Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ves arbitrary SYSTEM code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.advancedinstaller.com/release-22.6.html - https://www.advancedinstaller.com/advanced-installer-security-fixes-retrospective.html - https://www.advancedinstaller.com/advanced-installer-security-fixes-retrospective.html#update-deprecated-apis-used-to-resolve-paths
CVE ID: CVE-2025-47423 State: PUBLISHED Published: 2025-05-07T00:00:00.000Z Last Updated: 2025-05-07T20:17:41.490Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: pwsdashboard Products: Personal Weather Station Dashboard Problem Types: CWE-24 Description: Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/_test.php, as demonstrated by reading the server's private SSL key in cleartext. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pwsdashboard.com/ - https://github.com/haluka92/CVE-2025-47423
CVE ID: CVE-2025-47424 State: PUBLISHED Published: 2025-05-09T00:00:00.000Z Last Updated: 2025-05-12T19:32:24.725Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C) Vendors: Retool Products: Retool Problem Types: CWE-348 Description: Retool (self-hosted) before 3.196.0 allows Host header injection. When the BASE_DOMAIN environment variable is not set, the HTTP host header can be manipulated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.retool.com/disclosures/cve-2025-47424
CVE ID: CVE-2025-47436 State: PUBLISHED Published: 2025-05-14T13:11:36.329Z Last Updated: 2025-05-14T20:58:23.567Z Vendors: Apache Software Foundation Products: Apache ORC Problem Types: CWE-122 Description: Heap-based Buffer Overflow vulnerability in Apache ORC. A vulnerability has been identified in the ORC C++ LZO decompression logic, where specially crafted malformed ORC files can cause the decompressor to allocate a 250-byte buffer but then attempts to copy 295 bytes into it. It causes memory corruption. This issue affects Apache ORC C++ library: through 1.8.8, from 1.9.0 through 1.9.5, from 2.0.0 through 2.0.4, from 2.1.0 through 2.1.1. Users are recommended to upgrade to version 1.8.9
9.0 through 1.9.5, from 2.0.0 through 2.0.4, from 2.1.0 through 2.1.1. Users are recommended to upgrade to version 1.8.9, 1.9.6, 2.0.5, and 2.1.2, which fix the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://orc.apache.org/security/CVE-2025-47436/ - https://lists.apache.org/thread/kd6tlv8fs5jybmsgxr4vrkdxyc866wrn
CVE ID: CVE-2025-47437 State: PUBLISHED Published: 2025-09-09T16:25:28.839Z Last Updated: 2025-09-09T18:41:34.348Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: LiteSpeed Technologies Products: LiteSpeed Cache Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in LiteSpeed Technologies LiteSpeed Cache. This issue affects LiteSpeed Cache: from n/a through 7.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/litespeed-cache/vulnerability/wordpress-litespeed-cache-plugin-7-0-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-47438 State: PUBLISHED Published: 2025-05-23T12:43:37.020Z Last Updated: 2025-05-23T14:55:15.452Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wpjobportal Products: WP Job Portal Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpjobportal WP Job Portal allows PHP Local File Inclusion. This issue affects WP Job Portal: from n/a through 2.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-plugin-2-3-1-local-file-inclus
chstack.com/database/wordpress/plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-plugin-2-3-1-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-47439 State: PUBLISHED Published: 2025-05-07T14:19:30.638Z Last Updated: 2025-05-07T18:24:07.020Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: WP Chill Products: Download Monitor Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Chill Download Monitor allows PHP Local File Inclusion. This issue affects Download Monitor: from n/a through 5.0.22. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/download-monitor/vulnerability/wordpress-download-monitor-5-0-22-local-file-in
/patchstack.com/database/wordpress/plugin/download-monitor/vulnerability/wordpress-download-monitor-5-0-22-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-47440 State: PUBLISHED Published: 2025-05-07T14:19:31.226Z Last Updated: 2025-05-07T18:23:56.620Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Greg Winiarski Products: WPAdverts Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Greg Winiarski WPAdverts allows PHP Local File Inclusion. This issue affects WPAdverts: from n/a through 2.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpadverts/vulnerability/wordpress-wpadverts-2-2-2-local-file-inclusion-vulnerability?_s_
k.com/database/wordpress/plugin/wpadverts/vulnerability/wordpress-wpadverts-2-2-2-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-47441 State: PUBLISHED Published: 2025-05-07T14:19:31.824Z Last Updated: 2025-05-07T18:23:46.431Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Chris Reynolds Products: Progress Bar Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Reynolds Progress Bar allows Stored XSS. This issue affects Progress Bar: from n/a through 2.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/progress-bar/vulnerability/wordpress-progress-bar-2-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-47442 State: PUBLISHED Published: 2025-05-07T14:19:32.404Z Last Updated: 2025-05-07T18:23:34.872Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: CC Products: CC BMI Calculator Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CC CC BMI Calculator allows Stored XSS. This issue affects CC BMI Calculator: from n/a through 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cc-bmi-calculator/vulnerability/wordpress-cc-bmi-calculator-2-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-47443 State: PUBLISHED Published: 2025-05-07T14:19:32.982Z Last Updated: 2025-05-07T18:23:23.310Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: wpdevart Products: Widget Countdown Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Widget Countdown allows Stored XSS. This issue affects Widget Countdown: from n/a through 2.7.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/widget-countdown/vulnerability/wordpress-widget-countdown-2-7-4-cross-site-scripting-xss-vulnerability?_s_id=c
ss/plugin/widget-countdown/vulnerability/wordpress-widget-countdown-2-7-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-47444 State: PUBLISHED Published: 2025-08-12T06:37:11.075Z Last Updated: 2025-11-13T10:33:40.473Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Liquid Web Products: GiveWP Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Liquid Web GiveWP allows Retrieve Embedded Sensitive Data.This issue affects GiveWP: from n/a before 4.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-6-1-pii-sensitive-data-exposure-vulnerability?_s_id=cve - https://github.com/impress-org/givewp/issues/8042
ewp-plugin-4-6-1-pii-sensitive-data-exposure-vulnerability?_s_id=cve - https://github.com/impress-org/givewp/issues/8042?_s_id=cve
CVE ID: CVE-2025-47445 State: PUBLISHED Published: 2025-05-14T11:37:49.467Z Last Updated: 2025-06-07T04:40:19.454Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Themewinter Products: Eventin Problem Types: CWE-23 Description: Relative Path Traversal vulnerability in Themewinter Eventin allows Path Traversal.This issue affects Eventin: from n/a through 4.0.26. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-eventin-4-0-26-arbitrary-file-download-vulnerability?_s_id=cve
CVE ID: CVE-2025-47446 State: PUBLISHED Published: 2025-05-07T14:19:33.520Z Last Updated: 2025-05-07T18:23:13.057Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: listamester Products: Listamester Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in listamester Listamester allows Cross Site Request Forgery. This issue affects Listamester: from n/a through 2.3.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/listamester/vulnerability/wordpress-listamester-2-3-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-47447 State: PUBLISHED Published: 2025-05-07T14:19:34.070Z Last Updated: 2025-05-07T18:23:00.798Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Hossni Mubarak Products: Cool Author Box Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak Cool Author Box allows Cross Site Request Forgery. This issue affects Cool Author Box: from n/a through 3.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/hm-cool-author-box-widget/vulnerability/wordpress-cool-author-box-3-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-47448 State: PUBLISHED Published: 2025-05-07T14:19:34.598Z Last Updated: 2025-05-07T18:22:49.603Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ThimPress Products: WP Hotel Booking Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking allows Cross Site Request Forgery. This issue affects WP Hotel Booking: from n/a through 2.1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-hotel-booking/vulnerability/wordpress-wp-hotel-booking-2-1-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-47449 State: PUBLISHED Published: 2025-05-07T14:19:35.143Z Last Updated: 2025-05-07T18:22:37.370Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Jordy Meow Products: Meow Gallery Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Meow Gallery allows Stored XSS. This issue affects Meow Gallery: from n/a through 5.2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/meow-gallery/vulnerability/wordpress-meow-gallery-5-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-47450 State: PUBLISHED Published: 2025-05-07T14:19:35.682Z Last Updated: 2025-05-07T16:37:13.999Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Mitchell Bennis Products: Simple File List Problem Types: CWE-862 Description: Missing Authorization vulnerability in Mitchell Bennis Simple File List allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple File List: from n/a through 6.1.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-file-list/vulnerability/wordpress-simple-file-list-6-1-13-settings-change-vulnerability?_s_id=cv
wordpress/plugin/simple-file-list/vulnerability/wordpress-simple-file-list-6-1-13-settings-change-vulnerability?_s_id=cve
CVE ID: CVE-2025-47451 State: PUBLISHED Published: 2025-05-07T14:19:36.213Z Last Updated: 2025-05-07T16:37:08.908Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: silverplugins217 Products: Product Quantity Dropdown For Woocommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in silverplugins217 Product Quantity Dropdown For Woocommerce allows Cross Site Request Forgery. This issue affects Product Quantity Dropdown For Woocommerce: from n/a through 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/product-quantity-dropdown-for-woocommerce/vulnerability
: References: - https://patchstack.com/database/wordpress/plugin/product-quantity-dropdown-for-woocommerce/vulnerability/wordpress-product-quantity-dropdown-for-woocommerce-plugin-1-2-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE ID: CVE-2025-47452 State: PUBLISHED Published: 2025-06-17T15:01:34.207Z Last Updated: 2025-06-17T18:37:20.245Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: RexTheme Products: WP VR Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in RexTheme WP VR allows Upload a Web Shell to a Web Server. This issue affects WP VR: from n/a through 8.5.26. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpvr/vulnerability/wordpress-wp-vr-8-5-26-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-47453 State: PUBLISHED Published: 2025-05-23T12:43:36.560Z Last Updated: 2025-05-23T14:55:35.513Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Xylus Themes Products: WP Smart Import Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Xylus Themes WP Smart Import allows PHP Local File Inclusion. This issue affects WP Smart Import: from n/a through 1.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-smart-import/vulnerability/wordpress-wp-smart-import-1-1-3-local-file-i
ps://patchstack.com/database/wordpress/plugin/wp-smart-import/vulnerability/wordpress-wp-smart-import-1-1-3-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-47454 State: PUBLISHED Published: 2025-05-07T14:19:36.753Z Last Updated: 2025-05-07T16:37:03.498Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: CRM Perks Products: WP Gravity Forms Dynamics CRM Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Dynamics CRM allows Phishing. This issue affects WP Gravity Forms Dynamics CRM: from n/a through 1.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gf-dynamics-crm/vulnerability/wordpress-wp-gravity-forms-dynamics-crm-1-1-4-open-redirection-vulnerabil
wordpress/plugin/gf-dynamics-crm/vulnerability/wordpress-wp-gravity-forms-dynamics-crm-1-1-4-open-redirection-vulnerability?_s_id=cve
CVE ID: CVE-2025-47455 State: PUBLISHED Published: 2025-05-07T14:19:37.300Z Last Updated: 2025-05-07T16:36:58.183Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: CRM Perks Products: Integration for WooCommerce and Salesforce Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Salesforce allows Phishing. This issue affects Integration for WooCommerce and Salesforce: from n/a through 1.7.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woo-salesforce-plugin-crm-perks/vulnerability/wordpress-integrat
ces: - https://patchstack.com/database/wordpress/plugin/woo-salesforce-plugin-crm-perks/vulnerability/wordpress-integration-for-woocommerce-and-salesforce-1-7-5-open-redirection-vulnerability?_s_id=cve
CVE ID: CVE-2025-47456 State: PUBLISHED Published: 2025-05-07T14:19:37.838Z Last Updated: 2025-05-07T18:22:27.082Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: CRM Perks Products: WP Gravity Forms Zendesk Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zendesk allows Phishing. This issue affects WP Gravity Forms Zendesk: from n/a through 1.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gf-zendesk/vulnerability/wordpress-wp-gravity-forms-zendesk-1-1-2-open-redirection-vulnerability?_s_id=cve
CVE ID: CVE-2025-47457 State: PUBLISHED Published: 2025-05-07T14:19:38.392Z Last Updated: 2025-05-07T14:38:19.730Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: dgamoni Products: LocateAndFilter Problem Types: CWE-862 Description: Missing Authorization vulnerability in dgamoni LocateAndFilter allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects LocateAndFilter: from n/a through 1.6.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/locateandfilter/vulnerability/wordpress-locateandfilter-1-6-16-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-47458 State: PUBLISHED Published: 2025-05-23T12:43:36.084Z Last Updated: 2025-05-23T14:52:02.785Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: B2itech Products: B2i Investor Tools Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in B2itech B2i Investor Tools allows Reflected XSS. This issue affects B2i Investor Tools: from n/a through 1.0.7.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/b2i-investor-tools/vulnerability/wordpress-b2i-investor-tools-plugin-1-0-7-9-reflected-cross-site-scrip
wordpress/plugin/b2i-investor-tools/vulnerability/wordpress-b2i-investor-tools-plugin-1-0-7-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-47459 State: PUBLISHED Published: 2025-05-07T14:19:38.923Z Last Updated: 2025-05-07T18:22:16.430Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: XpeedStudio Products: WP Fundraising Donation and Crowdfunding Platform Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in XpeedStudio WP Fundraising Donation and Crowdfunding Platform allows Cross Site Request Forgery. This issue affects WP Fundraising Donation and Crowdfunding Platform: from n/a through 1.7.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-fundraising-donation/vulnerability/w
ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-fundraising-donation/vulnerability/wordpress-wp-fundraising-donation-and-crowdfunding-platform-1-7-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-47460 State: PUBLISHED Published: 2025-05-07T14:19:39.465Z Last Updated: 2025-05-07T18:22:06.099Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: TrackShip Products: TrackShip for WooCommerce Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TrackShip TrackShip for WooCommerce allows SQL Injection. This issue affects TrackShip for WooCommerce: from n/a through 1.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/trackship-for-woocommerce/vulnerability/wordpress-trackship-for-woocommerce-1-9-
atchstack.com/database/wordpress/plugin/trackship-for-woocommerce/vulnerability/wordpress-trackship-for-woocommerce-1-9-1-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-47461 State: PUBLISHED Published: 2025-05-23T12:43:35.572Z Last Updated: 2025-05-23T14:58:17.899Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: mediaticus Products: Subaccounts for WooCommerce Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in mediaticus Subaccounts for WooCommerce allows Authentication Abuse. This issue affects Subaccounts for WooCommerce: from n/a through 1.6.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/subaccounts-for-woocommerce/vulnerability/wordpress-subaccounts-for-woocommerce-plugin-1-6-6
m/database/wordpress/plugin/subaccounts-for-woocommerce/vulnerability/wordpress-subaccounts-for-woocommerce-plugin-1-6-6-account-takeover-vulnerability?_s_id=cve
CVE ID: CVE-2025-47462 State: PUBLISHED Published: 2025-05-07T14:19:40.037Z Last Updated: 2025-05-07T18:21:55.932Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ohidul Islam Products: Challan Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Ohidul Islam Challan allows Privilege Escalation. This issue affects Challan: from n/a through 3.7.58. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/webappick-pdf-invoice-for-woocommerce/vulnerability/wordpress-challan-plugin-3-7-58-csrf-to-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-47463 State: PUBLISHED Published: 2025-06-09T15:54:12.968Z Last Updated: 2025-06-10T13:54:20.508Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Fahad Mahmood Products: Stock Locations for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Stock Locations for WooCommerce: from n/a through 2.8.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/stock-locations-for-woocommerce/vulnerability/wordpress-stock-loc
es: - https://patchstack.com/database/wordpress/plugin/stock-locations-for-woocommerce/vulnerability/wordpress-stock-locations-for-woocommerce-2-8-6-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-47464 State: PUBLISHED Published: 2025-05-07T14:19:40.549Z Last Updated: 2025-05-07T18:21:45.675Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: solacewp Products: Solace Extra Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in solacewp Solace Extra allows Server Side Request Forgery. This issue affects Solace Extra: from n/a through 1.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/solace-extra/vulnerability/wordpress-solace-extra-1-3-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve