Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-39450 State: PUBLISHED Published: 2025-05-19T17:32:19.805Z Last Updated: 2025-05-20T13:14:09.614Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Crocoblock Products: JetTabs Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through 2.2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-tabs/vulnerability/wordpress-jettabs-plugin-2-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39451 State: PUBLISHED Published: 2025-05-19T18:48:48.908Z Last Updated: 2025-05-19T19:33:57.124Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Crocoblock Products: JetBlocks For Elementor Problem Types: CWE-862 Description: Missing Authorization vulnerability in Crocoblock JetBlocks For Elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetBlocks For Elementor: from n/a through 1.3.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-blocks/vulnerability/wordpress-jetblocks-for-elementor-1-3-16-broken-access-control-vulnerability?_
wordpress/plugin/jet-blocks/vulnerability/wordpress-jetblocks-for-elementor-1-3-16-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-39452 State: PUBLISHED Published: 2025-04-17T15:15:42.576Z Last Updated: 2025-04-17T17:23:57.271Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Themewinter Products: WPCafe Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themewinter WPCafe allows PHP Local File Inclusion. This issue affects WPCafe: from n/a through 2.2.32. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-cafe/vulnerability/wordpress-wpcafe-plugin-2-2-32-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39453 State: PUBLISHED Published: 2025-04-17T15:15:41.737Z Last Updated: 2025-04-17T18:45:35.528Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: algol.plus Products: Advanced Dynamic Pricing for WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in algol.plus Advanced Dynamic Pricing for WooCommerce allows Cross Site Request Forgery. This issue affects Advanced Dynamic Pricing for WooCommerce: from n/a through 4.9.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/advanced-dynamic-pricing-for-woocommerce/vulnerability/wordpress-adv
- https://patchstack.com/database/wordpress/plugin/advanced-dynamic-pricing-for-woocommerce/vulnerability/wordpress-advanced-dynamic-pricing-for-woocommerce-plugin-4-9-3-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE ID: CVE-2025-39454 State: PUBLISHED Published: 2025-05-19T17:31:37.126Z Last Updated: 2025-05-20T13:14:27.244Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Jeroen Peters Products: Name Directory Problem Types: CWE-862 Description: Missing Authorization vulnerability in Jeroen Peters Name Directory.This issue affects Name Directory: from n/a through 1.30.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/name-directory/vulnerability/wordpress-name-directory-plugin-1-30-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-39455 State: PUBLISHED Published: 2025-04-17T15:15:40.863Z Last Updated: 2025-04-17T18:45:46.337Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: ip2location Products: IP2Location Variables Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ip2location IP2Location Variables allows Reflected XSS. This issue affects IP2Location Variables: from n/a through 2.9.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ip2location-variables/vulnerability/wordpress-ip2location-variables-plugin-2-9-5-csrf-to-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39456 State: PUBLISHED Published: 2025-04-17T15:15:40.060Z Last Updated: 2025-04-17T18:45:55.649Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: iTRON Products: WP Logger Problem Types: CWE-862 Description: Missing Authorization vulnerability in iTRON WP Logger allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Logger: from n/a through 2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-data-logger/vulnerability/wordpress-wp-logger-plugin-2-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-39457 State: PUBLISHED Published: 2025-04-17T15:15:39.241Z Last Updated: 2025-04-17T18:46:06.404Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: magepeopleteam Products: Booking and Rental Manager Problem Types: CWE-862 Description: Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Booking and Rental Manager: from n/a through 2.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/booking-and-rental-manager-for-woocommerce/vulnerability/wordpress-booking-a
://patchstack.com/database/wordpress/plugin/booking-and-rental-manager-for-woocommerce/vulnerability/wordpress-booking-and-rental-manager-plugin-2-2-8-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-39458 State: PUBLISHED Published: 2025-05-19T18:47:55.062Z Last Updated: 2025-05-19T19:34:36.694Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Mikado-Themes Products: Foton Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Foton allows PHP Local File Inclusion.This issue affects Foton: from n/a through 2.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/foton/vulnerability/wordpress-foton-theme-2-5-2-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39459 State: PUBLISHED Published: 2025-05-19T18:46:41.609Z Last Updated: 2025-05-19T19:35:03.253Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Contempo Themes Products: Real Estate 7 Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in Contempo Themes Real Estate 7 allows Privilege Escalation.This issue affects Real Estate 7: from n/a through 3.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/realestate-7/vulnerability/wordpress-real-estate-7-theme-3-5-2-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-39460 State: PUBLISHED Published: 2025-05-19T17:30:44.742Z Last Updated: 2025-05-20T13:14:44.896Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: ThimPress Products: Eduma Problem Types: CWE-862 Description: Missing Authorization vulnerability in ThimPress Eduma allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eduma: from n/a through 5.6.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/eduma/vulnerability/wordpress-eduma-theme-5-6-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-39461 State: PUBLISHED Published: 2025-04-17T15:15:38.431Z Last Updated: 2025-04-17T18:46:14.593Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Nawawi Jamili Products: Docket Cache Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nawawi Jamili Docket Cache allows PHP Local File Inclusion. This issue affects Docket Cache: from n/a through 24.07.02. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/docket-cache/vulnerability/wordpress-docket-cache-plugin-24-07-02-local-file-i
/patchstack.com/database/wordpress/plugin/docket-cache/vulnerability/wordpress-docket-cache-plugin-24-07-02-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39462 State: PUBLISHED Published: 2025-04-17T15:15:37.605Z Last Updated: 2025-04-17T18:46:22.995Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: teamzt Products: Smart Agreements Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in teamzt Smart Agreements allows PHP Local File Inclusion. This issue affects Smart Agreements: from n/a through 1.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/smart-agreements/vulnerability/wordpress-smart-agreements-plugin-1-0-3-local-file-i
hstack.com/database/wordpress/plugin/smart-agreements/vulnerability/wordpress-smart-agreements-plugin-1-0-3-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39463 State: PUBLISHED Published: 2025-11-06T15:53:23.424Z Last Updated: 2025-11-13T10:33:40.316Z Vendors: Select-Themes Products: Dessau Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Dessau dessau allows PHP Local File Inclusion.This issue affects Dessau: from n/a through < 1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/dessau/vulnerability/wordpress-dessau-theme-1-9-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39464 State: PUBLISHED Published: 2025-04-17T15:15:36.747Z Last Updated: 2025-04-17T18:46:34.223Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: rtowebsites Products: AdminQuickbar Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtowebsites AdminQuickbar allows Reflected XSS. This issue affects AdminQuickbar: from n/a through 1.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/adminquickbar/vulnerability/wordpress-adminquickbar-plugin-1-9-1-reflected-cross-site-scripting-xss-vulnerabilit
/plugin/adminquickbar/vulnerability/wordpress-adminquickbar-plugin-1-9-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39465 State: PUBLISHED Published: 2025-11-06T15:53:29.145Z Last Updated: 2025-11-13T10:33:40.287Z Vendors: flippercode Products: Advanced Google Maps Problem Types: CWE-862 Description: Missing Authorization vulnerability in flippercode Advanced Google Maps wp-google-map-gold allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Google Maps: from n/a through <= 5.8.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wp-google-map-gold/vulnerability/wordpress-advanced-google-maps-plugin-5-8-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-39466 State: PUBLISHED Published: 2025-11-06T15:53:30.016Z Last Updated: 2025-11-13T10:33:39.407Z Vendors: Mikado-Themes Products: Dør Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dør dor allows PHP Local File Inclusion.This issue affects Dør: from n/a through <= 2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/dor/vulnerability/wordpress-doer-2-4-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39467 State: PUBLISHED Published: 2025-11-06T15:53:33.195Z Last Updated: 2025-11-13T10:33:39.913Z Vendors: Mikado-Themes Products: Wanderland Problem Types: CWE-35 Description: Path Traversal: '.../...//' vulnerability in Mikado-Themes Wanderland wanderland allows PHP Local File Inclusion.This issue affects Wanderland: from n/a through <= 1.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/wanderland/vulnerability/wordpress-wanderland-1-7-1-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39468 State: PUBLISHED Published: 2025-11-06T15:53:34.539Z Last Updated: 2025-11-13T10:33:39.419Z Vendors: pantherius Products: Modal Survey Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in pantherius Modal Survey modal-survey.This issue affects Modal Survey: from n/a through <= 2.0.2.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/modal-survey/vulnerability/wordpress-modal-survey-plugin-2-0-2-0-1-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39469 State: PUBLISHED Published: 2025-04-18T04:31:51.451Z Last Updated: 2025-04-18T12:01:01.706Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Pantherius Products: Modal Survey Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pantherius Modal Survey allows Reflected XSS.This issue affects Modal Survey: from n/a through 2.0.2.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/modal-survey/vulnerability/wordpress-modal-survey-plugin-2-0-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cv
lugin/modal-survey/vulnerability/wordpress-modal-survey-plugin-2-0-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39470 State: PUBLISHED Published: 2025-04-18T04:30:31.772Z Last Updated: 2025-04-18T11:27:59.586Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ThimPress Products: Ivy School Problem Types: CWE-35 Description: Path Traversal: '.../...//' vulnerability in ThimPress Ivy School allows PHP Local File Inclusion.This issue affects Ivy School: from n/a through 1.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/ivy-school/vulnerability/wordpress-ivy-school-1-6-0-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39471 State: PUBLISHED Published: 2025-04-18T04:27:58.846Z Last Updated: 2025-04-18T12:01:09.565Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: Pantherius Products: Modal Survey Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pantherius Modal Survey.This issue affects Modal Survey: from n/a through 2.0.2.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/modal-survey/vulnerability/wordpress-modal-survey-plugin-2-0-2-0-1-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39472 State: PUBLISHED Published: 2025-04-16T17:15:50.209Z Last Updated: 2025-06-09T12:49:09.349Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WPWeb Products: WooCommerce Social Login Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WPWeb WooCommerce Social Login allows Cross Site Request Forgery.This issue affects WooCommerce Social Login: from n/a before 2.8.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woo-social-login/vulnerability/wordpress-woocommerce-social-login-plugin-2-8-2-cross-site-request-forgery-csrf-vulnerability?_s_
al-login/vulnerability/wordpress-woocommerce-social-login-plugin-2-8-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-39473 State: PUBLISHED Published: 2025-06-09T15:54:16.031Z Last Updated: 2025-06-10T13:37:11.888Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WebGeniusLab Products: Seofy Core Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebGeniusLab Seofy Core allows PHP Local File Inclusion. This issue affects Seofy Core: from n/a through 1.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/seofy-core/vulnerability/wordpress-seofy-core-1-4-5-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39474 State: PUBLISHED Published: 2025-06-27T11:52:35.674Z Last Updated: 2025-06-27T13:05:18.710Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: ThemeMove Products: Amely Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeMove Amely allows SQL Injection. This issue affects Amely: from n/a through 3.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/amely/vulnerability/wordpress-amely-theme-3-1-4-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39475 State: PUBLISHED Published: 2025-06-09T15:54:15.232Z Last Updated: 2025-06-10T13:39:29.174Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Frenify Products: Arlo Problem Types: CWE-35 Description: Path Traversal vulnerability in Frenify Arlo allows PHP Local File Inclusion. This issue affects Arlo: from n/a through 6.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/arlo/vulnerability/wordpress-arlo-6-0-3-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39476 State: PUBLISHED Published: 2025-06-09T15:54:14.400Z Last Updated: 2025-06-10T13:39:47.005Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: magentech Products: Revo Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Revo allows PHP Local File Inclusion. This issue affects Revo: from n/a through 4.0.26. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/revo/vulnerability/wordpress-revo-theme-4-0-26-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39478 State: PUBLISHED Published: 2025-06-27T11:52:35.066Z Last Updated: 2025-06-27T13:06:10.850Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: smartiolabs Products: Smart Notification Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smartiolabs Smart Notification allows Reflected XSS. This issue affects Smart Notification: from n/a through 10.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/smio-push-notification/vulnerability/wordpress-smart-notification-plugin-10-3-reflected-cross-site
base/wordpress/plugin/smio-push-notification/vulnerability/wordpress-smart-notification-plugin-10-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39479 State: PUBLISHED Published: 2025-06-17T15:01:35.656Z Last Updated: 2025-06-17T18:37:00.527Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: smartiolabs Products: Smart Notification Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in smartiolabs Smart Notification allows Blind SQL Injection. This issue affects Smart Notification: from n/a through 10.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/smio-push-notification/vulnerability/wordpress-smart-notification-plugin-10-3-sql-inject
k.com/database/wordpress/plugin/smio-push-notification/vulnerability/wordpress-smart-notification-plugin-10-3-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39480 State: PUBLISHED Published: 2025-05-23T12:43:55.871Z Last Updated: 2025-05-23T13:35:06.766Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ThemeMakers Products: Car Dealer Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in ThemeMakers Car Dealer allows Object Injection. This issue affects Car Dealer: from n/a through 1.6.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/cardealer/vulnerability/wordpress-car-dealer-1-6-6-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39481 State: PUBLISHED Published: 2025-05-16T15:45:27.223Z Last Updated: 2025-05-16T16:19:29.934Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: imithemes Products: Eventer Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in imithemes Eventer allows Blind SQL Injection. This issue affects Eventer: from n/a through 3.9.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/eventer/vulnerability/wordpress-eventer-wordpress-event-booking-manager-plugin-plugin-3-9-6-sql-injection-vulnerability?_s_i
ter/vulnerability/wordpress-eventer-wordpress-event-booking-manager-plugin-plugin-3-9-6-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39482 State: PUBLISHED Published: 2025-05-16T15:45:26.697Z Last Updated: 2025-05-16T16:19:49.566Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: imithemes Products: Eventer Problem Types: CWE-862 Description: Missing Authorization vulnerability in imithemes Eventer allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Eventer: from n/a through 3.9.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/eventer/vulnerability/wordpress-eventer-wordpress-event-booking-manager-plugin-plugin-3-9-6-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-39483 State: PUBLISHED Published: 2025-08-14T10:34:26.628Z Last Updated: 2025-08-14T19:37:58.584Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: imithemes Products: Eventer Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in imithemes Eventer allows Code Injection. This issue affects Eventer: from n/a through 3.9.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/eventer/vulnerability/wordpress-eventer-plugin-3-9-6-shortcode-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39485 State: PUBLISHED Published: 2025-05-23T12:43:55.410Z Last Updated: 2025-05-23T13:37:54.091Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ThemeGoods Products: Grand Tour | Travel Agency WordPress Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Tour | Travel Agency WordPress allows Object Injection. This issue affects Grand Tour | Travel Agency WordPress: from n/a through 5.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/grandtour/vulnerability/wordpress-grandtour-theme-5-5-1-php-object-injection-vulnerabilit