Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-23915 State: PUBLISHED Published: 2025-01-16T20:07:53.345Z Last Updated: 2025-01-17T18:57:44.271Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Roninwp Products: FAT Event Lite Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Roninwp FAT Event Lite allows PHP Local File Inclusion.This issue affects FAT Event Lite: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/fat-event-lite/vulnerability/wordpress-fat-event-lite-plugin-1-1-authenticated-non-arbitra
com/database/wordpress/plugin/fat-event-lite/vulnerability/wordpress-fat-event-lite-plugin-1-1-authenticated-non-arbitrary-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-23916 State: PUBLISHED Published: 2025-01-16T20:07:52.090Z Last Updated: 2025-01-17T18:58:04.005Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Nuanced Media Products: WP Meetup Problem Types: CWE-862 Description: Missing Authorization vulnerability in Nuanced Media WP Meetup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Meetup: from n/a through 2.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-meetup/vulnerability/wordpress-wp-meetup-plugin-2-3-0-settings-change-vulnerability?_s_id=cve
CVE ID: CVE-2025-23917 State: PUBLISHED Published: 2025-01-16T20:07:57.607Z Last Updated: 2025-01-17T18:56:53.902Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Chandrika Guntur, Morgan Kay Products: Chamber Dashboard Business Directory Problem Types: CWE-862 Description: Missing Authorization vulnerability in Chandrika Guntur, Morgan Kay Chamber Dashboard Business Directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chamber Dashboard Business Directory: from n/a through 3.3.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/chamber-dashboard-b
alyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/chamber-dashboard-business-directory/vulnerability/wordpress-chamber-dashboard-business-directory-plugin-3-3-8-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-23918 State: PUBLISHED Published: 2025-01-22T14:29:23.318Z Last Updated: 2025-01-22T19:45:07.113Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: NotFound Products: Smallerik File Browser Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in NotFound Smallerik File Browser allows Upload a Web Shell to a Web Server. This issue affects Smallerik File Browser: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/smallerik-file-browser/vulnerability/wordpress-smallerik-file-browser-plugin-1-1-arbitrary-file-upload-v
ordpress/plugin/smallerik-file-browser/vulnerability/wordpress-smallerik-file-browser-plugin-1-1-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-23919 State: PUBLISHED Published: 2025-01-16T20:07:51.476Z Last Updated: 2025-01-17T18:58:11.428Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Ella van Durpe Products: Slides & Presentations Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Ella van Durpe Slides & Presentations allows Code Injection.This issue affects Slides & Presentations: from n/a through 0.0.39. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/slide/vulnerability/wordpress-slides-presentations-plugin-0-0-39-content-injection-
hstack.com/database/wordpress/plugin/slide/vulnerability/wordpress-slides-presentations-plugin-0-0-39-content-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-23920 State: PUBLISHED Published: 2025-02-03T14:22:45.384Z Last Updated: 2025-02-03T16:57:36.532Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: ApplicantPro Products: ApplicantPro Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ApplicantPro ApplicantPro allows Reflected XSS. This issue affects ApplicantPro: from n/a through 1.3.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/applicantpro/vulnerability/wordpress-applicantpro-plugin-1-3-9-reflected-cross-site-scripting-xss-vulnerability?_
plugin/applicantpro/vulnerability/wordpress-applicantpro-plugin-1-3-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23921 State: PUBLISHED Published: 2025-01-22T14:29:23.541Z Last Updated: 2025-01-22T21:31:48.736Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: NotFound Products: Multi Uploader for Gravity Forms Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in NotFound Multi Uploader for Gravity Forms allows Upload a Web Shell to a Web Server. This issue affects Multi Uploader for Gravity Forms: from n/a through 1.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gf-multi-uploader/vulnerability/wordpress-multi-uploader-for-gravity-forms
ps://patchstack.com/database/wordpress/plugin/gf-multi-uploader/vulnerability/wordpress-multi-uploader-for-gravity-forms-plugin-1-1-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-23922 State: PUBLISHED Published: 2025-01-16T20:07:54.096Z Last Updated: 2025-01-17T18:57:37.311Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Harsh Products: iSpring Embedder Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Harsh iSpring Embedder allows Upload a Web Shell to a Web Server.This issue affects iSpring Embedder: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/embed-ispring/vulnerability/wordpress-ispring-embedder-plugin-1-0-csrf-to-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-23923 State: PUBLISHED Published: 2025-02-03T14:22:45.552Z Last Updated: 2025-02-03T16:32:24.839Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Lockets Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Lockets allows Reflected XSS. This issue affects Lockets: from n/a through 0.999. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lockets/vulnerability/wordpress-lockets-plugin-0-999-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23924 State: PUBLISHED Published: 2025-01-16T20:08:00.233Z Last Updated: 2025-01-17T18:56:20.977Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Jérémy Heleine Products: WP Photo Sphere Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jérémy Heleine WP Photo Sphere allows Stored XSS.This issue affects WP Photo Sphere: from n/a through 3.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-photo-sphere/vulnerability/wordpress-wp-photo-sphere-plugin-3-8-cross-site-scripting-xss-vulnerabilit
ordpress/plugin/wp-photo-sphere/vulnerability/wordpress-wp-photo-sphere-plugin-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23925 State: PUBLISHED Published: 2025-01-16T20:07:56.941Z Last Updated: 2025-01-17T18:56:59.202Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Jimmy Peña Products: Feedburner Optin Form Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jimmy Peña Feedburner Optin Form allows Stored XSS.This issue affects Feedburner Optin Form: from n/a through 0.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/feedburner-optin-form/vulnerability/wordpress-feedburner-optin-form-plugin-0-2-8-stored-cros
m/database/wordpress/plugin/feedburner-optin-form/vulnerability/wordpress-feedburner-optin-form-plugin-0-2-8-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23926 State: PUBLISHED Published: 2025-01-16T20:07:52.727Z Last Updated: 2025-01-17T18:57:52.905Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: TC Products: Ajax WP Query Search Filter Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TC Ajax WP Query Search Filter allows Stored XSS.This issue affects Ajax WP Query Search Filter: from n/a through 1.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ajax-wp-query-search-filter/vulnerability/wordpress-ajax-wp-query-search-filter-plugin-1-0
com/database/wordpress/plugin/ajax-wp-query-search-filter/vulnerability/wordpress-ajax-wp-query-search-filter-plugin-1-0-7-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23927 State: PUBLISHED Published: 2025-01-16T20:07:55.719Z Last Updated: 2025-01-17T18:57:14.272Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Massimo Serpilli Products: Incredible Font Awesome Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Massimo Serpilli Incredible Font Awesome allows Stored XSS.This issue affects Incredible Font Awesome: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/incredible-font-awesome/vulnerability/wordpress-incredible-font-awesome-plug
://patchstack.com/database/wordpress/plugin/incredible-font-awesome/vulnerability/wordpress-incredible-font-awesome-plugin-1-0-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23928 State: PUBLISHED Published: 2025-01-16T20:08:00.878Z Last Updated: 2025-01-17T18:56:12.761Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Aleksandar Arsovski Products: Google Org Chart Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aleksandar Arsovski Google Org Chart allows Stored XSS.This issue affects Google Org Chart: from n/a through 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/google-org-chart/vulnerability/wordpress-google-org-chart-plugin-1-0-1-cross-site-scripti
.com/database/wordpress/plugin/google-org-chart/vulnerability/wordpress-google-org-chart-plugin-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23929 State: PUBLISHED Published: 2025-01-16T20:07:54.774Z Last Updated: 2025-01-17T18:57:26.364Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wishfulthemes Products: Email Capture & Lead Generation Problem Types: CWE-862 Description: Missing Authorization vulnerability in wishfulthemes Email Capture & Lead Generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Email Capture & Lead Generation: from n/a through 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/email-capture-lead-generation/vulnerability/wordpress-email-capt
ces: - https://patchstack.com/database/wordpress/plugin/email-capture-lead-generation/vulnerability/wordpress-email-capture-lead-generation-plugin-1-0-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-23930 State: PUBLISHED Published: 2025-01-16T20:07:58.272Z Last Updated: 2025-01-17T18:56:45.817Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: iTechArt-Group Products: PayPal Marketing Solutions Problem Types: CWE-862 Description: Missing Authorization vulnerability in iTechArt-Group PayPal Marketing Solutions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayPal Marketing Solutions: from n/a through 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/paypal-promotions-and-insights/vulnerability/wordpress-paypal-marketing-solutio
patchstack.com/database/wordpress/plugin/paypal-promotions-and-insights/vulnerability/wordpress-paypal-marketing-solutions-plugin-1-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-23931 State: PUBLISHED Published: 2025-01-22T14:29:23.719Z Last Updated: 2025-01-22T19:43:04.300Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: NotFound Products: WordPress Local SEO Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound WordPress Local SEO allows Blind SQL Injection. This issue affects WordPress Local SEO: from n/a through 2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/dh-local-seo/vulnerability/wordpress-wordpress-local-seo-plugin-2-3-sql-injection-vulnerabil
m/database/wordpress/plugin/dh-local-seo/vulnerability/wordpress-wordpress-local-seo-plugin-2-3-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-23932 State: PUBLISHED Published: 2025-01-22T14:29:23.867Z Last Updated: 2025-01-22T19:39:20.983Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NotFound Products: Quick Count Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in NotFound Quick Count allows Object Injection. This issue affects Quick Count: from n/a through 3.00. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/quick-count/vulnerability/wordpress-quick-count-plugin-3-00-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-23933 State: PUBLISHED Published: 2025-01-16T20:07:58.900Z Last Updated: 2025-01-17T18:56:35.883Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WpFreeware Products: WpF Ultimate Carousel Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpFreeware WpF Ultimate Carousel allows Stored XSS.This issue affects WpF Ultimate Carousel: from n/a through 1.0.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpf-ultimate-carousel/vulnerability/wordpress-wpf-ultimate-carousel-plugin-1-0-11-stored-cr
om/database/wordpress/plugin/wpf-ultimate-carousel/vulnerability/wordpress-wpf-ultimate-carousel-plugin-1-0-11-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23934 State: PUBLISHED Published: 2025-01-16T20:08:03.422Z Last Updated: 2025-01-17T21:08:44.554Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: PromoSimple Products: Giveaways and Contests by PromoSimple Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PromoSimple Giveaways and Contests by PromoSimple allows Stored XSS.This issue affects Giveaways and Contests by PromoSimple: from n/a through 1.24. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/giveaways-contests-by-promosimple/vulnerabi
Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/giveaways-contests-by-promosimple/vulnerability/wordpress-giveaways-and-contests-by-promosimple-plugin-1-24-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23935 State: PUBLISHED Published: 2025-01-16T20:07:59.561Z Last Updated: 2025-01-27T09:34:50.069Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Magic Plugin Factory Products: Magic Google Maps Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magic Plugin Factory Magic Google Maps allows Stored XSS. This issue affects Magic Google Maps: from n/a through 1.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/magic-google-maps/vulnerability/wordpress-magic-google-maps-plugin-1-0-4-cross-site
hstack.com/database/wordpress/plugin/magic-google-maps/vulnerability/wordpress-magic-google-maps-plugin-1-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23936 State: PUBLISHED Published: 2025-01-16T20:07:56.338Z Last Updated: 2025-01-17T18:57:07.507Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Harun R. Rayhan (Cr@zy Coder) Products: CC Circle Progress Bar Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harun R. Rayhan (Cr@zy Coder) CC Circle Progress Bar allows Stored XSS.This issue affects CC Circle Progress Bar: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cc-circle-progress-bar/vulnerability/wordpress-cc-c
ment: References: - https://patchstack.com/database/wordpress/plugin/cc-circle-progress-bar/vulnerability/wordpress-cc-circle-progress-bar-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23937 State: PUBLISHED Published: 2025-03-26T14:24:16.843Z Last Updated: 2025-03-26T15:32:13.252Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NotFound Products: LinkedIn Lite Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NotFound LinkedIn Lite allows PHP Local File Inclusion. This issue affects LinkedIn Lite: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/linkedin-lite/vulnerability/wordpress-linkedin-lite-plugin-1-0-local-file-inclusion-vulner
com/database/wordpress/plugin/linkedin-lite/vulnerability/wordpress-linkedin-lite-plugin-1-0-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-23938 State: PUBLISHED Published: 2025-01-22T14:29:24.027Z Last Updated: 2025-01-22T19:36:02.518Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NotFound Products: Image Gallery Box by CRUDLab Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NotFound Image Gallery Box by CRUDLab allows PHP Local File Inclusion. This issue affects Image Gallery Box by CRUDLab: from n/a through 1.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/image-gallery-box-by-crudlab/vulnerability/
Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/image-gallery-box-by-crudlab/vulnerability/wordpress-image-gallery-box-by-crudlab-plugin-1-0-3-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-23939 State: PUBLISHED Published: 2025-01-16T20:08:08.026Z Last Updated: 2025-01-17T20:26:05.954Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Saiem Khan Products: Image Switcher Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiem Khan Image Switcher allows Stored XSS.This issue affects Image Switcher: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/image-switcher/vulnerability/wordpress-image-switcher-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23940 State: PUBLISHED Published: 2025-01-16T20:08:01.513Z Last Updated: 2025-01-17T21:12:11.939Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Saiem Khan Products: Image Switcher Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiem Khan Image Switcher allows Stored XSS.This issue affects Image Switcher: from n/a through 0.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/image-switcher/vulnerability/wordpress-jupdf-pdf-viewer-plugin-0-1-1-cross-site-scripting-xss-vulnerability?_s_id
plugin/image-switcher/vulnerability/wordpress-jupdf-pdf-viewer-plugin-0-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23941 State: PUBLISHED Published: 2025-01-16T20:08:05.397Z Last Updated: 2025-01-17T20:31:06.564Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Meinturnierplan.de Team Products: MeinTurnierplan.de Widget Viewer Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meinturnierplan.de Team MeinTurnierplan.de Widget Viewer allows Stored XSS.This issue affects MeinTurnierplan.de Widget Viewer: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/meinturnierplande-widget-viewer/vul
ISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/meinturnierplande-widget-viewer/vulnerability/wordpress-meinturnierplan-de-widget-viewer-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-23942 State: PUBLISHED Published: 2025-01-22T14:29:24.172Z Last Updated: 2025-01-22T19:33:33.763Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: NgocCode Products: WP Load Gallery Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in NgocCode WP Load Gallery allows Upload a Web Shell to a Web Server. This issue affects WP Load Gallery: from n/a through 2.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-load-gallery/vulnerability/wordpress-wp-load-gallery-plugin-2-1-6-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-23943 State: PUBLISHED Published: 2025-01-16T20:08:06.661Z Last Updated: 2025-01-17T20:28:48.373Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: arul Products: PDF.js Shortcode Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arul PDF.js Shortcode allows Stored XSS.This issue affects PDF.js Shortcode: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/pdfjs-shortcode/vulnerability/wordpress-pdf-js-shortcode-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve