Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-62796 State: PUBLISHED Published: 2025-10-28T20:47:50.277Z Last Updated: 2025-10-29T13:31:54.964Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: PrivateBin Products: PrivateBin Problem Types: CWE-79, CWE-80 Description: PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Versions 1.7.7 through 2.0.1 allow persistent HTML injection via the unsanitized attachment filename (attachment_name) when attachments are enabled. An attacker can modify attachment_name before encryption so that, after decryption, arbitrary HTML is inserted unescaped into the page near the file size hint, enabling redirect (e.g., meta refr
cryption, arbitrary HTML is inserted unescaped into the page near the file size hint, enabling redirect (e.g., meta refresh) and site defacement and related phishing attacks. Script execution is normally blocked by the recommended Content Security Policy, limiting confidentiality impact. The issue was introduced in 1.7.7 and fixed in 2.0.2. Update to 2.0.2 or later. Workarounds include enforcing the recommended CSP, deploying PrivateBin on a separate domain, or disabling attachments. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-867c-p784-5q6g - https://github.com/PrivateBin/PrivateBin/pull/1550 - https://gi
Bin/PrivateBin/security/advisories/GHSA-867c-p784-5q6g - https://github.com/PrivateBin/PrivateBin/pull/1550 - https://github.com/PrivateBin/PrivateBin/commit/c4f8482b3072be7ae012cace1b3f5658dcc3b42e
CVE ID: CVE-2025-62797 State: PUBLISHED Published: 2025-10-29T17:49:07.899Z Last Updated: 2025-10-29T19:01:54.985Z Vendors: rathena Products: FluxCP Problem Types: CWE-352 Description: FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery (CSRF) vulnerability exists in the FluxCP-based website template used by multiple rAthena/Ragnarok servers. State-changing POST endpoints accept browser-initiated requests that are authorized solely by the session cookie without per-request anti-CSRF tokens or robust Origin/Referer validation. An attacker who can lure a logged-in user to an attacker-controlled page can cause that user to perform sensit
lidation. An attacker who can lure a logged-in user to an attacker-controlled page can cause that user to perform sensitive actions without their intent. This vulnerability is fixed with commit e3f130c. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rathena/FluxCP/security/advisories/GHSA-5w2g-8cqq-r4fr - https://github.com/rathena/FluxCP/commit/e3f130c4a2ccd615a3ee2ee0302ecbfbd84747e6
CVE ID: CVE-2025-62798 State: PUBLISHED Published: 2025-10-28T20:58:21.793Z Last Updated: 2025-10-29T17:31:24.267Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: code16 Products: sharp Problem Types: CWE-79 Description: Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in {{ & }} were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser when the field is displayed. The issue has been fixe
to inject arbitrary JavaScript or HTML that executes in the browser when the field is displayed. The issue has been fixed in v9.11.1 . Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/code16/sharp/security/advisories/GHSA-9f58-4465-23c7 - https://github.com/code16/sharp/pull/654 - https://github.com/code16/sharp/releases/tag/v9.11.1
CVE ID: CVE-2025-62800 State: PUBLISHED Published: 2025-10-28T21:34:40.392Z Last Updated: 2025-10-29T15:52:44.433Z Vendors: jlowin Products: fastmcp Problem Types: CWE-79 Description: FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values are inserted into the generated HTML, allowing arbitrary JavaScript execution in the callback server origin. The issue is fixed in version 2.13.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jlowin/fastmcp/security/advisories/GHSA-mxxr-jv3v-
lyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jlowin/fastmcp/security/advisories/GHSA-mxxr-jv3v-6pgc
CVE ID: CVE-2025-62801 State: PUBLISHED Published: 2025-10-28T21:36:41.167Z Last Updated: 2025-10-29T14:54:56.687Z Vendors: jlowin Products: fastmcp Problem Types: CWE-78 Description: FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor. This vulnerability is fixed in 2.13.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/jlowin/fastmcp/security/advisories/GHSA-rj5c-58rq-j5g5
CVE ID: CVE-2025-62802 State: PUBLISHED Published: 2025-10-28T21:42:07.724Z Last Updated: 2025-10-29T14:53:52.509Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-1188, CWE-434 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 10.1.1, the out-of-box experience for HTML editing allows unauthenticated users to upload files. This opens a potential vector to other security issues and is not needed on most implementations. This vulnerability is fixed in 10.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
mentations. This vulnerability is fixed in 10.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-2374-6cvw-qmx6
CVE ID: CVE-2025-62804 State: REJECTED Published: N/A Last Updated: 2025-10-23T02:55:10.168Z Description: No description available.
CVE ID: CVE-2025-62805 State: REJECTED Published: N/A Last Updated: 2025-10-23T02:55:09.672Z Description: No description available.
CVE ID: CVE-2025-62806 State: REJECTED Published: N/A Last Updated: 2025-10-23T02:55:09.180Z Description: No description available.
CVE ID: CVE-2025-62807 State: REJECTED Published: N/A Last Updated: 2025-10-23T02:55:08.656Z Description: No description available.
CVE ID: CVE-2025-62808 State: REJECTED Published: N/A Last Updated: 2025-10-23T02:55:08.163Z Description: No description available.
CVE ID: CVE-2025-62809 State: REJECTED Published: N/A Last Updated: 2025-10-23T02:55:07.473Z Description: No description available.
CVE ID: CVE-2025-62810 State: REJECTED Published: N/A Last Updated: 2025-10-23T02:55:06.973Z Description: No description available.
CVE ID: CVE-2025-62811 State: REJECTED Published: N/A Last Updated: 2025-10-23T02:55:06.456Z Description: No description available.
CVE ID: CVE-2025-62812 State: REJECTED Published: N/A Last Updated: 2025-10-23T02:55:05.748Z Description: No description available.
CVE ID: CVE-2025-62813 State: REJECTED Published: 2025-10-23T00:00:00.000Z Last Updated: 2025-10-29T05:41:00.849Z Description: No description available.
CVE ID: CVE-2025-62820 State: PUBLISHED Published: 2025-10-23T00:00:00.000Z Last Updated: 2025-10-23T14:35:19.815Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L) Vendors: Slack Products: Nebula Problem Types: CWE-420 Description: Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/slackhq/nebula/pull/1493 - https://github.com/slackhq/nebula/pull/1494
CVE ID: CVE-2025-62827 State: REJECTED Published: N/A Last Updated: 2025-10-24T02:55:10.036Z Description: No description available.
CVE ID: CVE-2025-62828 State: REJECTED Published: N/A Last Updated: 2025-10-24T02:55:09.487Z Description: No description available.
CVE ID: CVE-2025-62829 State: REJECTED Published: N/A Last Updated: 2025-10-24T02:55:08.886Z Description: No description available.
CVE ID: CVE-2025-62830 State: REJECTED Published: N/A Last Updated: 2025-10-24T02:55:08.363Z Description: No description available.
CVE ID: CVE-2025-62831 State: REJECTED Published: N/A Last Updated: 2025-10-24T02:55:07.858Z Description: No description available.
CVE ID: CVE-2025-62832 State: REJECTED Published: N/A Last Updated: 2025-10-24T02:55:07.350Z Description: No description available.
CVE ID: CVE-2025-62833 State: REJECTED Published: N/A Last Updated: 2025-10-24T02:55:06.799Z Description: No description available.
CVE ID: CVE-2025-62834 State: REJECTED Published: N/A Last Updated: 2025-10-24T02:55:06.289Z Description: No description available.
CVE ID: CVE-2025-62835 State: REJECTED Published: N/A Last Updated: 2025-10-24T02:55:05.656Z Description: No description available.
CVE ID: CVE-2025-62868 State: PUBLISHED Published: 2025-10-24T07:52:58.711Z Last Updated: 2025-10-24T16:48:39.563Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Edge-Themes Products: Edge CPT Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Edge CPT allows PHP Local File Inclusion.This issue affects Edge CPT: from n/a through 1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/wordpress/plugin/edge-cpt/security-policy/vdp/vulnerability/wordpress-edge-cpt-plugin-1-4-local-file-inclusion-vu
tabase/wordpress/plugin/edge-cpt/security-policy/vdp/vulnerability/wordpress-edge-cpt-plugin-1-4-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-62875 State: PUBLISHED Published: 2025-11-20T16:02:11.542Z Last Updated: 2025-11-21T16:28:18.612Z Vendors: SUSE Products: openSUSE Tumbleweed Problem Types: CWE-754 Description: An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local users to crash OpenSMTPD. This issue affects openSUSE Tumbleweed: from ? before 7.8.0p0-1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-62875 - https://security.opensuse.org/2025/10/31/opensmtpd-local-DoS.html
CVE ID: CVE-2025-62876 State: PUBLISHED Published: 2025-11-12T12:57:54.078Z Last Updated: 2025-11-17T17:03:53.487Z Vendors: SUSE Products: openSUSE Problem Types: CWE-250 Description: A Execution with Unnecessary Privileges vulnerability in lightdm-kde-greeter allows escalation from the service user to root.This issue affects lightdm-kde-greeter. before 6.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-62876
CVE ID: CVE-2025-62881 State: PUBLISHED Published: 2025-10-27T01:33:42.812Z Last Updated: 2025-11-13T10:33:47.323Z Vendors: WP Lab Products: WP-Lister Lite for eBay Problem Types: CWE-862 Description: Missing Authorization vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.8.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wp-lister-for-ebay/vulnerability/wordpress-wp-lister-lite-for-ebay-plugin-3-8-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-62882 State: PUBLISHED Published: 2025-10-27T01:33:43.191Z Last Updated: 2025-11-13T10:33:47.353Z Vendors: Craig Hewitt Products: Seriously Simple Podcasting Problem Types: CWE-862 Description: Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through <= 3.13.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/seriously-simple-podcasting/vulnerability/wordpress-seriously-simple-podcasting-plugin-3-13-0-broken-access-control
ugin/seriously-simple-podcasting/vulnerability/wordpress-seriously-simple-podcasting-plugin-3-13-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-62883 State: PUBLISHED Published: 2025-10-27T01:33:43.581Z Last Updated: 2025-11-13T10:33:47.380Z Vendors: Premmerce Products: Premmerce User Roles Problem Types: CWE-862 Description: Missing Authorization vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce User Roles: from n/a through <= 1.0.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/premmerce-user-roles/vulnerability/wordpress-premmerce-user-roles-plugin-1-0-13-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-62884 State: PUBLISHED Published: 2025-10-27T01:33:43.969Z Last Updated: 2025-11-13T10:33:47.423Z Vendors: Elliot Sowersby / RelyWP Products: Coupon Affiliates Problem Types: CWE-862 Description: Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Coupon Affiliates: from n/a through <= 7.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/woo-coupon-usage/vulnerability/wordpress-coupon-affiliates-plugin-7-0-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-62885 State: PUBLISHED Published: 2025-10-27T01:33:44.357Z Last Updated: 2025-11-13T10:33:47.375Z Vendors: RexTheme Products: WP VR Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RexTheme WP VR wpvr allows DOM-Based XSS.This issue affects WP VR: from n/a through <= 8.5.42. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wpvr/vulnerability/wordpress-wp-vr-plugin-8-5-42-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-62886 State: PUBLISHED Published: 2025-10-27T01:33:44.741Z Last Updated: 2025-11-13T10:33:47.425Z Vendors: wpdevart Products: Pricing Table builder Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Pricing Table builder wpdevart-pricing-table allows Stored XSS.This issue affects Pricing Table builder: from n/a through <= 1.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wpdevart-pricing-table/vulnerability/wordpress-pricing-table-builder-plugin-1-5-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-62887 State: PUBLISHED Published: 2025-10-27T01:33:45.420Z Last Updated: 2025-11-13T10:33:47.462Z Vendors: KingAddons.com Products: King Addons for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KingAddons.com King Addons for Elementor king-addons allows DOM-Based XSS.This issue affects King Addons for Elementor: from n/a through <= 51.1.37. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/king-addons/vulnerability/wordpress-king-addons-for-elementor-plugin-51-1-37-cross-site-scripting-xss-vulnerability?_s_id
ing-addons/vulnerability/wordpress-king-addons-for-elementor-plugin-51-1-37-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-62889 State: PUBLISHED Published: 2025-10-27T01:33:45.909Z Last Updated: 2025-11-13T10:33:47.452Z Vendors: KingAddons.com Products: King Addons for Elementor Problem Types: CWE-862 Description: Missing Authorization vulnerability in KingAddons.com King Addons for Elementor king-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects King Addons for Elementor: from n/a through <= 51.1.37. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/king-addons/vulnerability/wordpress-king-addons-for-elementor-plugin-51-1-37-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-62890 State: PUBLISHED Published: 2025-10-27T01:33:46.308Z Last Updated: 2025-11-13T10:33:47.456Z Vendors: Premmerce Products: Premmerce Brands for WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Brands for WooCommerce premmerce-woocommerce-brands allows Cross Site Request Forgery.This issue affects Premmerce Brands for WooCommerce: from n/a through <= 1.2.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/premmerce-woocommerce-brands/vulnerability/wordpress-premmerce-brands-for-woocommerce-plugin-1-2-13-cross-site-request-forgery-csrf
oocommerce-brands/vulnerability/wordpress-premmerce-brands-for-woocommerce-plugin-1-2-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-62891 State: PUBLISHED Published: 2025-10-27T01:33:46.691Z Last Updated: 2025-11-13T10:33:47.451Z Vendors: Jory Hogeveen Products: Off-Canvas Sidebars & Menus (Slidebars) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) off-canvas-sidebars allows Cross Site Request Forgery.This issue affects Off-Canvas Sidebars & Menus (Slidebars): from n/a through <= 0.5.8.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/off-canvas-sidebars/vulnerability/wordpress-off-canvas-sidebars-menus-slidebars-plugin-0-5-8-5-cross-site-requ
ss/Plugin/off-canvas-sidebars/vulnerability/wordpress-off-canvas-sidebars-menus-slidebars-plugin-0-5-8-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-62892 State: PUBLISHED Published: 2025-10-27T01:33:47.085Z Last Updated: 2025-11-13T10:33:47.490Z Vendors: sunshinephotocart Products: Sunshine Photo Cart Problem Types: CWE-862 Description: Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/sunshine-photo-cart/vulnerability/wordpress-sunshine-photo-cart-plugin-3-5-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-62893 State: PUBLISHED Published: 2025-10-27T01:33:47.484Z Last Updated: 2025-11-13T10:33:47.483Z Vendors: mediavine Products: Create by Mediavine Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in mediavine Create by Mediavine mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create by Mediavine: from n/a through <= 1.9.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/mediavine-create/vulnerability/wordpress-create-by-mediavine-plugin-1-9-14-insecure-direct-object-references-idor-vulnerability?_
-create/vulnerability/wordpress-create-by-mediavine-plugin-1-9-14-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE ID: CVE-2025-62894 State: PUBLISHED Published: 2025-10-27T01:33:47.856Z Last Updated: 2025-11-13T10:33:47.529Z Vendors: magicoders Products: ACF Recent Posts Widget Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magicoders ACF Recent Posts Widget acf-recent-posts-widget allows Stored XSS.This issue affects ACF Recent Posts Widget: from n/a through <= 5.9.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/acf-recent-posts-widget/vulnerability/wordpress-acf-recent-posts-widget-plugin-5-9-3-cross-site-scripting-xss-vulnerability?_s_i
nt-posts-widget/vulnerability/wordpress-acf-recent-posts-widget-plugin-5-9-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-62895 State: PUBLISHED Published: 2025-10-27T01:33:48.249Z Last Updated: 2025-11-13T10:33:47.596Z Vendors: Vito Peleg Products: Atarim Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Retrieve Embedded Sensitive Data.This issue affects Atarim: from n/a through <= 4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/atarim-visual-collaboration/vulnerability/wordpress-atarim-plugin-4-2-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-62896 State: PUBLISHED Published: 2025-10-27T01:33:48.644Z Last Updated: 2025-11-13T10:33:47.595Z Vendors: digitaldonkey Products: Multilang Contact Form Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in digitaldonkey Multilang Contact Form multilang-contact-form allows Stored XSS.This issue affects Multilang Contact Form: from n/a through <= 1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/multilang-contact-form/vulnerability/wordpress-multilang-contact-form-plugin-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-62897 State: PUBLISHED Published: 2025-10-27T01:33:49.016Z Last Updated: 2025-11-13T10:33:47.627Z Vendors: Brecht Products: WP Recipe Maker Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brecht WP Recipe Maker wp-recipe-maker allows Code Injection.This issue affects WP Recipe Maker: from n/a through <= 10.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/wp-recipe-maker/vulnerability/wordpress-wp-recipe-maker-plugin-10-1-1-content-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-62898 State: PUBLISHED Published: 2025-10-27T01:33:49.376Z Last Updated: 2025-11-13T10:33:47.622Z Vendors: Maarten Products: Links shortcode Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maarten Links shortcode links-shortcode allows Stored XSS.This issue affects Links shortcode: from n/a through <= 1.8.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/links-shortcode/vulnerability/wordpress-links-shortcode-plugin-1-8-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-62899 State: PUBLISHED Published: 2025-10-27T01:33:49.758Z Last Updated: 2025-11-13T10:33:47.602Z Vendors: THRIVE - Web Design Gold Coast Products: Photospace Responsive Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in THRIVE - Web Design Gold Coast Photospace Responsive photospace-responsive allows Stored XSS.This issue affects Photospace Responsive: from n/a through <= 2.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/photospace-responsive/vulnerability/wordpress-photospace-responsive-plugin-2-2-0-cross-site-scri
tabase/Wordpress/Plugin/photospace-responsive/vulnerability/wordpress-photospace-responsive-plugin-2-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve