Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-49317 State: PUBLISHED Published: 2025-06-06T12:53:52.974Z Last Updated: 2025-06-06T19:22:54.107Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: NTC Products: WP Page Loading Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in NTC WP Page Loading allows Cross Site Request Forgery. This issue affects WP Page Loading: from n/a through 1.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-page-loading/vulnerability/wordpress-wp-page-loading-1-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-49318 State: PUBLISHED Published: 2025-06-06T12:53:53.437Z Last Updated: 2025-06-06T19:22:48.660Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: WPtouch Products: WPtouch Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPtouch WPtouch allows Stored XSS. This issue affects WPtouch: from n/a through 4.3.60. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wptouch/vulnerability/wordpress-wptouch-4-3-60-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49319 State: PUBLISHED Published: 2025-07-16T11:27:59.235Z Last Updated: 2025-07-16T20:25:00.443Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: WPFactory Products: Wishlist for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in WPFactory Wishlist for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Wishlist for WooCommerce: from n/a through 3.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wish-list-for-woocommerce/vulnerability/wordpress-wishlist-for-woocommerce-3-2-3-broken-acce
m/database/wordpress/plugin/wish-list-for-woocommerce/vulnerability/wordpress-wishlist-for-woocommerce-3-2-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49320 State: PUBLISHED Published: 2025-06-06T12:53:53.887Z Last Updated: 2025-06-06T19:22:42.805Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: fraudlabspro Products: FraudLabs Pro for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in fraudlabspro FraudLabs Pro for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FraudLabs Pro for WooCommerce: from n/a through 2.22.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/fraudlabs-pro-for-woocommerce/vulnerability/wordpress-fraudlabs-pro-f
- https://patchstack.com/database/wordpress/plugin/fraudlabs-pro-for-woocommerce/vulnerability/wordpress-fraudlabs-pro-for-woocommerce-2-22-11-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49321 State: PUBLISHED Published: 2025-06-27T11:52:32.006Z Last Updated: 2025-06-27T14:47:12.677Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Arraytics Products: Eventin Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Eventin allows Reflected XSS. This issue affects Eventin: from n/a through 4.0.28. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-eventin-4-0-28-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49322 State: PUBLISHED Published: 2025-06-06T12:53:54.330Z Last Updated: 2025-06-06T19:22:37.197Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: SeedProd Products: 404 Page by SeedProd Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeedProd 404 Page by SeedProd allows Stored XSS. This issue affects 404 Page by SeedProd: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/404-page/vulnerability/wordpress-404-page-by-seedprod-1-0-2-cross-site-scripting-xss-vulnerability?_
se/wordpress/plugin/404-page/vulnerability/wordpress-404-page-by-seedprod-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49323 State: PUBLISHED Published: 2025-06-06T12:53:54.778Z Last Updated: 2025-06-06T19:22:31.499Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: Themefic Products: Hydra Booking Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking allows SQL Injection. This issue affects Hydra Booking: from n/a through 1.1.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/hydra-booking/vulnerability/wordpress-hydra-booking-1-1-10-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49324 State: PUBLISHED Published: 2025-06-06T12:53:55.229Z Last Updated: 2025-06-06T19:22:26.059Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: PickPlugins Products: Job Board Manager Problem Types: CWE-862 Description: Missing Authorization vulnerability in PickPlugins Job Board Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Job Board Manager: from n/a through 2.1.60. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/job-board-manager/vulnerability/wordpress-job-board-manager-2-1-60-broken-access-control-vulnerability?_s_id
ress/plugin/job-board-manager/vulnerability/wordpress-job-board-manager-2-1-60-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49325 State: PUBLISHED Published: 2025-06-06T12:53:55.675Z Last Updated: 2025-06-06T19:22:20.518Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: Automattic Products: Newspack Newsletters Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Automattic Newspack Newsletters allows Phishing. This issue affects Newspack Newsletters: from n/a through 3.13.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/newspack-newsletters/vulnerability/wordpress-newspack-newsletters-3-13-0-open-redirection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49326 State: PUBLISHED Published: 2025-06-06T12:53:56.115Z Last Updated: 2025-06-06T16:25:37.788Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Ruben Garcia Products: GamiPress Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress allows SQL Injection. This issue affects GamiPress: from n/a through 7.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gamipress/vulnerability/wordpress-gamipress-7-4-5-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49327 State: PUBLISHED Published: 2025-06-06T12:53:56.553Z Last Updated: 2025-06-06T16:04:19.010Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Ruben Garcia Products: ShortLinks Pro Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia ShortLinks Pro allows SQL Injection. This issue affects ShortLinks Pro: from n/a through 1.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/shortlinkspro/vulnerability/wordpress-shortlinks-pro-1-0-7-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49328 State: PUBLISHED Published: 2025-06-06T12:53:57.015Z Last Updated: 2025-06-06T16:04:12.365Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Agile Logix Products: Store Locator WordPress Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agile Logix Store Locator WordPress allows SQL Injection. This issue affects Store Locator WordPress: from n/a through 1.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/agile-store-locator/vulnerability/wordpress-store-locator-wordpress-1-5-1-sql-inje
chstack.com/database/wordpress/plugin/agile-store-locator/vulnerability/wordpress-store-locator-wordpress-1-5-1-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49329 State: PUBLISHED Published: 2025-06-06T12:53:57.531Z Last Updated: 2025-06-06T16:04:05.121Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: Agile Logix Products: Store Locator WordPress Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Agile Logix Store Locator WordPress allows Upload a Web Shell to a Web Server. This issue affects Store Locator WordPress: from n/a through 1.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/agile-store-locator/vulnerability/wordpress-store-locator-wordpress-1-5-2-arbitrary-file-upload
atabase/wordpress/plugin/agile-store-locator/vulnerability/wordpress-store-locator-wordpress-1-5-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-49330 State: PUBLISHED Published: 2025-06-17T15:01:23.343Z Last Updated: 2025-06-20T13:13:17.417Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CRM Perks Products: Integration for Contact Form 7 and Zoho CRM, Bigin Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin allows Object Injection. This issue affects Integration for Contact Form 7 and Zoho CRM, Bigin: from n/a through 1.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cf7-zoho/vulnerability/wordpress-integration-for
ichment: References: - https://patchstack.com/database/wordpress/plugin/cf7-zoho/vulnerability/wordpress-integration-for-contact-form-7-and-zoho-crm-bigin-1-3-0-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49331 State: PUBLISHED Published: 2025-06-17T15:01:22.874Z Last Updated: 2025-06-20T13:13:22.955Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: impleCode Products: eCommerce Product Catalog Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in impleCode eCommerce Product Catalog allows Object Injection. This issue affects eCommerce Product Catalog: from n/a through 3.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ecommerce-product-catalog/vulnerability/wordpress-ecommerce-product-catalog-3-4-3-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49332 State: PUBLISHED Published: 2025-06-06T12:53:57.993Z Last Updated: 2025-06-06T16:03:55.542Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: codepeople Products: WP Time Slots Booking Form Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in codepeople WP Time Slots Booking Form allows Cross Site Request Forgery. This issue affects WP Time Slots Booking Form: from n/a through 1.2.30. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-time-slots-booking-form/vulnerability/wordpress-wp-time-slots-booking-form-1-2-30-cross-site-request-forge
ess/plugin/wp-time-slots-booking-form/vulnerability/wordpress-wp-time-slots-booking-form-1-2-30-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-49333 State: PUBLISHED Published: 2025-06-06T12:53:58.451Z Last Updated: 2025-06-06T16:03:48.797Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: wp.insider Products: Simple Membership Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp.insider Simple Membership allows Stored XSS. This issue affects Simple Membership: from n/a through 4.6.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-membership/vulnerability/wordpress-simple-membership-4-6-3-cross-site-scripting-xss-vulnerabilit
wordpress/plugin/simple-membership/vulnerability/wordpress-simple-membership-4-6-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-49372 State: PUBLISHED Published: 2025-11-06T15:53:50.181Z Last Updated: 2025-11-13T10:33:40.318Z Vendors: VillaTheme Products: HAPPY Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Remote Code Inclusion.This issue affects HAPPY: from n/a through <= 1.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/happy-helpdesk-support-ticket-system/vulnerability/wordpress-happy-plugin-1-0-7-remote-code-execution-rce-vulnerability?_s_id=cve
CVE ID: CVE-2025-49373 State: PUBLISHED Published: 2025-10-22T14:32:08.403Z Last Updated: 2025-11-13T10:33:40.040Z Vendors: Evergreen Content Poster Products: Evergreen Content Poster Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Evergreen Content Poster Evergreen Content Poster evergreen-content-poster allows Cross Site Request Forgery.This issue affects Evergreen Content Poster: from n/a through <= 1.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/evergreen-content-poster/vulnerability/wordpress-evergreen-content-poster-plugin-1-4-5-cross-site-request-forgery-csrf-vulnerabili
content-poster/vulnerability/wordpress-evergreen-content-poster-plugin-1-4-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-49374 State: PUBLISHED Published: 2025-10-22T14:32:08.617Z Last Updated: 2025-11-13T10:33:40.251Z Vendors: captcha.eu Products: Captcha.eu Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in captcha.eu Captcha.eu captcha-eu allows Server Side Request Forgery.This issue affects Captcha.eu: from n/a through <= 1.0.61. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/captcha-eu/vulnerability/wordpress-captcha-eu-plugin-1-0-61-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-49376 State: PUBLISHED Published: 2025-10-22T14:32:08.837Z Last Updated: 2025-11-13T10:33:40.284Z Vendors: DELUCKS Products: DELUCKS SEO Problem Types: CWE-862 Description: Missing Authorization vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects DELUCKS SEO: from n/a through <= 2.5.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/delucks-seo/vulnerability/wordpress-delucks-seo-plugin-2-5-9-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49377 State: PUBLISHED Published: 2025-10-22T14:32:09.195Z Last Updated: 2025-11-13T10:33:40.480Z Vendors: Themefic Products: Hydra Booking Problem Types: CWE-862 Description: Missing Authorization vulnerability in Themefic Hydra Booking hydra-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hydra Booking: from n/a through <= 1.1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/hydra-booking/vulnerability/wordpress-hydra-booking-plugin-1-1-9-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-49378 State: PUBLISHED Published: 2025-10-22T14:32:09.452Z Last Updated: 2025-11-13T10:33:40.530Z Vendors: Themefic Products: Hydra Booking Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/hydra-booking/vulnerability/wordpress-hydra-booking-plugin-1-1-10-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49380 State: PUBLISHED Published: 2025-10-22T14:32:09.626Z Last Updated: 2025-11-13T10:33:40.563Z Vendors: wpinstinct Products: WooCommerce Vehicle Parts Finder Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in wpinstinct WooCommerce Vehicle Parts Finder woo-vehicle-parts-finder allows Object Injection.This issue affects WooCommerce Vehicle Parts Finder: from n/a through <= 3.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/woo-vehicle-parts-finder/vulnerability/wordpress-woocommerce-vehicle-parts-finder-plugin-3-7-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49381 State: PUBLISHED Published: 2025-08-20T08:03:55.230Z Last Updated: 2025-08-20T13:35:36.354Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: ads.txt Guru Products: ads.txt Guru Connect Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ads.txt Guru ads.txt Guru Connect allows Cross Site Request Forgery. This issue affects ads.txt Guru Connect: from n/a through 1.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/adstxt-guru-connect/vulnerability/wordpress-ads-txt-guru-connect-plugin-1-1-1-cross-site-request-forgery-csrf-vulnerabilit
stxt-guru-connect/vulnerability/wordpress-ads-txt-guru-connect-plugin-1-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-49382 State: PUBLISHED Published: 2025-08-20T08:03:54.651Z Last Updated: 2025-08-20T13:36:39.971Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: DexignZone Products: JobZilla - Job Board WordPress Theme Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in DexignZone JobZilla - Job Board WordPress Theme allows Privilege Escalation. This issue affects JobZilla - Job Board WordPress Theme: from n/a through 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/jobzilla/vulnerability/wordpress-jobzilla-job-board-wordpress-theme-theme-2-0-cross-site-re
com/database/wordpress/theme/jobzilla/vulnerability/wordpress-jobzilla-job-board-wordpress-theme-theme-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-49383 State: PUBLISHED Published: 2025-08-28T12:37:12.575Z Last Updated: 2025-08-28T14:20:29.008Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CocoBasic Products: Neresa Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CocoBasic Neresa allows PHP Local File Inclusion. This issue affects Neresa: from n/a through 1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/neresa-wp/vulnerability/wordpress-neresa-theme-1-3-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-49384 State: PUBLISHED Published: 2025-06-17T20:40:21.350Z Last Updated: 2025-06-18T15:42:37.957Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Internet Security (Consumer) Problem Types: CWE-64 Description: Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-11112
CVE ID: CVE-2025-49385 State: PUBLISHED Published: 2025-06-17T20:40:29.929Z Last Updated: 2025-06-18T15:37:33.230Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Trend Micro, Inc. Products: Trend Micro Internet Security (Consumer) Problem Types: CWE-64 Description: Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-18461 - https://www.zerodayinitiative.com/advisories/ZDI-25-380
: - https://helpcenter.trendmicro.com/en-us/article/TMKA-18461 - https://www.zerodayinitiative.com/advisories/ZDI-25-380/
CVE ID: CVE-2025-49386 State: PUBLISHED Published: 2025-11-06T15:53:50.934Z Last Updated: 2025-11-13T10:33:40.559Z Vendors: Scott Reilly Products: Preserve Code Formatting Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Scott Reilly Preserve Code Formatting preserve-code-formatting allows Object Injection.This issue affects Preserve Code Formatting: from n/a through <= 4.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/preserve-code-formatting/vulnerability/wordpress-preserve-code-formatting-plugin-4-0-1-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-49387 State: PUBLISHED Published: 2025-08-28T12:37:13.181Z Last Updated: 2025-08-28T15:38:44.366Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: add-ons.org Products: Drag and Drop File Upload for Elementor Forms Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms allows Upload a Web Shell to a Web Server. This issue affects Drag and Drop File Upload for Elementor Forms: from n/a through 1.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/drag-and-drop-file-upload-fo
es: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/drag-and-drop-file-upload-for-elementor-forms/vulnerability/wordpress-drag-and-drop-file-upload-for-elementor-forms-plugin-1-5-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-49388 State: PUBLISHED Published: 2025-08-28T12:37:13.815Z Last Updated: 2025-08-28T15:32:50.543Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: kamleshyadav Products: Miraculous Core Plugin Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in kamleshyadav Miraculous Core Plugin allows Privilege Escalation. This issue affects Miraculous Core Plugin: from n/a through 2.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/miraculouscore/vulnerability/wordpress-miraculous-core-plugin-plugin-2-0-7-privilege-escalation-vulnerability?_s_id=cve