Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-48240 State: PUBLISHED Published: 2025-05-19T14:44:53.148Z Last Updated: 2025-05-19T15:20:08.032Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPFactory Products: Cost of Goods for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Cost of Goods for WooCommerce allows Stored XSS. This issue affects Cost of Goods for WooCommerce: from n/a through 3.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cost-of-goods-for-woocommerce/vulnerability/wordpress-cost-of-goods-f
- https://patchstack.com/database/wordpress/plugin/cost-of-goods-for-woocommerce/vulnerability/wordpress-cost-of-goods-for-woocommerce-3-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48241 State: PUBLISHED Published: 2025-05-23T12:43:17.808Z Last Updated: 2025-05-27T14:31:14.594Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Soft8Soft LLC Products: Verge3D Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soft8Soft LLC Verge3D allows Reflected XSS. This issue affects Verge3D: from n/a through 4.9.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/verge3d/vulnerability/wordpress-verge3d-plugin-4-9-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48242 State: PUBLISHED Published: 2025-05-19T14:44:53.592Z Last Updated: 2025-05-19T15:19:59.912Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: wpWax Products: Legal Pages Problem Types: CWE-862 Description: Missing Authorization vulnerability in wpWax Legal Pages allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Legal Pages: from n/a through 1.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/legal-pages/vulnerability/wordpress-legal-pages-1-4-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-48243 State: PUBLISHED Published: 2025-05-19T14:44:54.055Z Last Updated: 2025-05-19T15:19:54.072Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Bill Minozzi Products: reCAPTCHA for all Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Bill Minozzi reCAPTCHA for all allows Cross Site Request Forgery. This issue affects reCAPTCHA for all: from n/a through 2.26. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/recaptcha-for-all/vulnerability/wordpress-recaptcha-for-all-2-26-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-48244 State: PUBLISHED Published: 2025-05-19T14:44:54.508Z Last Updated: 2025-05-19T15:19:48.345Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Tim Strifler Products: Exclusive Addons Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor allows Stored XSS. This issue affects Exclusive Addons Elementor: from n/a through 2.7.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/exclusive-addons-for-elementor/vulnerability/wordpress-exclusive-addons-
ttps://patchstack.com/database/wordpress/plugin/exclusive-addons-for-elementor/vulnerability/wordpress-exclusive-addons-elementor-2-7-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48245 State: PUBLISHED Published: 2025-05-23T12:43:17.321Z Last Updated: 2025-05-27T14:31:36.405Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: fullworks Products: Quick Contact Form Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fullworks Quick Contact Form allows Reflected XSS. This issue affects Quick Contact Form : from n/a through 8.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/quick-contact-form/vulnerability/wordpress-quick-contact-form-plugin-8-2-1-reflected-cross-site-scri
se/wordpress/plugin/quick-contact-form/vulnerability/wordpress-quick-contact-form-plugin-8-2-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48246 State: PUBLISHED Published: 2025-05-19T14:44:54.964Z Last Updated: 2025-05-19T15:19:41.886Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: The Events Calendar Products: The Events Calendar Problem Types: CWE-862 Description: Missing Authorization vulnerability in The Events Calendar The Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Events Calendar: from n/a through 6.11.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/the-events-calendar/vulnerability/wordpress-the-events-calendar-6-11-2-1-broken-acce
stack.com/database/wordpress/plugin/the-events-calendar/vulnerability/wordpress-the-events-calendar-6-11-2-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-48247 State: PUBLISHED Published: 2025-05-19T14:44:55.413Z Last Updated: 2025-05-19T15:19:36.395Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Blair Williams Products: Shortlinks by Pretty Links Problem Types: CWE-862 Description: Missing Authorization vulnerability in Blair Williams Shortlinks by Pretty Links allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Shortlinks by Pretty Links: from n/a through 3.6.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/pretty-link/vulnerability/wordpress-shortlinks-by-pretty-links-3-6-15-broke
s://patchstack.com/database/wordpress/plugin/pretty-link/vulnerability/wordpress-shortlinks-by-pretty-links-3-6-15-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-48248 State: PUBLISHED Published: 2025-05-19T14:44:55.865Z Last Updated: 2025-05-19T15:19:30.759Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPFactory Products: Sitewide Discount for WooCommerce: Apply Discount to All Products Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Sitewide Discount for WooCommerce: Apply Discount to All Products allows Stored XSS. This issue affects Sitewide Discount for WooCommerce: Apply Discount to All Products: from n/a through 2.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://pa
unt to All Products: from n/a through 2.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/global-shop-discount-for-woocommerce/vulnerability/wordpress-sitewide-discount-for-woocommerce-apply-discount-to-all-products-2-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48249 State: PUBLISHED Published: 2025-05-19T14:44:56.380Z Last Updated: 2025-05-19T15:19:24.496Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPFactory Products: EAN for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory EAN for WooCommerce allows Stored XSS. This issue affects EAN for WooCommerce: from n/a through 5.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ean-for-woocommerce/vulnerability/wordpress-ean-for-woocommerce-5-4-6-cross-site-scripting-xss-vuln
ase/wordpress/plugin/ean-for-woocommerce/vulnerability/wordpress-ean-for-woocommerce-5-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48250 State: PUBLISHED Published: 2025-05-19T14:44:56.839Z Last Updated: 2025-05-19T15:19:19.239Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPFactory Products: Coupons &amp; Add to Cart by URL Links for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Coupons &amp; Add to Cart by URL Links for WooCommerce allows Stored XSS. This issue affects Coupons &amp; Add to Cart by URL Links for WooCommerce: from n/a through 1.7.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/p
ough 1.7.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/url-coupons-for-woocommerce-by-algoritmika/vulnerability/wordpress-coupons-add-to-cart-by-url-links-for-woocommerce-1-7-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48251 State: PUBLISHED Published: 2025-05-19T14:44:57.292Z Last Updated: 2025-05-19T15:19:13.535Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPFactory Products: Additional Custom Emails &amp; Recipients for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Emails &amp; Recipients for WooCommerce allows Stored XSS. This issue affects Additional Custom Emails &amp; Recipients for WooCommerce: from n/a through 3.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wo
m n/a through 3.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/custom-emails-for-woocommerce/vulnerability/wordpress-additional-custom-emails-recipients-for-woocommerce-3-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48252 State: PUBLISHED Published: 2025-05-19T14:44:57.782Z Last Updated: 2025-05-19T15:19:06.163Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPFactory Products: Back Button Widget Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Back Button Widget allows Stored XSS. This issue affects Back Button Widget: from n/a through 1.6.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/back-button-widget/vulnerability/wordpress-back-button-widget-1-6-8-cross-site-scripting-xss-vulnerabi
/wordpress/plugin/back-button-widget/vulnerability/wordpress-back-button-widget-1-6-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48253 State: PUBLISHED Published: 2025-05-19T14:44:58.246Z Last Updated: 2025-05-19T15:18:59.515Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPFactory Products: Free Shipping Bar: Amount Left for Free Shipping for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Free Shipping Bar: Amount Left for Free Shipping for WooCommerce allows Stored XSS. This issue affects Free Shipping Bar: Amount Left for Free Shipping for WooCommerce: from n/a through 2.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patch
for WooCommerce: from n/a through 2.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/amount-left-free-shipping-woocommerce/vulnerability/wordpress-free-shipping-bar-amount-left-for-free-shipping-for-woocommerce-2-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48254 State: PUBLISHED Published: 2025-05-19T14:44:58.736Z Last Updated: 2025-05-19T15:18:52.618Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPFactory Products: Change Add to Cart Button Text for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Change Add to Cart Button Text for WooCommerce allows Stored XSS. This issue affects Change Add to Cart Button Text for WooCommerce: from n/a through 2.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/add-to-cart-button
nalyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/add-to-cart-button-labels-for-woocommerce/vulnerability/wordpress-change-add-to-cart-button-text-for-woocommerce-2-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48255 State: PUBLISHED Published: 2025-05-19T14:44:59.186Z Last Updated: 2025-05-19T15:18:46.461Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: videowhisper Products: Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in videowhisper Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP allows Cross Site Request Forgery. This issue affects Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP: from n/a through 6.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/pl
ugh 6.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/videowhisper-live-streaming-integration/vulnerability/wordpress-broadcast-live-video-live-streaming-webrtc-hls-rtsp-rtmp-6-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-48256 State: PUBLISHED Published: 2025-05-19T14:44:59.649Z Last Updated: 2025-05-19T15:18:38.995Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Xylus Themes Products: Import Social Events Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes Import Social Events allows Stored XSS. This issue affects Import Social Events: from n/a through 1.8.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/import-facebook-events/vulnerability/wordpress-import-social-events-1-8-5-cross-site-scrip
com/database/wordpress/plugin/import-facebook-events/vulnerability/wordpress-import-social-events-1-8-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48257 State: PUBLISHED Published: 2025-05-19T14:45:00.326Z Last Updated: 2025-05-19T15:18:30.631Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Projectopia Products: Projectopia Problem Types: CWE-862 Description: Missing Authorization vulnerability in Projectopia Projectopia allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Projectopia: from n/a through 5.1.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/projectopia-core/vulnerability/wordpress-projectopia-5-1-17-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-48258 State: PUBLISHED Published: 2025-05-19T14:45:00.913Z Last Updated: 2025-05-19T15:18:21.217Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: jetmonsters Products: Mega Menu Block Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jetmonsters Mega Menu Block allows Stored XSS. This issue affects Mega Menu Block: from n/a through 1.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/getwid-megamenu/vulnerability/wordpress-mega-menu-block-1-0-6-cross-site-scripting-xss-vulnerability?_s_id=
press/plugin/getwid-megamenu/vulnerability/wordpress-mega-menu-block-1-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48259 State: PUBLISHED Published: 2025-05-19T14:45:01.435Z Last Updated: 2025-05-19T15:18:06.833Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Juan Carlos Products: WP Mapa Politico España Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Juan Carlos WP Mapa Politico España allows Cross Site Request Forgery. This issue affects WP Mapa Politico España: from n/a through 3.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-mapa-politico-spain/vulnerability/wordpress-wp-mapa-politico-espana-plugin-3-8-0-cross-site-request-forgery-csrf-t
in/wp-mapa-politico-spain/vulnerability/wordpress-wp-mapa-politico-espana-plugin-3-8-0-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE ID: CVE-2025-48260 State: PUBLISHED Published: 2025-05-19T14:45:02.120Z Last Updated: 2025-05-19T15:17:59.286Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Ninja Team Products: GDPR CCPA Compliance Support Problem Types: CWE-862 Description: Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GDPR CCPA Compliance Support: from n/a through 2.7.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ninja-gdpr-compliance/vulnerability/wordpress-gdpr-ccpa-compliance-support-2-7
/patchstack.com/database/wordpress/plugin/ninja-gdpr-compliance/vulnerability/wordpress-gdpr-ccpa-compliance-support-2-7-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-48261 State: PUBLISHED Published: 2025-06-09T15:53:56.298Z Last Updated: 2025-06-10T13:52:28.985Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: MultiVendorX Products: MultiVendorX Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in MultiVendorX MultiVendorX allows Retrieve Embedded Sensitive Data. This issue affects MultiVendorX: from n/a through 4.2.22. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/dc-woocommerce-multi-vendor/vulnerability/wordpress-multivendorx-4-2-22-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-48262 State: PUBLISHED Published: 2025-05-19T14:45:02.598Z Last Updated: 2025-05-19T15:17:53.769Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Michael Revellin-Clerc Products: Url Rewrite Analyzer Problem Types: CWE-862 Description: Missing Authorization vulnerability in Michael Revellin-Clerc Url Rewrite Analyzer allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Url Rewrite Analyzer: from n/a through 1.3.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/url-rewrite-analyzer/vulnerability/wordpress-url-rewrite-analyzer-1-3-3-broken
/patchstack.com/database/wordpress/plugin/url-rewrite-analyzer/vulnerability/wordpress-url-rewrite-analyzer-1-3-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-48263 State: PUBLISHED Published: 2025-05-19T14:45:11.886Z Last Updated: 2025-05-19T15:17:48.130Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: MultiVendorX Products: MultiVendorX Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX MultiVendorX allows Stored XSS. This issue affects MultiVendorX: from n/a through 4.2.22. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/dc-woocommerce-multi-vendor/vulnerability/wordpress-multivendorx-4-2-22-cross-site-scripting-xss-vulnerability?_s
plugin/dc-woocommerce-multi-vendor/vulnerability/wordpress-multivendorx-4-2-22-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48264 State: PUBLISHED Published: 2025-05-19T14:45:12.414Z Last Updated: 2025-05-19T15:17:42.679Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: artiosmedia Products: Product Code for WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in artiosmedia Product Code for WooCommerce allows Cross Site Request Forgery. This issue affects Product Code for WooCommerce: from n/a through 1.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/product-code-for-woocommerce/vulnerability/wordpress-product-code-for-woocommerce-plugin-1-5-0-csrf-to
/wordpress/plugin/product-code-for-woocommerce/vulnerability/wordpress-product-code-for-woocommerce-plugin-1-5-0-csrf-to-database-update-vulnerability?_s_id=cve
CVE ID: CVE-2025-48265 State: PUBLISHED Published: 2025-05-19T14:45:12.920Z Last Updated: 2025-05-19T15:17:37.066Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Pektsekye Products: Year Make Model Search for WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Pektsekye Year Make Model Search for WooCommerce allows Cross Site Request Forgery. This issue affects Year Make Model Search for WooCommerce: from n/a through 1.0.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ymm-search/vulnerability/wordpress-year-make-model-search-for-woocommerce-p
s://patchstack.com/database/wordpress/plugin/ymm-search/vulnerability/wordpress-year-make-model-search-for-woocommerce-plugin-1-0-11-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE ID: CVE-2025-48266 State: PUBLISHED Published: 2025-05-19T14:45:16.146Z Last Updated: 2025-05-19T15:17:31.339Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: RealMag777 Products: Active Products Tables for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 Active Products Tables for WooCommerce allows Stored XSS. This issue affects Active Products Tables for WooCommerce: from n/a through 1.0.6.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/profit-products-tables-for-woocommerce
ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/profit-products-tables-for-woocommerce/vulnerability/wordpress-active-products-tables-for-woocommerce-1-0-6-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48267 State: PUBLISHED Published: 2025-06-09T15:53:55.539Z Last Updated: 2025-06-09T19:46:17.649Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: ThimPress Products: WP Pipes Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes allows Path Traversal. This issue affects WP Pipes: from n/a through 1.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-pipes/vulnerability/wordpress-wp-pipes-1-4-2-arbitrary-file-deletion-vulnerability?_s_id=cve