Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-60122 State: PUBLISHED Published: 2025-09-26T08:31:37.615Z Last Updated: 2025-09-26T13:11:33.504Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: HivePress Products: HivePress Claim Listings Problem Types: CWE-862 Description: Missing Authorization vulnerability in HivePress HivePress Claim Listings allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HivePress Claim Listings: from n/a through 1.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/hivepress-claim-listings/vulnerability/wordpress-hivepress-claim-listings-plugin-1-1-3-broke
m/database/wordpress/plugin/hivepress-claim-listings/vulnerability/wordpress-hivepress-claim-listings-plugin-1-1-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-60123 State: PUBLISHED Published: 2025-09-26T08:31:38.284Z Last Updated: 2025-09-26T13:11:09.869Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: HivePress Products: HivePress Claim Listings Problem Types: CWE-862 Description: Missing Authorization vulnerability in HivePress HivePress Claim Listings allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HivePress Claim Listings: from n/a through 1.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/hivepress-claim-listings/vulnerability/wordpress-hivepress-claim-listings-plugin-1-1-3-broke
m/database/wordpress/plugin/hivepress-claim-listings/vulnerability/wordpress-hivepress-claim-listings-plugin-1-1-3-broken-access-control-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-60124 State: PUBLISHED Published: 2025-09-26T08:31:38.894Z Last Updated: 2025-09-26T13:10:43.819Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Ryan Hellyer Products: Simple Colorbox Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Hellyer Simple Colorbox allows Stored XSS. This issue affects Simple Colorbox: from n/a through 1.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-colorbox/vulnerability/wordpress-simple-colorbox-plugin-1-6-1-cross-site-scripting-xss-vulnerabili
rdpress/plugin/simple-colorbox/vulnerability/wordpress-simple-colorbox-plugin-1-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-60125 State: PUBLISHED Published: 2025-09-26T08:31:39.629Z Last Updated: 2025-09-26T13:10:10.272Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: themelooks Products: FoodBook Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in themelooks FoodBook allows Retrieve Embedded Sensitive Data. This issue affects FoodBook: from n/a through 4.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/foodbook/vulnerability/wordpress-foodbook-plugin-4-7-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-60126 State: PUBLISHED Published: 2025-09-26T08:31:40.209Z Last Updated: 2025-09-26T13:09:29.707Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PluginOps Products: Testimonial Slider Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PluginOps Testimonial Slider allows PHP Local File Inclusion. This issue affects Testimonial Slider: from n/a through 3.5.8.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/testimonial-add/vulnerability/wordpress-testimonial-slider-plugin-3-5
- https://patchstack.com/database/wordpress/plugin/testimonial-add/vulnerability/wordpress-testimonial-slider-plugin-3-5-8-6-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-60127 State: PUBLISHED Published: 2025-09-26T08:31:40.810Z Last Updated: 2025-09-26T15:00:39.626Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: ArtistScope Products: CopySafe Web Protection Problem Types: CWE-862 Description: Missing Authorization vulnerability in ArtistScope CopySafe Web Protection allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CopySafe Web Protection: from n/a through 4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-copysafe-web/vulnerability/wordpress-copysafe-web-protection-plugin-4-3-broken-access-cont
/database/wordpress/plugin/wp-copysafe-web/vulnerability/wordpress-copysafe-web-protection-plugin-4-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-60128 State: PUBLISHED Published: 2025-09-26T08:31:41.384Z Last Updated: 2025-09-26T14:54:40.615Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: WP Delicious Products: Delisho Problem Types: CWE-862 Description: Missing Authorization vulnerability in WP Delicious Delisho allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Delisho: from n/a through 1.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/dr-widgets-blocks/vulnerability/wordpress-delisho-plugin-1-1-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-60129 State: PUBLISHED Published: 2025-09-26T08:31:42.001Z Last Updated: 2025-09-26T14:54:07.622Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Yext Products: Yext Problem Types: CWE-862 Description: Missing Authorization vulnerability in Yext Yext allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Yext: from n/a through 1.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/yext/vulnerability/wordpress-yext-plugin-1-1-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-60130 State: PUBLISHED Published: 2025-09-26T08:31:42.595Z Last Updated: 2025-09-26T16:54:54.737Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: wedos.com Products: WEDOS Global Problem Types: CWE-862 Description: Missing Authorization vulnerability in wedos.com WEDOS Global allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WEDOS Global: from n/a through 1.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wgpwpp/vulnerability/wordpress-wedos-global-plugin-1-2-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-60131 State: PUBLISHED Published: 2025-10-22T14:32:40.297Z Last Updated: 2025-11-13T10:33:44.664Z Vendors: Zoefff Products: Werk aan de Muur Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoefff Werk aan de Muur werk-aan-de-muur allows Stored XSS.This issue affects Werk aan de Muur: from n/a through <= 1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/werk-aan-de-muur/vulnerability/wordpress-werk-aan-de-muur-plugin-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-60132 State: PUBLISHED Published: 2025-10-22T14:32:40.543Z Last Updated: 2025-11-13T10:33:44.484Z Vendors: johnh10 Products: Video Blogster Lite Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in johnh10 Video Blogster Lite video-blogster-lite allows Stored XSS.This issue affects Video Blogster Lite: from n/a through <= 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/video-blogster-lite/vulnerability/wordpress-video-blogster-lite-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-60133 State: PUBLISHED Published: 2025-09-26T08:31:43.196Z Last Updated: 2025-09-26T16:54:12.139Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: DJ-Extensions.com Products: PE Easy Slider Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DJ-Extensions.com PE Easy Slider allows Stored XSS. This issue affects PE Easy Slider: from n/a through 1.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/pe-easy-slider/vulnerability/wordpress-pe-easy-slider-plugin-1-1-0-cross-site-scripting-xss-vulner
base/wordpress/plugin/pe-easy-slider/vulnerability/wordpress-pe-easy-slider-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-60134 State: PUBLISHED Published: 2025-10-22T14:32:41.146Z Last Updated: 2025-11-13T10:33:43.707Z Vendors: John James Jacoby Products: WP Media Categories Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in John James Jacoby WP Media Categories wp-media-categories allows Cross Site Request Forgery.This issue affects WP Media Categories: from n/a through <= 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wp-media-categories/vulnerability/wordpress-wp-media-categories-plugin-2-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-60135 State: PUBLISHED Published: 2025-10-22T14:32:41.610Z Last Updated: 2025-11-13T10:33:43.830Z Vendors: NIKITAS GEORGOPOULOS Products: WeShare Buttons Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NIKITAS GEORGOPOULOS WeShare Buttons e-mailit allows Stored XSS.This issue affects WeShare Buttons: from n/a through <= 13.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/e-mailit/vulnerability/wordpress-weshare-buttons-plugin-13-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-60136 State: PUBLISHED Published: 2025-09-26T08:31:43.773Z Last Updated: 2025-09-26T16:53:49.426Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: cartpauj Products: User Notes Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cartpauj User Notes allows Stored XSS. This issue affects User Notes: from n/a through 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/user-notes/vulnerability/wordpress-user-notes-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-60137 State: PUBLISHED Published: 2025-09-26T08:31:44.401Z Last Updated: 2025-09-26T16:49:57.477Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Galaxy Weblinks Products: Post Featured Video Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Galaxy Weblinks Post Featured Video allows Cross Site Request Forgery. This issue affects Post Featured Video: from n/a through 1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/post-featured-video/vulnerability/wordpress-post-featured-video-plugin-1-7-cross-site-request-forgery-csrf-vulnerability?_s
t-featured-video/vulnerability/wordpress-post-featured-video-plugin-1-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-60138 State: PUBLISHED Published: 2025-09-26T08:31:45.070Z Last Updated: 2025-09-26T16:48:54.943Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: sonalsinha21 Products: SKT Blocks Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks allows Stored XSS. This issue affects SKT Blocks: from n/a through 2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/skt-blocks/vulnerability/wordpress-skt-blocks-plugin-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-60139 State: PUBLISHED Published: 2025-09-26T08:31:45.706Z Last Updated: 2025-09-26T16:59:16.541Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Joovii Products: Sendle Shipping Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Joovii Sendle Shipping allows Cross Site Request Forgery. This issue affects Sendle Shipping: from n/a through 6.02. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/official-sendle-shipping-method/vulnerability/wordpress-sendle-shipping-plugin-6-02-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-60140 State: PUBLISHED Published: 2025-09-26T08:31:46.345Z Last Updated: 2025-09-26T16:58:34.089Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: thetechtribe Products: The Tribal Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in thetechtribe The Tribal allows Retrieve Embedded Sensitive Data. This issue affects The Tribal: from n/a through 1.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/the-tech-tribe/vulnerability/wordpress-the-tribal-plugin-1-3-3-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-60141 State: PUBLISHED Published: 2025-09-26T08:31:46.991Z Last Updated: 2025-09-26T13:09:02.626Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: thetechtribe Products: The Tribal Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thetechtribe The Tribal allows Stored XSS. This issue affects The Tribal: from n/a through 1.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/the-tech-tribe/vulnerability/wordpress-the-tribal-plugin-1-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-60142 State: PUBLISHED Published: 2025-09-26T08:31:47.588Z Last Updated: 2025-09-26T13:08:32.177Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: DaganLev Products: Simple Meta Tags Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DaganLev Simple Meta Tags allows DOM-Based XSS. This issue affects Simple Meta Tags: from n/a through 1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-meta-tags/vulnerability/wordpress-simple-meta-tags-plugin-1-5-cross-site-scripting-xss-vulnerability?_
ess/plugin/simple-meta-tags/vulnerability/wordpress-simple-meta-tags-plugin-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-60143 State: PUBLISHED Published: 2025-09-26T08:31:48.179Z Last Updated: 2025-09-26T16:58:04.964Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: netgsm Products: Netgsm Problem Types: CWE-862 Description: Missing Authorization vulnerability in netgsm Netgsm allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Netgsm: from n/a through 2.9.58. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/netgsm/vulnerability/wordpress-netgsm-plugin-2-9-58-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-60144 State: PUBLISHED Published: 2025-09-26T08:31:48.760Z Last Updated: 2025-09-26T14:51:57.000Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: yonifre Products: Lenix scss compiler Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonifre Lenix scss compiler allows Stored XSS. This issue affects Lenix scss compiler: from n/a through 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lenix-scss-compiler/vulnerability/wordpress-lenix-scss-compiler-plugin-1-2-cross-site-scripting-xss-vulne
rdpress/plugin/lenix-scss-compiler/vulnerability/wordpress-lenix-scss-compiler-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-60145 State: PUBLISHED Published: 2025-09-26T08:31:49.379Z Last Updated: 2025-09-26T14:47:24.190Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: yonifre Products: Lenix scss compiler Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in yonifre Lenix scss compiler allows Cross Site Request Forgery. This issue affects Lenix scss compiler: from n/a through 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lenix-scss-compiler/vulnerability/wordpress-lenix-scss-compiler-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-60146 State: PUBLISHED Published: 2025-09-26T08:31:50.016Z Last Updated: 2025-09-26T14:41:22.380Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Amit Verma Products: Map Categories to Pages Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amit Verma Map Categories to Pages allows Stored XSS. This issue affects Map Categories to Pages: from n/a through 1.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/map-categories-to-pages/vulnerability/wordpress-map-categories-to-pages-plugin-1-3-2-
tack.com/database/wordpress/plugin/map-categories-to-pages/vulnerability/wordpress-map-categories-to-pages-plugin-1-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-60147 State: PUBLISHED Published: 2025-09-26T08:31:50.655Z Last Updated: 2025-09-26T14:33:17.828Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: HT Plugins Products: HT Feed Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Feed allows Stored XSS. This issue affects HT Feed: from n/a through 1.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ht-instagram/vulnerability/wordpress-ht-feed-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-60148 State: PUBLISHED Published: 2025-09-26T08:31:51.384Z Last Updated: 2025-09-26T13:07:51.403Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpshuffle Products: Subscribe to Download Problem Types: CWE-862 Description: Missing Authorization vulnerability in wpshuffle Subscribe to Download allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Subscribe to Download: from n/a through 2.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/subscribe-to-download/vulnerability/wordpress-subscribe-to-download-plugin-2-0-9-broken-access-contro
e/wordpress/plugin/subscribe-to-download/vulnerability/wordpress-subscribe-to-download-plugin-2-0-9-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-60149 State: PUBLISHED Published: 2025-09-26T08:31:52.062Z Last Updated: 2025-09-26T13:07:25.087Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Michael Ott Products: Notely Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Ott Notely allows Stored XSS. This issue affects Notely: from n/a through 1.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/notely/vulnerability/wordpress-notely-plugin-1-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-60150 State: PUBLISHED Published: 2025-09-26T08:31:52.690Z Last Updated: 2025-09-26T13:07:00.657Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpshuffle Products: Subscribe to Download Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpshuffle Subscribe to Download allows PHP Local File Inclusion. This issue affects Subscribe to Download: from n/a through 2.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/subscribe-to-download/vulnerability/wordpress-subscribe-to-dow
ences: - https://patchstack.com/database/wordpress/plugin/subscribe-to-download/vulnerability/wordpress-subscribe-to-download-plugin-2-0-9-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-60151 State: PUBLISHED Published: 2025-10-22T14:32:41.801Z Last Updated: 2025-11-13T10:33:44.724Z Vendors: CRM Perks Products: WP Gravity Forms HubSpot Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Phishing.This issue affects WP Gravity Forms HubSpot: from n/a through <= 1.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/gf-hubspot/vulnerability/wordpress-wp-gravity-forms-hubspot-plugin-1-2-5-open-redirection-vulnerability?_s_id=cve
CVE ID: CVE-2025-60152 State: PUBLISHED Published: 2025-09-26T08:31:53.335Z Last Updated: 2025-09-26T13:06:36.148Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpshuffle Products: Subscribe To Unlock Problem Types: CWE-862 Description: Missing Authorization vulnerability in wpshuffle Subscribe To Unlock allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Subscribe To Unlock: from n/a through 1.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/subscribe-to-unlock/vulnerability/wordpress-subscribe-to-unlock-plugin-1-1-5-broken-access-control-vulnerab
press/plugin/subscribe-to-unlock/vulnerability/wordpress-subscribe-to-unlock-plugin-1-1-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-60153 State: PUBLISHED Published: 2025-09-26T08:31:53.998Z Last Updated: 2025-09-26T13:06:07.903Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: wpshuffle Products: Subscribe To Unlock Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpshuffle Subscribe To Unlock allows PHP Local File Inclusion. This issue affects Subscribe To Unlock: from n/a through 1.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/subscribe-to-unlock/vulnerability/wordpress-subscribe-to-unlock-plug
- https://patchstack.com/database/wordpress/plugin/subscribe-to-unlock/vulnerability/wordpress-subscribe-to-unlock-plugin-1-1-5-local-file-inclusion-vulnerability?_s_id=cve