Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303689 - https://vuldb.com/?ctiid.303689 - https://vuldb.com/?submit.544288 - https://github.com/Tr0e/CVE_Hunter/blob/main/AIAS/AIAS_SSRF1.md
CVE ID: CVE-2025-3412 State: PUBLISHED Published: 2025-04-08T05:31:05.642Z Last Updated: 2025-04-08T15:29:36.428Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: mymagicpower Products: AIAS Problem Types: CWE-918 Description: A vulnerability, which was classified as critical, was found in mymagicpower AIAS 20250308. Affected is an unknown function of the file 2_training_platform/train-platform/src/main/java/top/aias/training/controller/InferController.java. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this
ttack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303690 - https://vuldb.com/?ctiid.303690 - https://vuldb.com/?submit.544289 - https://github.com/Tr0e/CVE_Hunter/blob/main/AIAS/AIAS_SSRF2.md
CVE ID: CVE-2025-3413 State: PUBLISHED Published: 2025-04-08T06:00:13.827Z Last Updated: 2025-04-08T15:29:24.358Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: opplus Products: springboot-admin Problem Types: CWE-502, CWE-20 Description: A vulnerability has been found in opplus springboot-admin up to a2d5310f44fd46780a8686456cf2f9001ab8f024 and classified as critical. Affected by this vulnerability is the function code of the file SysGeneratorController.java. The manipulation of the argument Tables leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why inform
. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.303691 - https://vuldb.com/?ctiid.303691 - https://vuldb.com/?submit.545374 - https://github.com/mapl3miss/Vul/blob/main/Vul.md
CVE ID: CVE-2025-3414 State: PUBLISHED Published: 2025-08-14T06:00:02.316Z Last Updated: 2025-08-14T14:50:06.299Z Vendors: Unknown Products: Structured Content (JSON-LD) #wpsc Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Structured Content (JSON-LD) #wpsc WordPress plugin before 1.7.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1dd322b5-3c1d-4da7-8737-e6688fc9f4df/
CVE ID: CVE-2025-3415 State: PUBLISHED Published: 2025-07-17T10:13:14.717Z Last Updated: 2025-07-17T14:05:19.284Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Grafana Products: Grafana Problem Types: CWE-200 Description: Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://grafana.com/sec
urity-01 and 12.0.1+security-01 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://grafana.com/security/security-advisories/cve-2025-3415
CVE ID: CVE-2025-3416 State: PUBLISHED Published: 2025-04-08T18:24:22.102Z Last Updated: 2025-11-15T04:21:16.475Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Directory Server 11, Red Hat Directory Server 12, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Red Hat Trusted Artifact Signer, Red Hat Trusted Profile Analyzer Problem Types: CWE-416 Description: A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, wh
s handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-3416 - https://bugzilla.redhat.com/show_bug.cgi?id=2357560 - https://github.com/sfackler/rust-openssl - https://github.com/sfackler/rust-openssl/commit/87085bd67896b7f92e6de35d081f607a334beae4 - https://github.com/sfackler/rust-openssl/pull/2390 - https://rustsec.org/advisories/RUSTSEC-2025-0022.html
CVE ID: CVE-2025-3417 State: PUBLISHED Published: 2025-04-10T07:02:41.154Z Last Updated: 2025-04-10T14:00:46.653Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: stringfold Products: Embedder Problem Types: CWE-862 Description: The Embedder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajax_set_global_option() function in versions 1.3 to 1.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to admi
pdate arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fa86bcb9-e558-4b60-9473-65cd6f9663fd?source=cve - https://plugins.trac.wordpress.org/browser/embedder/trunk/emb-admin-ajax.php#L41
CVE ID: CVE-2025-3418 State: PUBLISHED Published: 2025-04-12T06:37:17.333Z Last Updated: 2025-04-14T16:24:32.115Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpclever Products: WPC Admin Columns Problem Types: CWE-269 Description: The WPC Admin Columns plugin for WordPress is vulnerable to privilege escalation in versions 2.0.6 to 2.1.0. This is due to the plugin not properly restricting user meta values that can be updated through the ajax_edit_save() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to that of an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
ess and above, to update their role to that of an administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6145e2d7-c917-4814-a13e-6d34088cb784?source=cve - https://plugins.trac.wordpress.org/changeset/3269302/wpc-admin-columns/trunk/includes/class-backend.php
CVE ID: CVE-2025-3419 State: PUBLISHED Published: 2025-05-08T05:22:51.039Z Last Updated: 2025-05-08T14:12:20.919Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: themewinter Products: Event Manager, Events Calendar, Tickets, Registrations – Eventin Problem Types: CWE-73 Description: The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 4.0.26 via the proxy_image() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CIS
the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1479071c-85c3-41fd-8ad7-f0dee32f201b?source=cve - https://plugins.trac.wordpress.org/changeset/3284545/wp-event-solution/trunk/core/Admin/Hooks.php
CVE ID: CVE-2025-3421 State: PUBLISHED Published: 2025-04-11T12:42:24.777Z Last Updated: 2025-04-11T13:16:51.408Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wpeverest Products: Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress Problem Types: CWE-79 Description: The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'form_id' parameter in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje
due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d55737a5-8aa5-4c26-bbb5-bbc5ea8be8d1?source=cve - https://plugins.trac.wordpress.org/changeset/3268742/
CVE ID: CVE-2025-3422 State: PUBLISHED Published: 2025-04-11T12:42:24.394Z Last Updated: 2025-04-11T13:17:46.777Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: wpeverest Products: Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress Problem Types: CWE-94 Description: The The Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.1.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes
are allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3db1d9a0-ea68-4979-a36d-864c649f7aca?source=cve - https://plugins.trac.wordpress.org/changeset/3268742/
CVE ID: CVE-2025-3423 State: PUBLISHED Published: 2025-04-13T11:56:15.398Z Last Updated: 2025-09-01T10:15:36.536Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Aspera Faspex Problem Types: CWE-79 Description: IBM Aspera Faspex 5.0.0 through 5.0.11 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7230757
CVE ID: CVE-2025-3424 State: PUBLISHED Published: 2025-04-07T15:36:46.060Z Last Updated: 2025-04-10T15:42:10.381Z Vendors: Philips Products: IntelliSpace Portal Problem Types: CWE-22 Description: The IntelliSpace portal application utilizes .NET Remoting for its functionality. The vulnerability arises from the exploitation of port 755 through the "Object Marshalling" technique, which allows an attacker to read internal files without any authentication. This is possible by crafting specific .NET Remoting URLs derived from information enumerated in the client-side configuration files. This issue affects IntelliSpace Portal: 12 and prior. Additional Analyst Notes: - CISA ADP Vulnrichment: Refer
on files. This issue affects IntelliSpace Portal: 12 and prior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cve.org/CVERecord?id=CVE-2025-3424 - https://www.philips.com/a-w/security/security-advisories.html#security_advisories
CVE ID: CVE-2025-3425 State: PUBLISHED Published: 2025-04-07T16:05:46.457Z Last Updated: 2025-04-10T15:41:29.106Z Vendors: Philips Products: IntelliSpace Portal Problem Types: CWE-502 Description: The IntelliSpace portal application utilizes .NET Remoting for its functionality. The vulnerability arises from the exploitation of port 755 through the deserialization vulnerability. After analyzing the configuration files, we observed that the server had set the TypeFilterLevel to Full which is dangerous as it can potentially lead to remote code execution using deserialization. This issue affects IntelliSpace Portal: 12 and prior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
This issue affects IntelliSpace Portal: 12 and prior. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cve.org/CVERecord?id=CVE-2025-3425 - https://www.philips.com/a-w/security/security-advisories.html#security_advisories
CVE ID: CVE-2025-3426 State: PUBLISHED Published: 2025-04-07T16:23:00.325Z Last Updated: 2025-04-10T15:40:20.578Z Vendors: Philips Products: IntelliSpace Portal, Advanced Visualization Workspace Problem Types: CWE-798 Description: We observed that Intellispace Portal binaries doesn’t have any protection mechanisms to prevent reverse engineering. Specifically, the app’s code is not obfuscated, and no measures are in place to protect against decompilation, disassembly, or debugging. As a result, attackers can reverse-engineer the application to gain insights into its internal workings, which can potentially lead to the discovery of sensitive information, business logic flaws, and other vulnera
workings, which can potentially lead to the discovery of sensitive information, business logic flaws, and other vulnerabilities. Utilizing this flaw, the attacker was able to identify the Hardcoded credentials from PortalUsersDatabase.dll, which contains .NET remoting definition. Inside the namespace PortalUsersDatabase, the class Users contains the functions CreateAdmin and CreateService that are used to initialize accounts in the Portal service. Both CreateAdmin and CreateService functions contain a hardcoded encrypted password along with its respective salt that are set with the function SetInitialPasswordAndSalt. This issue affects IntelliSpace Portal: 12 and prior; Advanced Visualizati
with the function SetInitialPasswordAndSalt. This issue affects IntelliSpace Portal: 12 and prior; Advanced Visualization Workspace: 15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cve.org/CVERecord?id=CVE-2025-3426 - https://www.philips.com/a-w/security/security-advisories.html#security_advisories
CVE ID: CVE-2025-3427 State: PUBLISHED Published: 2025-04-08T07:01:01.247Z Last Updated: 2025-04-08T15:59:23.834Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: fuzzoid Products: 3DPrint Lite Problem Types: CWE-89 Description: The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'infill_text' parameter in all versions up to, and including, 2.1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information fro
ers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/156945e1-80dc-4fb4-958f-bb87722e96fb?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3249784%403dprint-lite&new=3249784%403dprint-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2025-3428 State: PUBLISHED Published: 2025-04-08T07:01:03.563Z Last Updated: 2025-04-08T14:17:01.378Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: fuzzoid Products: 3DPrint Lite Problem Types: CWE-89 Description: The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'coating_text' parameter in all versions up to, and including, 2.1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information fr
kers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/eaac2a61-7be6-4936-82a0-21c3665fa436?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3249784%403dprint-lite&new=3249784%403dprint-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2025-3429 State: PUBLISHED Published: 2025-04-08T07:01:01.984Z Last Updated: 2025-04-08T15:59:14.585Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: fuzzoid Products: 3DPrint Lite Problem Types: CWE-89 Description: The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'material_text' parameter in all versions up to, and including, 2.1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information f
ckers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3cf26716-70b6-4e5e-9ac1-764060be2215?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3249784%403dprint-lite&new=3249784%403dprint-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2025-3430 State: PUBLISHED Published: 2025-04-08T07:01:02.412Z Last Updated: 2025-04-08T15:59:04.129Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: fuzzoid Products: 3DPrint Lite Problem Types: CWE-89 Description: The 3DPrint Lite plugin for WordPress is vulnerable to SQL Injection via the 'printer_text' parameter in all versions up to, and including, 2.1.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information fr
kers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/718f5cf2-ca83-4981-9123-4360d043a32d?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3249784%403dprint-lite&new=3249784%403dprint-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2025-3431 State: PUBLISHED Published: 2025-04-08T07:29:43.985Z Last Updated: 2025-04-08T14:50:11.584Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ZoomIt Products: ZoomSounds - WordPress Wave Audio Player with Playlist Problem Types: CWE-73 Description: The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.91 via the 'dzsap_download' action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a78998da-1cb1-4991-95a8-a551bde04064?source=cve - https://codecanyon.net/item/zoomsounds-wordpress-wave-audio-player-with-playlist/6181433
CVE ID: CVE-2025-3432 State: PUBLISHED Published: 2025-04-08T08:22:08.355Z Last Updated: 2025-04-08T13:19:32.767Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: elpix Products: AAWP Obfuscator Problem Types: CWE-79 Description: The AAWP Obfuscator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-aawp-web' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes:
ct arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/26b1b899-37a2-44fd-b961-5e6175e0417f?source=cve - https://wordpress.org/plugins/aawp-obfuscator/
CVE ID: CVE-2025-3433 State: PUBLISHED Published: 2025-04-08T08:22:08.994Z Last Updated: 2025-04-08T13:14:40.048Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: smartdevth Products: Advanced Advertising System Problem Types: CWE-601 Description: The Advanced Advertising System plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.3.1. This is due to insufficient validation on the redirect url supplied via the 'redir' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. Additional Analyst Notes: - CI
otentially malicious sites if they can successfully trick them into performing an action. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/72a56589-9dc0-47a7-bb68-e31f84a639ee?source=cve - https://plugins.trac.wordpress.org/browser/advanced-advertising-system/trunk/shortcode.php#L165
CVE ID: CVE-2025-3434 State: PUBLISHED Published: 2025-04-11T08:21:31.899Z Last Updated: 2025-04-11T13:54:30.166Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: yaycommerce Products: SMTP for Amazon SES – YaySMTP Problem Types: CWE-79 Description: The SMTP for Amazon SES – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichme