Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-10120 State: PUBLISHED Published: 2025-09-09T01:32:12.388Z Last Updated: 2025-09-09T14:06:35.948Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR) Vendors: Tenda Products: AC20 Problem Types: CWE-120, CWE-119 Description: A vulnerability was detected in Tenda AC20 up to 16.03.08.12. The impacted element is the function strcpy of the file /goform/GetParentControlInfo. The manipulation of the argument mac results in buffer overflow. The attack may be performed from remote. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323089 - https://vuldb.com/?ctiid.323089 - https://vuldb.c
- CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323089 - https://vuldb.com/?ctiid.323089 - https://vuldb.com/?submit.645680 - https://github.com/cymiao1978/cve/blob/main/4.md - https://github.com/cymiao1978/cve/blob/main/4.md#poc - https://www.tenda.com.cn/
CVE ID: CVE-2025-10121 State: PUBLISHED Published: 2025-09-09T02:02:06.058Z Last Updated: 2025-09-09T14:28:44.563Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: uverif Problem Types: CWE-89, CWE-74 Description: A flaw has been found in uverif up to 3.2. This affects the function addbatch of the file /admin/kami_list. This manipulation of the argument note causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323090 - https://vuldb.com/?ctiid.323090 - https://vuldb.com/?submit.645685 - https://gith
nces: - https://vuldb.com/?id.323090 - https://vuldb.com/?ctiid.323090 - https://vuldb.com/?submit.645685 - https://github.com/Axianke/cve_bug/issues/1
CVE ID: CVE-2025-10122 State: PUBLISHED Published: 2025-09-09T02:32:07.071Z Last Updated: 2025-09-09T19:24:14.503Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: n/a Products: Maccms10 Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in Maccms10 2025.1000.4050. Affected is the function rep of the file application/admin/controller/Database.php. Performing manipulation of the argument where results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323092 - https://vuldb.com/?ctiid.323092 - https://vu
otes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323092 - https://vuldb.com/?ctiid.323092 - https://vuldb.com/?submit.645702 - https://github.com/August829/Yu/blob/main/58ead8e7e08bfb016.md
CVE ID: CVE-2025-10123 State: PUBLISHED Published: 2025-09-09T02:32:10.145Z Last Updated: 2025-09-09T19:24:43.181Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: D-Link Products: DIR-823X Problem Types: CWE-77, CWE-74 Description: A vulnerability was determined in D-Link DIR-823X up to 250416. Affected by this vulnerability is the function sub_415028 of the file /goform/set_static_leases. Executing manipulation of the argument Hostname can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323093 - htt
and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.323093 - https://vuldb.com/?ctiid.323093 - https://vuldb.com/?submit.645712 - https://github.com/lin-3-start/lin-cve/blob/main/DIR-823X/D-Link%20DIR-823X%20routers%20have%20an%20unauthorized%20command%20execution%20vulnerability.md - https://github.com/lin-3-start/lin-cve/blob/main/DIR-823X/D-Link%20DIR-823X%20routers%20have%20an%20unauthorized%20command%20execution%20vulnerability.md#poc - https://www.dlink.com/
CVE ID: CVE-2025-10124 State: PUBLISHED Published: 2025-10-10T06:00:06.988Z Last Updated: 2025-11-13T20:54:19.658Z Vendors: Unknown Products: Booking Manager Problem Types: CWE-863 Incorrect Authorization Description: The Booking Manager WordPress plugin before 2.1.15 registers a shortcode that deletes bookings and makes that shortcode available to anyone with contributor and above privileges. When a page containing the shortcode is visited, the bookings are deleted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9bb0589f-34bb-40e1-b7f0-ee883b7b896c/
CVE ID: CVE-2025-10125 State: PUBLISHED Published: 2025-09-17T04:01:15.516Z Last Updated: 2025-09-17T12:46:31.399Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: strangerstudios Products: Memberlite Shortcodes Problem Types: CWE-80 Description: The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'row' shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a u
ackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ceb7316e-8b55-4e7a-9309-8a9e84f22c90?source=cve - https://plugins.trac.wordpress.org/browser/memberlite-shortcodes/tags/1.4/shortcodes/columns.php#L12 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3359252%40memberlite-shortcodes&new=3359252%40memberlite-shortcodes&sfp_email=&sfph_mail=
CVE ID: CVE-2025-10126 State: PUBLISHED Published: 2025-09-10T06:38:50.789Z Last Updated: 2025-09-10T15:39:34.191Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: markohoven Products: MyBrain Utilities Problem Types: CWE-79 Description: The MyBrain Utilities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'mbumap' shortcode in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user acce
with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c722238a-6222-48f8-9b01-bdba56490c83?source=cve - https://plugins.trac.wordpress.org/browser/mybrain-utilities/tags/1.0.7/public/class-mybrain-utilities-public.php#L970 - https://plugins.trac.wordpress.org/changeset/3358574
CVE ID: CVE-2025-10127 State: PUBLISHED Published: 2025-09-11T19:44:35.008Z Last Updated: 2025-09-24T13:36:09.876Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Daikin Europe N.V Products: Security Gateway Problem Types: CWE-640 Description: Daikin Europe N.V Security Gateway is vulnerable to an authorization bypass through a user-controlled key vulnerability that could allow an attacker to bypass authentication. An unauthorized attacker could access the system without prior credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-10 - https://www.daikin.eu/en_us/customers/s
: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-10 - https://www.daikin.eu/en_us/customers/support.html
CVE ID: CVE-2025-10128 State: PUBLISHED Published: 2025-09-30T03:35:32.618Z Last Updated: 2025-09-30T15:37:41.439Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: michaellow Products: Eulerpool Research Systems Problem Types: CWE-80 Description: The Eulerpool Research Systems plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aaq' shortcode in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenev
ed attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e0b4267b-2929-489b-86b8-cd256708c5bd?source=cve - https://plugins.trac.wordpress.org/browser/alleaktien-quantitativ/trunk/aaq-fundamentals-plugin.php#L36
CVE ID: CVE-2025-10129 State: PUBLISHED Published: 2025-10-11T09:28:42.420Z Last Updated: 2025-10-14T18:44:43.255Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: miksco Products: WordPress Live Webcam Widget & Shortcode Problem Types: CWE-79 Description: The WordPress Live Webcam Widget & Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'webcam' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages
possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/edc4875e-3eca-4c25-a65c-93182912cd24?source=cve - https://plugins.trac.wordpress.org/browser/wp-webcam-widget-shortcode/trunk/wordpress-webcam.php#L174
CVE ID: CVE-2025-10130 State: PUBLISHED Published: 2025-09-30T03:35:25.966Z Last Updated: 2025-09-30T13:22:17.818Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: stripeswp Products: Layers Problem Types: CWE-79 Description: The Layers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'webcam' shortcode in all versions up to, and including, 0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Add
ess and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3ea00ce9-e48f-4641-844c-ced7db60d62d?source=cve - https://plugins.trac.wordpress.org/browser/layers/trunk/layers.php#L36 - https://wordpress.org/plugins/layers
CVE ID: CVE-2025-10131 State: PUBLISHED Published: 2025-09-30T03:35:27.821Z Last Updated: 2025-09-30T15:26:19.657Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: codiblog Products: All Social Share Options Problem Types: CWE-79 Description: The All Social Share Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sc' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user
ers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8761c046-35da-4fc9-a839-c06405ff4b31?source=cve - https://plugins.trac.wordpress.org/browser/all-social-share-options/trunk/shortcodes.php#L14
CVE ID: CVE-2025-10132 State: PUBLISHED Published: 2025-10-15T08:25:56.786Z Last Updated: 2025-10-15T14:02:40.552Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: dash8x Products: Dhivehi Text Problem Types: CWE-79 Description: The Dhivehi Text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dhivehi' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected
-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/74ff6acc-b362-428a-b227-24282e0f2783?source=cve - https://plugins.trac.wordpress.org/browser/dhivehi-text/tags/0.1/dhivehi-text.php#L105
CVE ID: CVE-2025-10133 State: PUBLISHED Published: 2025-10-15T08:25:55.537Z Last Updated: 2025-10-15T14:44:23.833Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: salamzadeh Products: URLYar URL Shortner Problem Types: CWE-79 Description: The URLYar URL Shortner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'urlyar_shortlink' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute wheneve
d attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/51867e4f-75be-4451-a585-87398881adf5?source=cve - https://plugins.trac.wordpress.org/browser/urlyar/trunk/urlyar.php#L604
CVE ID: CVE-2025-10134 State: PUBLISHED Published: 2025-09-09T08:22:36.849Z Last Updated: 2025-09-09T19:27:34.597Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Bearsthemes Products: Goza - Nonprofit Charity WordPress Theme Problem Types: CWE-73 Description: The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the alone_import_pack_restore_data() function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file i
attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/73efd9ad-9515-4ca8-bfb3-1d478f39c2b9?source=cve - https://themeforest.net/item/goza-nonprofit-charity-wordpress-theme/23781575
CVE ID: CVE-2025-10135 State: PUBLISHED Published: 2025-10-15T08:25:57.507Z Last Updated: 2025-10-15T13:55:00.290Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: falldeaf Products: WP ViewSTL Problem Types: CWE-79 Description: The WP ViewSTL plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'viewstl' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected p
evel access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/882070df-8a76-490b-a77c-03cdf84c481f?source=cve - https://wordpress.org/plugins/wp-viewstl/
CVE ID: CVE-2025-10136 State: PUBLISHED Published: 2025-09-26T06:43:29.535Z Last Updated: 2025-09-26T19:52:42.224Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: douglaskarr Products: TweetThis Shortcode Problem Types: CWE-79 Description: The TweetThis Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tweetthis' shortcode in all versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a us
ckers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e45e0ff1-3e74-4eee-a4ff-8ec033599bc3?source=cve - https://plugins.svn.wordpress.org/tweetthis-shortcode/tags/1.8.0/dkts.php
CVE ID: CVE-2025-10137 State: PUBLISHED Published: 2025-09-26T06:43:28.669Z Last Updated: 2025-09-26T19:51:08.705Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: inc2734 Products: Snow Monkey Problem Types: CWE-918 Description: The Snow Monkey theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 29.1.5 via the request() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.
modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3d4a938a-044b-4991-bc4c-db9e15210f06?source=cve - https://github.com/inc2734/wp-oembed-blog-card - https://github.com/inc2734/wp-oembed-blog-card/blob/master/src/App/Model/Requester.php#L64-L89 - https://github.com/inc2734/wp-oembed-blog-card/compare/14.0.1...14.0.2 - https://github.com/inc2734/snow-monkey/compare/29.1.5...29.1.6
CVE ID: CVE-2025-10138 State: PUBLISHED Published: 2025-10-22T08:27:05.416Z Last Updated: 2025-10-22T15:25:12.240Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: andrex84 Products: This-or-That Problem Types: CWE-79 Description: The This-or-That plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'thisorthat' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an i
ributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/22f291eb-d1f8-40d6-b020-f6364164dc40?source=cve - https://plugins.trac.wordpress.org/browser/this-or-that/trunk/this-or-that.php#L232
CVE ID: CVE-2025-10139 State: PUBLISHED Published: 2025-10-15T08:25:49.749Z Last Updated: 2025-10-15T15:49:11.358Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: remko Products: WP BookWidgets Problem Types: CWE-79 Description: The WP BookWidgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bw_link' shortcode in all versions up to, and including, 0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injec
tor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1716743f-8259-40fb-bc9b-53e3dfef8816?source=cve - https://plugins.trac.wordpress.org/browser/wp-bookwidgets/trunk/wp-bookwidgets.php#L163 - https://wordpress.org/plugins/wp-bookwidgets
CVE ID: CVE-2025-10140 State: PUBLISHED Published: 2025-10-15T08:25:59.746Z Last Updated: 2025-10-15T14:54:27.048Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: andreiigna Products: Quick Social Login Problem Types: CWE-79 Description: The Quick Social Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quick-login' shortcode in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a use
kers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/aabf1911-5c6f-4486-a750-d5c95f5815ba?source=cve - https://plugins.trac.wordpress.org/browser/quick-login/trunk/src/Buttons.php#L85 - https://wordpress.org/plugins/quick-login
CVE ID: CVE-2025-10141 State: PUBLISHED Published: 2025-10-15T08:26:04.038Z Last Updated: 2025-10-15T13:30:24.930Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: digiseller Products: Digiseller Problem Types: CWE-79 Description: The Digiseller plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ds' shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pa
vel access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d783b6ca-940c-4939-b96a-339419d8ed56?source=cve - https://plugins.trac.wordpress.org/browser/digiseller/trunk/digiseller.php#L61 - https://wordpress.org/plugins/digiseller
CVE ID: CVE-2025-10142 State: PUBLISHED Published: 2025-09-10T06:38:51.593Z Last Updated: 2025-09-10T14:59:27.883Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: martins56 Products: PagBank / PagSeguro Connect para WooCommerce Problem Types: CWE-89 Description: The PagBank / PagSeguro Connect para WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 4.44.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append addi