories/zsa-2025-02
CVE ID: CVE-2025-26847 State: PUBLISHED Published: 2025-05-08T00:00:00.000Z Last Updated: 2025-05-08T19:00:44.753Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Znuny before 7.1.5. When generating a support bundle, not all passwords are masked. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.znuny.com - https://www.znuny.org/en/advisories/zsa-2025-06
CVE ID: CVE-2025-26849 State: PUBLISHED Published: 2025-03-04T00:00:00.000Z Last Updated: 2025-03-05T03:30:08.131Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Docusnap Products: Docusnap Problem Types: CWE-1394 Description: There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be used to decrypt inventory files that contain sensitive information such as firewall rules. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.docusnap.com/en/release-notes/changelog/ - https://www.redteam-pentesting.de/en/advisories/rt-sa-2024-012/
CVE ID: CVE-2025-26850 State: PUBLISHED Published: 2025-07-04T00:00:00.000Z Last Updated: 2025-07-08T14:36:07.987Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Quest Products: KACE Systems Management Appliance Problem Types: CWE-863 Description: The agent in Quest KACE Systems Management Appliance (SMA) before 14.0.97 and 14.1.x before 14.1.19 potentially allows privilege escalation on managed systems. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.quest.com/kb/4378559/quest-response-to-kace-sma-agent-vulnerability-cve-2025-26850
CVE ID: CVE-2025-26852 State: PUBLISHED Published: 2025-03-20T00:00:00.000Z Last Updated: 2025-04-03T20:27:35.447Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Descor Products: Infocad FM Problem Types: CWE-89 Description: DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 allows SQL Injection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.descor.com/prodotti/infocad - https://www.infocadfm.com/changelog/sql-injection/
CVE ID: CVE-2025-26853 State: PUBLISHED Published: 2025-03-20T00:00:00.000Z Last Updated: 2025-04-03T20:18:08.325Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Descor Products: Infocad FM Problem Types: CWE-863 Description: DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.descor.com/prodotti/infocad - https://www.infocadfm.com/changelog/broken-authorization-schema/
CVE ID: CVE-2025-26854 State: PUBLISHED Published: 2025-07-18T07:38:25.510Z Last Updated: 2025-07-23T11:14:21.609Z Vendors: joomcar.net Products: Articles Good Search extension for Joomla Problem Types: CWE-89 Description: A SQL injection in Articles Good Search extension 1.0.0 - 1.2.4.0011 for Joomla allows attackers to execute arbitrary SQL commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://joomcar.net/
CVE ID: CVE-2025-26855 State: PUBLISHED Published: 2025-07-18T07:38:31.619Z Last Updated: 2025-07-23T11:14:59.941Z Vendors: joomcar.net Products: Articles Calendar extension for Joomla Problem Types: CWE-89 Description: A SQL injection in Articles Calendar extension 1.0.0 - 1.0.1.0007 for Joomla allows attackers to execute arbitrary SQL commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://joomcar.net/
CVE ID: CVE-2025-26856 State: PUBLISHED Published: 2025-02-20T05:49:49.402Z Last Updated: 2025-02-20T16:15:20.874Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: I-O DATA DEVICE, INC. Products: UD-LT2 Problem Types: CWE-78 Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If an attacker logs in to the affected product with an administrative account and manipulates requests for a certain screen operation, an arbitrary OS command may be executed. This vulnerability was reported on a different screen operation from CVE-2025-20617. Additional Analyst
may be executed. This vulnerability was reported on a different screen operation from CVE-2025-20617. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.iodata.jp/support/information/2025/01_ud-lt2/ - https://jvn.jp/en/jp/JVN15293958/
CVE ID: CVE-2025-26857 State: PUBLISHED Published: 2025-04-15T21:12:13.452Z Last Updated: 2025-04-16T15:08:48.134Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Growatt Products: Cloud portal Problem Types: CWE-639 Description: Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04
CVE ID: CVE-2025-26859 State: PUBLISHED Published: 2025-10-15T06:06:04.501Z Last Updated: 2025-10-15T13:22:28.831Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: RSUPPORT CO., LTD. Products: RemoteView PC Application Console Problem Types: CWE-427 Description: RemoteView PC Application Console versions prior to 6.0.2 contain an uncontrolled search path element vulnerability. If a crafted DLL is placed in the same folder with the affected product, it may cause an arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://help.rview.com/hc/en-us/articles/4420613945875-Notice-of-termination-of-RemoteView-PC-application-con
erences: - https://help.rview.com/hc/en-us/articles/4420613945875-Notice-of-termination-of-RemoteView-PC-application-console-service - https://jvn.jp/en/jp/JVN22713803/
CVE ID: CVE-2025-26860 State: PUBLISHED Published: 2025-10-15T06:06:41.514Z Last Updated: 2025-10-15T13:17:32.545Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: RSUPPORT CO., LTD. Products: RemoteCall Remote Support Program (for Operator) Problem Types: CWE-427 Description: RemoteCall Remote Support Program (for Operator) versions prior to 5.1.0 contain an uncontrolled search path element vulnerability. If a crafted DLL is placed in the same folder with the affected product, it may cause an arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.remotecall.com/en/support/download/ - https://jvn.jp/en/jp/JVN22713
: - CISA ADP Vulnrichment: References: - https://www.remotecall.com/en/support/download/ - https://jvn.jp/en/jp/JVN22713803/
CVE ID: CVE-2025-26861 State: PUBLISHED Published: 2025-10-15T06:07:01.220Z Last Updated: 2025-10-15T17:15:33.687Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: RSUPPORT CO., LTD. Products: RemoteCall Remote Support Program (for Operator) Problem Types: CWE-427 Description: RemoteCall Remote Support Program (for Operator) versions prior to 5.3.0 contain an uncontrolled search path element vulnerability. If a crafted DLL is placed in the same folder with the affected product, it may cause an arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.remotecall.com/en/support/download/ - https://jvn.jp/en/jp/JVN22713
CVE ID: CVE-2025-26862 State: PUBLISHED Published: 2025-10-27T14:39:41.284Z Last Updated: 2025-10-27T14:48:11.544Z Vendors: Ping Identity Products: PingFederate Problem Types: CWE-307 Description: Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.pingidentity.com/s/article/PingFederate-unexpected-template-rendering-in-redirectless-mode - https://www.pingidentity.com/en/resources/downloads/pingfederate.html
CVE ID: CVE-2025-26863 State: PUBLISHED Published: 2025-08-12T16:59:25.188Z Last Updated: 2025-08-13T20:15:35.544Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L) Vendors: n/a Products: Intel(R) 700 Series Ethernet Problem Types: Denial of Service, CWE-400 Description: Uncontrolled resource consumption in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potentially enable denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01335.html
CVE ID: CVE-2025-26864 State: PUBLISHED Published: 2025-05-14T10:44:12.712Z Last Updated: 2025-05-19T18:41:38.927Z Vendors: Apache Software Foundation Products: Apache IoTDB Problem Types: CWE-200, CWE-532 Description: Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB. This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2. Users are recommended to upgrade to version 1.3.4 and 2.0.2, which fix the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/2kcjnlypppk8qjh17dpz0jv
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/2kcjnlypppk8qjh17dpz0jvkcpn6l162
CVE ID: CVE-2025-26865 State: PUBLISHED Published: 2025-03-10T14:01:06.952Z Last Updated: 2025-03-11T19:26:51.972Z Vendors: Apache Software Foundation Products: Apache OFBiz Problem Types: CWE-1336 Description: Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before 18.12.18. It's a regression between 18.12.17 and 18.12.18. In case you use something like that, which is not recommended! For security, only official releases should be used. In other words, if you use 18.12.17 you are still safe. The version 18.12.17 is not a affected. But something between 18.12.17 and 18.12.18 is. In that case, u
are still safe. The version 18.12.17 is not a affected. But something between 18.12.17 and 18.12.18 is. In that case, users are recommended to upgrade to version 18.12.18, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ofbiz.apache.org/download.html - https://ofbiz.apache.org/security.html - https://issues.apache.org/jira/browse/OFBIZ-12594 - https://lists.apache.org/thread/prb48ztk01bflyyjbl6p56wlcc1n5sz7
CVE ID: CVE-2025-26867 State: PUBLISHED Published: 2025-05-19T16:48:56.873Z Last Updated: 2025-05-20T14:07:08.996Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Themes4WP Products: Bulk Problem Types: CWE-862 Description: Missing Authorization vulnerability in Themes4WP Bulk allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bulk: from n/a through 1.0.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/bulk/vulnerability/wordpress-bulk-theme-1-0-11-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-26868 State: PUBLISHED Published: 2025-02-25T14:17:50.737Z Last Updated: 2025-02-25T19:16:21.819Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: fastflow Products: Fast Flow Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fastflow Fast Flow allows Reflected XSS. This issue affects Fast Flow: from n/a through 1.2.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/fast-flow-dashboard/vulnerability/wordpress-fast-flow-plugin-1-2-16-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26869 State: PUBLISHED Published: 2025-03-26T14:48:53.951Z Last Updated: 2025-03-26T15:29:57.677Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Products: Build Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Build allows Stored XSS.This issue affects Build: from n/a through 1.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/build/vulnerability/wordpress-build-theme-1-13-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26870 State: PUBLISHED Published: 2025-04-15T21:53:11.010Z Last Updated: 2025-04-16T15:06:15.419Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: JetEngine Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound JetEngine allows DOM-Based XSS. This issue affects JetEngine: from n/a through 3.6.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-6-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26871 State: PUBLISHED Published: 2025-02-25T14:17:50.925Z Last Updated: 2025-02-25T19:11:28.803Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: WPDeveloper Products: Essential Blocks for Gutenberg Problem Types: CWE-862 Description: Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Essential Blocks for Gutenberg: from n/a through 4.8.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/essential-blocks/vulnerability/wordpress-essential-blocks-plugin-4-8-3
https://patchstack.com/database/wordpress/plugin/essential-blocks/vulnerability/wordpress-essential-blocks-plugin-4-8-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-26872 State: PUBLISHED Published: 2025-05-19T18:04:14.384Z Last Updated: 2025-05-19T21:22:54.026Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: dkszone Products: Eximius Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Eximius allows Using Malicious Files.This issue affects Eximius: from n/a through 2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/eximius/vulnerability/wordpress-eximius-theme-2-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-26873 State: PUBLISHED Published: 2025-03-27T21:59:49.863Z Last Updated: 2025-06-09T08:44:54.118Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Shine theme Products: Traveler Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Shine theme Traveler.This issue affects Traveler: from n/a before 3.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/traveler/vulnerability/wordpress-traveler-theme-3-1-8-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-26874 State: PUBLISHED Published: 2025-03-27T21:58:19.989Z Last Updated: 2025-03-28T15:52:11.659Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: MemberSpace Products: MemberSpace Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MemberSpace allows Reflected XSS.This issue affects MemberSpace: from n/a through 2.1.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/memberspace/vulnerability/wordpress-memberspace-plugin-2-1-13-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26875 State: PUBLISHED Published: 2025-03-15T21:57:01.817Z Last Updated: 2025-03-17T16:11:57.870Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: silverplugins217 Products: Multiple Shipping And Billing Address For Woocommerce Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in silverplugins217 Multiple Shipping And Billing Address For Woocommerce allows SQL Injection. This issue affects Multiple Shipping And Billing Address For Woocommerce: from n/a through 1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/databa
ce: from n/a through 1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/different-shipping-and-billing-address-for-woocommerce/vulnerability/wordpress-multiple-shipping-and-billing-address-for-woocommerce-plugin-1-3-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-26876 State: PUBLISHED Published: 2025-02-25T14:17:51.077Z Last Updated: 2025-08-26T19:33:58.109Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: CodeManas Products: Search with Typesense Problem Types: CWE-35 Description: Path Traversal vulnerability in CodeManas Search with Typesense allows Path Traversal. This issue affects Search with Typesense: from n/a through 2.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/search-with-typesense/vulnerability/wordpress-search-with-typesense-plugin-2-0-8-path-traversal-vulnerability?_s_id=cve
CVE ID: CVE-2025-26877 State: PUBLISHED Published: 2025-02-25T14:17:51.241Z Last Updated: 2025-08-26T19:32:51.029Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Rustaurius Products: Front End Users Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Front End Users allows Stored XSS. This issue affects Front End Users: from n/a through 3.2.30. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/front-end-only-users/vulnerability/wordpress-front-end-users-plugin-3-2-30-cross-site-scripting-xss-vulnerab
ress/plugin/front-end-only-users/vulnerability/wordpress-front-end-users-plugin-3-2-30-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26878 State: PUBLISHED Published: 2025-02-25T14:17:51.390Z Last Updated: 2025-02-25T18:32:28.952Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: patternsinthecloud Products: Autoship Cloud for WooCommerce Subscription Products Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in patternsinthecloud Autoship Cloud for WooCommerce Subscription Products allows DOM-Based XSS. This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.8.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/dat
s: from n/a through 2.8.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/autoship-cloud/vulnerability/wordpress-autoship-cloud-for-woocommerce-subscription-products-plugin-2-8-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26879 State: PUBLISHED Published: 2025-03-03T13:30:40.679Z Last Updated: 2025-03-03T14:34:23.745Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Cristián Lávaque Products: s2Member Pro Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristián Lávaque s2Member Pro allows Reflected XSS. This issue affects s2Member Pro: from n/a through 241216. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/s2member/vulnerability/wordpress-s2member-plugin-241216-reflected-cross-site-scripting-xss-vulnerability
ordpress/plugin/s2member/vulnerability/wordpress-s2member-plugin-241216-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26880 State: PUBLISHED Published: 2025-04-15T21:53:11.279Z Last Updated: 2025-04-16T14:00:42.238Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: sonalsinha21 Products: SKT Skill Bar Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Skill Bar allows Stored XSS. This issue affects SKT Skill Bar: from n/a through 2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/skt-skill-bar/vulnerability/wordpress-skt-skill-bar-plugin-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26881 State: PUBLISHED Published: 2025-02-25T14:17:51.599Z Last Updated: 2025-02-25T18:49:43.605Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: bPlugins Products: Sticky Content Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Sticky Content allows Stored XSS. This issue affects Sticky Content: from n/a through 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/sticky-menu-block/vulnerability/wordpress-sticky-content-plugin-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=c
gin/sticky-menu-block/vulnerability/wordpress-sticky-content-plugin-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve