Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-26735 State: PUBLISHED Published: 2025-05-19T18:01:42.890Z Last Updated: 2025-05-19T21:22:59.160Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Candid themes Products: Grip Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Candid themes Grip.This issue affects Grip: from n/a through 1.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/grip/vulnerability/wordpress-grip-theme-1-0-9-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-26736 State: PUBLISHED Published: 2025-03-27T13:57:39.508Z Last Updated: 2025-04-03T13:19:32.812Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: viktoras Products: MorningTime Lite Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in viktoras MorningTime Lite allows Stored XSS.This issue affects MorningTime Lite: from n/a through 1.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/morningtime-lite/vulnerability/wordpress-morningtime-lite-theme-1-3-2-stored-cross-site-scripting-xss-vulnerabil
s/theme/morningtime-lite/vulnerability/wordpress-morningtime-lite-theme-1-3-2-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26737 State: PUBLISHED Published: 2025-03-27T13:56:36.678Z Last Updated: 2025-04-03T13:19:42.401Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: yudleethemes Products: City Store Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yudleethemes City Store allows DOM-Based XSS.This issue affects City Store: from n/a through 1.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/city-store/vulnerability/wordpress-city-store-theme-1-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26738 State: PUBLISHED Published: 2025-03-27T13:54:34.447Z Last Updated: 2025-04-03T13:19:54.454Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Graham Products: Quick Interest Slider Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Graham Quick Interest Slider allows DOM-Based XSS.This issue affects Quick Interest Slider: from n/a through 3.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/quick-interest-slider/vulnerability/wordpress-quick-interest-slider-plugin-3-1-3-cross-site-scrip
abase/wordpress/plugin/quick-interest-slider/vulnerability/wordpress-quick-interest-slider-plugin-3-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26739 State: PUBLISHED Published: 2025-03-26T14:58:26.522Z Last Updated: 2025-03-26T15:29:41.517Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: themefunction Products: newseqo Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themefunction newseqo allows Stored XSS.This issue affects newseqo: from n/a through 2.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/newseqo/vulnerability/wordpress-newseqo-theme-2-1-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26740 State: PUBLISHED Published: 2025-04-15T21:53:10.238Z Last Updated: 2025-04-16T15:06:49.620Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: burgersoftware Products: SpaBiz Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in burgersoftware SpaBiz allows DOM-Based XSS. This issue affects SpaBiz: from n/a through 1.0.18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/spabiz/vulnerability/wordpress-spabiz-plugin-1-0-18-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26741 State: PUBLISHED Published: 2025-04-15T11:59:04.878Z Last Updated: 2025-04-15T13:20:07.915Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: AWEOS GmbH Products: Email Notifications for Updates Problem Types: CWE-862 Description: Missing Authorization vulnerability in AWEOS GmbH Email Notifications for Updates allows Privilege Escalation. This issue affects Email Notifications for Updates: from n/a through 1.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-update-mail-notification/vulnerability/wordpress-email-notifications-for-updates-1-1-6-privilege-escalation-vuln
ugin/wp-update-mail-notification/vulnerability/wordpress-email-notifications-for-updates-1-1-6-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-26742 State: PUBLISHED Published: 2025-03-25T14:37:51.811Z Last Updated: 2025-03-25T14:46:04.526Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: GhozyLab Products: Gallery for Social Photo Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery for Social Photo allows Stored XSS.This issue affects Gallery for Social Photo: from n/a through 1.0.0.35. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/feed-instagram-lite/vulnerability/wordpress-gallery-for-social-photo-plugin-1-0-0-35
stack.com/database/wordpress/plugin/feed-instagram-lite/vulnerability/wordpress-gallery-for-social-photo-plugin-1-0-0-35-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26743 State: PUBLISHED Published: 2025-04-15T11:59:05.071Z Last Updated: 2025-04-15T13:20:58.606Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: TC.K Products: Advance WP Query Search Filter Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TC.K Advance WP Query Search Filter allows Reflected XSS. This issue affects Advance WP Query Search Filter: from n/a through 1.0.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/advance-wp-query-search-filter/vulnerability/wordpress-advance-wp-query-se
ps://patchstack.com/database/wordpress/plugin/advance-wp-query-search-filter/vulnerability/wordpress-advance-wp-query-search-filter-plugin-1-0-10-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26744 State: PUBLISHED Published: 2025-04-15T11:59:05.240Z Last Updated: 2025-04-15T13:20:51.772Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: JetBlog Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound JetBlog allows DOM-Based XSS. This issue affects JetBlog: from n/a through 2.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-blog/vulnerability/wordpress-jetblog-plugin-2-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26745 State: PUBLISHED Published: 2025-04-15T11:59:05.387Z Last Updated: 2025-04-15T13:20:41.929Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: RSTheme Products: RS Elements Elementor Addon Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RSTheme RS Elements Elementor Addon allows Stored XSS. This issue affects RS Elements Elementor Addon: from n/a through 1.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/rselements-lite/vulnerability/wordpress-rs-elements-elementor-addon-plugin-1-1-
patchstack.com/database/wordpress/plugin/rselements-lite/vulnerability/wordpress-rs-elements-elementor-addon-plugin-1-1-5-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26746 State: PUBLISHED Published: 2025-04-15T21:53:10.409Z Last Updated: 2025-04-16T15:06:41.643Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Advanced Custom Fields: Link Picker Field Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Advanced Custom Fields: Link Picker Field allows Reflected XSS. This issue affects Advanced Custom Fields: Link Picker Field: from n/a through 1.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/acf-link-picker-field/vulnerabilit
CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/acf-link-picker-field/vulnerability/wordpress-advanced-custom-fields-link-picker-field-plugin-1-2-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26747 State: PUBLISHED Published: 2025-03-26T14:56:17.922Z Last Updated: 2025-03-26T15:29:48.862Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: 99colorthemes Products: RainbowNews Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 99colorthemes RainbowNews allows Stored XSS.This issue affects RainbowNews: from n/a through 1.0.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/rainbownews/vulnerability/wordpress-rainbownews-theme-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26748 State: PUBLISHED Published: 2025-04-15T21:53:10.560Z Last Updated: 2025-04-16T15:06:33.919Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: LOOS,Inc. Products: Arkhe Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in LOOS,Inc. Arkhe allows PHP Local File Inclusion. This issue affects Arkhe: from n/a through 3.11.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/arkhe/vulnerability/wordpress-arkhe-theme-3-11-0-csrf-to-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-26749 State: PUBLISHED Published: 2025-04-15T21:53:10.737Z Last Updated: 2025-04-16T15:06:25.253Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPFactory Products: Additional Custom Product Tabs for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Product Tabs for WooCommerce allows Stored XSS. This issue affects Additional Custom Product Tabs for WooCommerce: from n/a through 1.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/product-tabs-for-w
nalyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/product-tabs-for-woocommerce/vulnerability/wordpress-additional-custom-product-tabs-for-woocommerce-plugin-1-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26750 State: PUBLISHED Published: 2025-02-22T15:52:11.429Z Last Updated: 2025-02-24T14:35:36.282Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: appsbd Products: Vitepos Problem Types: CWE-862 Description: Missing Authorization vulnerability in appsbd Vitepos allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Vitepos: from n/a through 3.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/vitepos-lite/vulnerability/wordpress-vitepos-plugin-3-1-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-26751 State: PUBLISHED Published: 2025-02-25T14:17:50.118Z Last Updated: 2025-02-25T19:30:06.203Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Fahad Mahmood Products: Alphabetic Pagination Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood Alphabetic Pagination allows Reflected XSS. This issue affects Alphabetic Pagination: from n/a through 3.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/alphabetic-pagination/vulnerability/wordpress-alphabetic-pagination-plugin-3-2-1-ref
stack.com/database/wordpress/plugin/alphabetic-pagination/vulnerability/wordpress-alphabetic-pagination-plugin-3-2-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26752 State: PUBLISHED Published: 2025-02-25T14:17:50.298Z Last Updated: 2025-02-25T19:28:43.801Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: videowhisper Products: VideoWhisper Live Streaming Integration Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper VideoWhisper Live Streaming Integration allows Path Traversal. This issue affects VideoWhisper Live Streaming Integration: from n/a through 6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/videowhisper-live-streaming-integration
ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/videowhisper-live-streaming-integration/vulnerability/wordpress-videowhisper-live-streaming-integration-plugin-6-2-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2025-26753 State: PUBLISHED Published: 2025-02-25T14:17:50.490Z Last Updated: 2025-02-25T19:21:00.888Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: videowhisper Products: VideoWhisper Live Streaming Integration Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper VideoWhisper Live Streaming Integration allows Path Traversal. This issue affects VideoWhisper Live Streaming Integration: from n/a through 6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/videowhisper-live-streaming-integration
ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/videowhisper-live-streaming-integration/vulnerability/wordpress-videowhisper-live-streaming-integration-plugin-6-2-arbitrary-file-download-vulnerability?_s_id=cve
CVE ID: CVE-2025-26754 State: PUBLISHED Published: 2025-02-17T11:38:13.566Z Last Updated: 2025-02-18T19:31:20.344Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: bPlugins Products: Timeline Block Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Timeline Block allows Stored XSS. This issue affects Timeline Block: from n/a through 1.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/timeline-block-block/vulnerability/wordpress-timeline-block-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_i
gin/timeline-block-block/vulnerability/wordpress-timeline-block-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26755 State: PUBLISHED Published: 2025-02-16T22:17:17.991Z Last Updated: 2025-02-18T19:34:50.963Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: jgwhite33 Products: WP Airbnb Review Slider Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Airbnb Review Slider allows Blind SQL Injection. This issue affects WP Airbnb Review Slider: from n/a through 3.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-airbnb-review-slider/vulnerability/wordpress-wp-airbnb-review-slider-plugin-3-9
chstack.com/database/wordpress/plugin/wp-airbnb-review-slider/vulnerability/wordpress-wp-airbnb-review-slider-plugin-3-9-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-26756 State: PUBLISHED Published: 2025-02-22T15:52:11.712Z Last Updated: 2025-02-24T14:33:00.746Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: grimdonkey Products: Magic the Gathering Card Tooltips Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grimdonkey Magic the Gathering Card Tooltips allows Stored XSS. This issue affects Magic the Gathering Card Tooltips: from n/a through 3.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/magic-the-gathering-card-tooltips/vulnerability/wordpress
References: - https://patchstack.com/database/wordpress/plugin/magic-the-gathering-card-tooltips/vulnerability/wordpress-magic-the-gathering-card-tooltips-plugin-3-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26757 State: PUBLISHED Published: 2025-02-22T15:52:47.168Z Last Updated: 2025-02-24T14:26:46.309Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FULL SERVICES Products: FULL Customer Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FULL SERVICES FULL Customer allows PHP Local File Inclusion. This issue affects FULL Customer: from n/a through 3.1.26. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/full-customer/vulnerability/wordpress-full-cliente-plugin-3-1-26-local-file-i
//patchstack.com/database/wordpress/plugin/full-customer/vulnerability/wordpress-full-cliente-plugin-3-1-26-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-26758 State: PUBLISHED Published: 2025-02-17T11:38:13.840Z Last Updated: 2025-02-18T15:46:10.702Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: RebelCode Products: Spotlight Social Media Feeds Problem Types: CWE-497 Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RebelCode Spotlight Social Media Feeds allows Retrieve Embedded Sensitive Data. This issue affects Spotlight Social Media Feeds: from n/a through 1.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/spotlight-social-photo-feeds/vulnerability/wordpress-spotli
ferences: - https://patchstack.com/database/wordpress/plugin/spotlight-social-photo-feeds/vulnerability/wordpress-spotlight-social-feeds-plugin-1-7-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-26759 State: PUBLISHED Published: 2025-02-16T22:17:18.126Z Last Updated: 2025-02-18T19:34:44.120Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: alexvtn Products: Content Snippet Manager Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in alexvtn Content Snippet Manager allows Stored XSS. This issue affects Content Snippet Manager: from n/a through 1.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/content-snippet-manager/vulnerability/wordpress-content-snippet-manager-plugin-1-1-5-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26760 State: PUBLISHED Published: 2025-02-22T15:52:47.316Z Last Updated: 2025-02-24T14:24:22.011Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Wow-Company Products: Calculator Builder Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Wow-Company Calculator Builder allows PHP Local File Inclusion. This issue affects Calculator Builder: from n/a through 1.6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/calculator-builder/vulnerability/wordpress-calculator-builder-plugi
: - https://patchstack.com/database/wordpress/plugin/calculator-builder/vulnerability/wordpress-calculator-builder-plugin-1-6-2-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-26761 State: PUBLISHED Published: 2025-02-16T22:17:18.301Z Last Updated: 2025-02-18T19:34:35.338Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: HashThemes Products: Easy Elementor Addons Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Easy Elementor Addons allows DOM-Based XSS. This issue affects Easy Elementor Addons: from n/a through 2.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/easy-elementor-addons/vulnerability/wordpress-easy-elementor-addons-plugin-2-1-5-cross-s
k.com/database/wordpress/plugin/easy-elementor-addons/vulnerability/wordpress-easy-elementor-addons-plugin-2-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26762 State: PUBLISHED Published: 2025-03-27T15:52:22.683Z Last Updated: 2025-03-27T16:17:11.478Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Automattic Products: WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce allows Stored XSS.This issue affects WooCommerce: from n/a through 9.7.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woocommerce/vulnerability/wordpress-woocommerce-plugin-9-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-26763 State: PUBLISHED Published: 2025-02-22T15:52:47.516Z Last Updated: 2025-02-24T14:23:22.524Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MetaSlider Products: Responsive Slider by MetaSlider Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider allows Object Injection. This issue affects Responsive Slider by MetaSlider: from n/a through 3.94.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ml-slider/vulnerability/wordpress-slider-gallery-and-carousel-by-metaslider-image-slider-video-slider-
/wordpress/plugin/ml-slider/vulnerability/wordpress-slider-gallery-and-carousel-by-metaslider-image-slider-video-slider-plugin-3-94-0-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-26764 State: PUBLISHED Published: 2025-02-22T15:52:47.845Z Last Updated: 2025-02-24T14:21:44.292Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: enituretechnology Products: Distance Based Shipping Calculator Problem Types: CWE-862 Description: Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Distance Based Shipping Calculator: from n/a through 2.0.22. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/distance-based-shipping-calculator/vulnerabil