Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-9180 State: PUBLISHED Published: 2025-08-19T20:33:54.532Z Last Updated: 2025-11-03T18:14:12.191Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Description: Same-origin policy bypass in the Graphics: Canvas2D component. This vulnerability affects Firefox < 142, Firefox ESR < 115.27, Firefox ESR < 128.14, Firefox ESR < 140.2, Thunderbird < 142, Thunderbird < 128.14, and Thunderbird < 140.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1979782 - https://www.mozilla.org/security/advisories/mfsa2025-64/ - https://www.mozilla.org/security/advisories/mfsa2025-65/ - https://www.m
.mozilla.org/security/advisories/mfsa2025-64/ - https://www.mozilla.org/security/advisories/mfsa2025-65/ - https://www.mozilla.org/security/advisories/mfsa2025-66/ - https://www.mozilla.org/security/advisories/mfsa2025-67/ - https://www.mozilla.org/security/advisories/mfsa2025-70/ - https://www.mozilla.org/security/advisories/mfsa2025-71/ - https://www.mozilla.org/security/advisories/mfsa2025-72/
CVE ID: CVE-2025-9181 State: PUBLISHED Published: 2025-08-19T20:33:55.063Z Last Updated: 2025-11-03T18:14:14.144Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Description: Uninitialized memory in the JavaScript Engine component. This vulnerability affects Firefox < 142, Firefox ESR < 128.14, Firefox ESR < 140.2, Thunderbird < 142, Thunderbird < 128.14, and Thunderbird < 140.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1977130 - https://www.mozilla.org/security/advisories/mfsa2025-64/ - https://www.mozilla.org/security/advisories/mfsa2025-66/ - https://www.mozilla.org/security/advisori
ries/mfsa2025-64/ - https://www.mozilla.org/security/advisories/mfsa2025-66/ - https://www.mozilla.org/security/advisories/mfsa2025-67/ - https://www.mozilla.org/security/advisories/mfsa2025-70/ - https://www.mozilla.org/security/advisories/mfsa2025-71/ - https://www.mozilla.org/security/advisories/mfsa2025-72/
CVE ID: CVE-2025-9182 State: PUBLISHED Published: 2025-08-19T20:33:56.512Z Last Updated: 2025-10-30T16:10:52.097Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Description: Denial-of-service due to out-of-memory in the Graphics: WebRender component. This vulnerability affects Firefox < 142, Firefox ESR < 140.2, Thunderbird < 142, and Thunderbird < 140.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1975837 - https://www.mozilla.org/security/advisories/mfsa2025-64/ - https://www.mozilla.org/security/advisories/mfsa2025-67/ - https://www.mozilla.org/security/advisories/mfsa2025-70/ - https://www.mozilla.org/securit
ity/advisories/mfsa2025-67/ - https://www.mozilla.org/security/advisories/mfsa2025-70/ - https://www.mozilla.org/security/advisories/mfsa2025-72/
CVE ID: CVE-2025-9183 State: PUBLISHED Published: 2025-08-19T20:33:57.019Z Last Updated: 2025-10-30T16:10:56.186Z Vendors: Mozilla Products: Firefox, Firefox ESR Description: Spoofing issue in the Address Bar component. This vulnerability affects Firefox < 142 and Firefox ESR < 140.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1976102 - https://www.mozilla.org/security/advisories/mfsa2025-64/ - https://www.mozilla.org/security/advisories/mfsa2025-67/
CVE ID: CVE-2025-9184 State: PUBLISHED Published: 2025-08-19T20:33:58.037Z Last Updated: 2025-10-30T16:10:59.423Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Description: Memory safety bugs present in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 142, Firefox ESR < 140.2, Thunderbird < 142, and Thunderbird < 140.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1929482%2C1976376%2C1979163%2
es: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1929482%2C1976376%2C1979163%2C1979955 - https://www.mozilla.org/security/advisories/mfsa2025-64/ - https://www.mozilla.org/security/advisories/mfsa2025-67/ - https://www.mozilla.org/security/advisories/mfsa2025-70/ - https://www.mozilla.org/security/advisories/mfsa2025-72/
CVE ID: CVE-2025-9185 State: PUBLISHED Published: 2025-08-19T20:33:55.556Z Last Updated: 2025-11-03T18:14:16.037Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Description: Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 142, Firefox ESR < 115.27, Firefox ESR < 128.14, Firefox ESR < 140.2, Thunderbird < 142, Thunderbird < 128.14, and Thunderbird < 140.2. Additional A
irefox ESR < 128.14, Firefox ESR < 140.2, Thunderbird < 142, Thunderbird < 128.14, and Thunderbird < 140.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1970154%2C1976782%2C1977166 - https://www.mozilla.org/security/advisories/mfsa2025-64/ - https://www.mozilla.org/security/advisories/mfsa2025-65/ - https://www.mozilla.org/security/advisories/mfsa2025-66/ - https://www.mozilla.org/security/advisories/mfsa2025-67/ - https://www.mozilla.org/security/advisories/mfsa2025-70/ - https://www.mozilla.org/security/advisories/mfsa2025-71/ - https://www.mozilla.org/security/advisories/mfsa2025-72/
CVE ID: CVE-2025-9186 State: PUBLISHED Published: 2025-08-19T20:33:56.025Z Last Updated: 2025-10-30T16:11:39.561Z Vendors: Mozilla Products: Firefox Description: Spoofing issue in the Address Bar component of Firefox Focus for Android. This vulnerability affects Firefox < 142. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1445758 - https://www.mozilla.org/security/advisories/mfsa2025-64/
CVE ID: CVE-2025-9187 State: PUBLISHED Published: 2025-08-19T20:33:57.516Z Last Updated: 2025-10-30T16:11:42.414Z Vendors: Mozilla Products: Firefox, Thunderbird Description: Memory safety bugs present in Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 142 and Thunderbird < 142. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1825621%2C1970079%2C1976736%2C1979072 - https://www.mozilla.org/security/advisories/mfsa2025-64/ - https://www.mozilla.org/secu
%2C1970079%2C1976736%2C1979072 - https://www.mozilla.org/security/advisories/mfsa2025-64/ - https://www.mozilla.org/security/advisories/mfsa2025-70/
CVE ID: CVE-2025-9188 State: PUBLISHED Published: 2025-09-02T18:19:48.923Z Last Updated: 2025-09-02T19:22:31.352Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Digilent Products: DASYLab Problem Types: CWE-502 Description: There is a deserialization of untrusted data vulnerability in Digilent DASYLab. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted DSB file. The vulnerability affects all versions of DASYLab. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-softw
Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-digilent-dasylab.html
CVE ID: CVE-2025-9189 State: PUBLISHED Published: 2025-09-02T18:12:43.393Z Last Updated: 2025-09-02T19:46:46.564Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Digilent Products: DASYLab Problem Types: CWE-1285 Description: There is an out of bounds write vulnerability due to improper bounds checking resulting in a large destination address when parsing a DSB file with Digilent DASYLab. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted DSB file. The vulnerability affects all versions of DASYLab. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
The vulnerability affects all versions of DASYLab. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-digilent-dasylab.html
CVE ID: CVE-2025-9190 State: PUBLISHED Published: 2025-08-26T12:22:59.617Z Last Updated: 2025-08-26T13:58:15.556Z Vendors: Cursor Products: Cursor Problem Types: CWE-276 Description: The configuration of Cursor on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Cursor TCC (Transparency, Consent, and Control) permissions. Acquired resource access is limited to previously granted permissions by the user. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Cursor, potentially disguising attacker's malicious intent. This issue was detected in
user for approval in the name of Cursor, potentially disguising attacker's malicious intent. This issue was detected in 15.4.1 version of Cursor. Project maintainers decided not to fix this issue, because a scenario including a local attacker falls outside their defined threat model. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://afine.com/threat-of-tcc-bypasses-on-macos/#cooking-cursor-app - https://github.com/cursor/cursor - https://cert.pl/posts/2025/08/tcc-bypass/ - https://github.com/cursor/cursor/security/advisories/GHSA-xp8w-f7f4-r544
CVE ID: CVE-2025-9193 State: PUBLISHED Published: 2025-08-20T00:02:07.078Z Last Updated: 2025-08-22T12:11:21.504Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C) Vendors: TOTVS Products: Portal Meu RH Problem Types: CWE-601 Description: A flaw has been found in TOTVS Portal Meu RH up to 12.1.17. Impacted is an unknown function of the component Password Reset Handler. Executing manipulation of the argument redirectUrl can lead to open redirect. The attack may be performed from a remote location. The exploit has been published and may be used. Upgrading to version 12.1.2410.274, 12.1.2502.178 and 12.1.2506.121 is recommended to address this issue. It is recommended to upgrad
version 12.1.2410.274, 12.1.2502.178 and 12.1.2506.121 is recommended to address this issue. It is recommended to upgrade the affected component. The vendor explains, that "[o]ur internal validation (...) confirms that the reported behavior does not exist in currently supported releases. In these tests, the redirectUrl parameter is ignored, and no malicious redirection occurs." This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.320579 - https://vuldb.com/?ctiid.320579 - https://vuldb.com/?submit.636360 - https://drive.google.com/file/d/1iorjSJ8gh3hTDZUy1fHyV-TJXFP43yIo
com/?ctiid.320579 - https://vuldb.com/?submit.636360 - https://drive.google.com/file/d/1iorjSJ8gh3hTDZUy1fHyV-TJXFP43yIo/view?usp=sharing
CVE ID: CVE-2025-9194 State: PUBLISHED Published: 2025-10-03T11:17:22.107Z Last Updated: 2025-10-03T18:20:03.099Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: antonshevchuk Products: Constructor Problem Types: CWE-862 Description: The Constructor theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clean() function in all versions up to, and including, 1.6.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a theme clean. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d9c479fc-2e98-4851-a36c-2fd219e750ed?source=cve - https://themes.svn.wordpress.org/constructor/1.6.5/libs/Constructor/Ajax.php
CVE ID: CVE-2025-9195 State: PUBLISHED Published: 2025-08-28T18:01:40.123Z Last Updated: 2025-08-28T18:32:17.579Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Solidigm Products: D7-PS1010/D7-PS1030 Problem Types: CWE-20 Description: Improper input validation in firmware of some Solidigm DC Products may allow an attacker with local access to cause a Denial of Service Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.solidigm.com/support-page/support-security.html
CVE ID: CVE-2025-9196 State: PUBLISHED Published: 2025-10-11T07:25:57.293Z Last Updated: 2025-10-14T14:12:19.232Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: sergiotrinity Products: Trinity Audio – Text to Speech AI audio player to convert content into audio Problem Types: CWE-200 Description: The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the ~/admin/inc/phpinfo.php file that gets created on install. This makes it possible for unauthenticated attackers to extract sensitive data including configuration da
ed on install. This makes it possible for unauthenticated attackers to extract sensitive data including configuration data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/64889659-24d6-40d9-97ba-b448f5205a96?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3373045%40trinity-audio&new=3373045%40trinity-audio&sfp_email=&sfph_mail=
CVE ID: CVE-2025-9197 State: REJECTED Published: N/A Last Updated: 2025-09-23T17:51:19.240Z Description: No description available.
CVE ID: CVE-2025-9198 State: PUBLISHED Published: 2025-10-03T11:17:10.412Z Last Updated: 2025-11-24T20:32:07.928Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: gopi_plus Products: Wp cycle text announcement Problem Types: CWE-89 Description: The Wp cycle text announcement plugin for WordPress is vulnerable to SQL Injection via the 'cycle-text' shortcode in all versions up to, and including, 8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already exist
or authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3db1375b-169a-450d-86b5-2db99f916034?source=cve - https://plugins.trac.wordpress.org/browser/wp-cycle-text-announcement/trunk/wp-cycle-text-announcement.php#L129
CVE ID: CVE-2025-9199 State: PUBLISHED Published: 2025-10-03T11:17:16.380Z Last Updated: 2025-11-24T20:31:12.576Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: gopiplus Products: Woo superb slideshow transition gallery with random effect Problem Types: CWE-89 Description: The Woo superb slideshow transition gallery with random effect plugin for WordPress is vulnerable to SQL Injection via the 'woo-superb-slideshow' shortcode in all versions up to, and including, 9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-le
ufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8e4c42e6-92f3-4c2f-8748-877c6df39e62?source=cve - https://plugins.trac.wordpress.org/browser/woo-superb-slideshow-transition-gallery-with-random-effect/trunk/woo-superb-slideshow-transition-gallery-with-random-effect.php#L61
CVE ID: CVE-2025-9200 State: PUBLISHED Published: 2025-10-03T11:17:17.214Z Last Updated: 2025-10-03T18:15:55.952Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: nebelhorn Products: Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App Problem Types: CWE-89 Description: The Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App plugin for WordPress is vulnerable to SQL Injection via the nh_ynaa_comments() function in all versions up to, and including, 0.8.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthentica
supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9169931c-a679-4801-b33b-08c4f464dc43?source=cve - https://wordpress.org/plugins/yournewsapp/
CVE ID: CVE-2025-9201 State: PUBLISHED Published: 2025-09-11T18:32:24.102Z Last Updated: 2025-09-11T19:10:40.015Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Browser Problem Types: CWE-427 Description: A potential DLL hijacking vulnerability was discovered in Lenovo Browser during an internal security assessment that could allow a local user to execute code with elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/431735
CVE ID: CVE-2025-9202 State: PUBLISHED Published: 2025-08-20T06:39:50.555Z Last Updated: 2025-08-20T17:32:33.927Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: themegrill Products: ColorMag Problem Types: CWE-862 Description: The ColorMag theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the welcome_notice_import_handler() function in all versions up to, and including, 4.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the ThemeGrill Demo Importer plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence
ThemeGrill Demo Importer plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b1922b16-e76c-4ee6-83ad-77970c8c25c0?source=cve - https://research.cleantalk.org/CVE-2025-9202 - https://themes.trac.wordpress.org/changeset/283558/colormag/4.0.20/inc/admin/class-colormag-welcome-notice.php
CVE ID: CVE-2025-9203 State: PUBLISHED Published: 2025-09-17T06:17:48.156Z Last Updated: 2025-09-17T12:52:40.527Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bplugins Products: Media Player Addons for Elementor – Audio and Video Widgets for Elementor Problem Types: CWE-79 Description: The Media Player Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtitle_ssize', 'track_title', and 'track_artist_name' parameters in version 1.0.5. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access
escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1067cc82-3595-4228-a7a2-5b3be7677b1f?source=cve - https://plugins.trac.wordpress.org/browser/media-player-addons-for-elementor/tags/1.0.5/widgets/bplayer-widget-video.php#L207 - https://plugins.trac.wordpress.org/browser/media-player-addons-for-elementor/tags/1.0.5/widgets/b_html5_addon.php#L432 - https://plugins.trac.wordpress.org/log/media-
ia-player-addons-for-elementor/tags/1.0.5/widgets/b_html5_addon.php#L432 - https://plugins.trac.wordpress.org/log/media-player-addons-for-elementor/
CVE ID: CVE-2025-9204 State: PUBLISHED Published: 2025-10-03T11:17:21.752Z Last Updated: 2025-10-03T13:57:52.823Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pencilwp Products: X Addons for Elementor Problem Types: CWE-79 Description: The X Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Youtube Video ID field in all versions up to, and including, 1.0.14. This is due to insufficient input sanitization and output escaping on the Youtube Video ID parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whe
cated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an affected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d37599aa-d8e0-4ff2-8e15-a96f1865f4d9?source=cve - https://plugins.trac.wordpress.org/browser/x-addons-elementor/tags/1.0.14/includes/widgets/xa-hero.php#L723
CVE ID: CVE-2025-9206 State: PUBLISHED Published: 2025-10-03T11:17:15.099Z Last Updated: 2025-10-03T14:48:50.677Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mekshq Products: Meks Easy Maps Problem Types: CWE-79 Description: The Meks Easy Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title field in all version up to, and including, 2.1.4. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the map co
r-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the map containing the malicious post. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8746b363-f1c2-42cb-83cf-639ab4102a50?source=cve - https://plugins.trac.wordpress.org/browser/meks-easy-maps/trunk/public/js/main-osm.js#L144 - https://plugins.trac.wordpress.org/browser/meks-easy-maps/trunk/inc/helpers.php#L419