Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-24746 State: PUBLISHED Published: 2025-01-24T17:25:23.212Z Last Updated: 2025-02-12T20:01:15.265Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Popup Maker Products: Popup Maker Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Popup Maker Popup Maker allows Stored XSS. This issue affects Popup Maker: from n/a through 1.20.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/popup-maker/vulnerability/wordpress-popup-maker-plugin-1-20-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24747 State: PUBLISHED Published: 2025-01-27T14:22:19.476Z Last Updated: 2025-02-12T20:41:33.126Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Houzez.co Products: Houzez Problem Types: CWE-862 Description: Missing Authorization vulnerability in Houzez.co Houzez. This issue affects Houzez: from n/a through 3.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/houzez/vulnerability/wordpress-houzez-theme-3-4-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-24748 State: PUBLISHED Published: 2025-07-04T08:42:05.486Z Last Updated: 2025-07-08T14:08:30.723Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: LambertGroup Products: All In One Slider Responsive Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup All In One Slider Responsive allows SQL Injection. This issue affects All In One Slider Responsive: from n/a through 3.7.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/all_in_one_carousel/vulnerability/wordpress-all-in-one-slider-res
es: - https://patchstack.com/database/wordpress/plugin/all_in_one_carousel/vulnerability/wordpress-all-in-one-slider-responsive-plugin-3-7-9-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-24749 State: PUBLISHED Published: 2025-01-31T08:24:41.763Z Last Updated: 2025-01-31T15:29:00.510Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Overt Software Solutions LTD Products: EZPZ SAML SP Single Sign On (SSO) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Overt Software Solutions LTD EZPZ SAML SP Single Sign On (SSO) allows Cross Site Request Forgery. This issue affects EZPZ SAML SP Single Sign On (SSO): from n/a through 1.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ezpz-sp/vulnerability/wordpress-ezpz-saml-sp-single-sig
: References: - https://patchstack.com/database/wordpress/plugin/ezpz-sp/vulnerability/wordpress-ezpz-saml-sp-single-sign-on-sso-plugin-1-2-5-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24750 State: PUBLISHED Published: 2025-01-24T17:25:20.489Z Last Updated: 2025-02-12T20:01:15.756Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: ExactMetrics Products: ExactMetrics Problem Types: CWE-862 Description: Missing Authorization vulnerability in ExactMetrics ExactMetrics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ExactMetrics: from n/a through 8.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/google-analytics-dashboard-for-wp/vulnerability/wordpress-exactmetrics-plugin-8-1-0-broken-access-control-vulnerability?_s
ogle-analytics-dashboard-for-wp/vulnerability/wordpress-exactmetrics-plugin-8-1-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-24751 State: PUBLISHED Published: 2025-01-24T17:25:21.194Z Last Updated: 2025-02-12T20:01:15.641Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GoDaddy Products: CoBlocks Problem Types: CWE-862 Description: Missing Authorization vulnerability in GoDaddy CoBlocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CoBlocks: from n/a through 3.1.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/coblocks/vulnerability/wordpress-coblocks-plugin-3-1-13-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-24752 State: PUBLISHED Published: 2025-04-17T15:48:11.325Z Last Updated: 2025-04-17T18:18:39.338Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: WPDeveloper Products: Essential Addons for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor allows Reflected XSS. This issue affects Essential Addons for Elementor: from n/a through 6.0.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/essential-addons-for-elementor-lite/vulnerability/wordpress-
erences: - https://patchstack.com/database/wordpress/plugin/essential-addons-for-elementor-lite/vulnerability/wordpress-essential-addons-for-elementor-plugin-6-0-14-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24753 State: PUBLISHED Published: 2025-01-24T17:25:21.829Z Last Updated: 2025-02-12T20:01:15.502Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Kadence WP Products: Gutenberg Blocks by Kadence Blocks Problem Types: CWE-862 Description: Missing Authorization vulnerability in Kadence WP Gutenberg Blocks by Kadence Blocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/kadence-blocks/vulnerability/wordpress-kadence-blocks-plugin
erences: - https://patchstack.com/database/wordpress/plugin/kadence-blocks/vulnerability/wordpress-kadence-blocks-plugin-3-3-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-24754 State: PUBLISHED Published: 2025-01-27T13:59:49.813Z Last Updated: 2025-01-27T14:24:16.379Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Houzez.co Products: Houzez Problem Types: CWE-862 Description: Missing Authorization vulnerability in Houzez.co Houzez. This issue affects Houzez: from n/a through 3.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/houzez/vulnerability/wordpress-houzez-theme-3-4-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-24755 State: PUBLISHED Published: 2025-01-24T17:25:22.462Z Last Updated: 2025-02-12T20:01:15.378Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: add-ons.org Products: PDF Invoices for WooCommerce + Drag and Drop Template Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF Invoices for WooCommerce + Drag and Drop Template Builder allows Stored XSS. This issue affects PDF Invoices for WooCommerce + Drag and Drop Template Builder: from n/a through 4.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack
ate Builder: from n/a through 4.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/pdf-for-woocommerce/vulnerability/wordpress-pdf-invoices-for-woocommerce-plugin-4-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24756 State: PUBLISHED Published: 2025-01-24T17:25:19.315Z Last Updated: 2025-02-12T20:01:15.891Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: mgplugin Products: Roi Calculator Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in mgplugin Roi Calculator allows Stored XSS. This issue affects Roi Calculator: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/roi-calculator/vulnerability/wordpress-roi-calculator-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24757 State: PUBLISHED Published: 2025-07-04T08:42:06.451Z Last Updated: 2025-07-08T14:08:08.092Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Long Watch Studio Products: MyRewards Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Long Watch Studio MyRewards allows Stored XSS. This issue affects MyRewards: from n/a through 5.4.13.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woorewards/vulnerability/wordpress-myrewards-plugin-5-4-13-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24758 State: PUBLISHED Published: 2025-03-03T13:30:21.486Z Last Updated: 2025-03-03T17:38:01.887Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: CreativeMindsSolutions Products: CM Map Locations Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Map Locations allows Reflected XSS. This issue affects CM Map Locations: from n/a through 2.0.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cm-map-locations/vulnerability/wordpress-cm-map-locations-plugin-2-0-8-reflected-
tchstack.com/database/wordpress/plugin/cm-map-locations/vulnerability/wordpress-cm-map-locations-plugin-2-0-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24759 State: PUBLISHED Published: 2025-07-16T11:28:14.460Z Last Updated: 2025-07-16T13:01:45.430Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: CMSJunkie - WordPress Business Directory Plugins Products: WP-BusinessDirectory Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory allows Blind SQL Injection. This issue affects WP-BusinessDirectory: from n/a through 3.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-busi
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-businessdirectory/vulnerability/wordpress-wp-businessdirectory-3-1-3-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-24760 State: PUBLISHED Published: 2025-06-27T11:52:10.667Z Last Updated: 2025-06-27T14:08:12.831Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: goalthemes Products: Sofass Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Sofass allows PHP Local File Inclusion. This issue affects Sofass: from n/a through 1.3.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/sofass/vulnerability/wordpress-sofass-1-3-4-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-24761 State: PUBLISHED Published: 2025-06-17T15:01:40.951Z Last Updated: 2025-06-17T15:15:27.980Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: snstheme Products: DSK Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme DSK allows PHP Local File Inclusion. This issue affects DSK: from n/a through 2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/dsk/vulnerability/wordpress-dsk-2-2-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-24762 State: PUBLISHED Published: 2025-06-06T12:54:40.421Z Last Updated: 2025-06-06T16:23:14.089Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: facturaone Products: TicketBAI Facturas para WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in facturaone TicketBAI Facturas para WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects TicketBAI Facturas para WooCommerce: from n/a through 3.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-ticketbai/vulnerability/wordpress-ticketbai-facturas-pa
eferences: - https://patchstack.com/database/wordpress/plugin/wp-ticketbai/vulnerability/wordpress-ticketbai-facturas-para-woocommerce-3-19-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-24763 State: PUBLISHED Published: 2025-06-06T12:54:39.955Z Last Updated: 2025-06-06T16:23:19.788Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Pascal Casier Products: bbPress API Problem Types: CWE-862 Description: Missing Authorization vulnerability in Pascal Casier bbPress API allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress API: from n/a through 1.0.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bbp-api/vulnerability/wordpress-bbpress-api-1-0-14-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-24764 State: PUBLISHED Published: 2025-07-04T08:42:07.391Z Last Updated: 2025-07-08T14:07:40.995Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: A. Jones Products: (Simply) Guest Author Name Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A. Jones (Simply) Guest Author Name allows DOM-Based XSS. This issue affects (Simply) Guest Author Name: from n/a through 4.36. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/guest-author-name/vulnerability/wordpress-simply-guest-author-name-plugin-4-36
/patchstack.com/database/wordpress/plugin/guest-author-name/vulnerability/wordpress-simply-guest-author-name-plugin-4-36-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24765 State: PUBLISHED Published: 2025-06-27T11:52:48.540Z Last Updated: 2025-06-27T13:41:32.696Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: RobMarsh Products: Image Shadow Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RobMarsh Image Shadow allows Path Traversal. This issue affects Image Shadow: from n/a through 1.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/image-shadow/vulnerability/wordpress-image-shadow-1-1-0-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2025-24766 State: PUBLISHED Published: 2025-08-14T10:34:36.787Z Last Updated: 2025-08-14T14:42:29.851Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: WP Royal Themes Products: News Magazine X Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Royal Themes News Magazine X allows PHP Local File Inclusion. This issue affects News Magazine X: from n/a through 1.2.37. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/news-magazine-x/vulnerability/wordpress-news-magazine-x-1-2-35-local
: - https://patchstack.com/database/wordpress/theme/news-magazine-x/vulnerability/wordpress-news-magazine-x-1-2-35-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-24767 State: PUBLISHED Published: 2025-06-09T15:56:56.570Z Last Updated: 2025-06-10T13:31:40.086Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: facturaone Products: TicketBAI Facturas para WooCommerce Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in facturaone TicketBAI Facturas para WooCommerce allows Blind SQL Injection. This issue affects TicketBAI Facturas para WooCommerce: from n/a through 3.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-ticketbai/vulnerability/wordpress-ti
ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-ticketbai/vulnerability/wordpress-ticketbai-facturas-para-woocommerce-3-19-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-24768 State: PUBLISHED Published: 2025-06-09T15:56:55.812Z Last Updated: 2025-06-10T13:14:58.727Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: snstheme Products: Nitan Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Nitan allows PHP Local File Inclusion. This issue affects Nitan: from n/a through 2.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/snsnitan/vulnerability/wordpress-nitan-2-9-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-24769 State: PUBLISHED Published: 2025-06-27T11:52:47.973Z Last Updated: 2025-06-27T14:06:38.299Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: BZOTheme Products: Zenny Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Zenny allows PHP Local File Inclusion. This issue affects Zenny: from n/a through 1.7.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/bw-zenny/vulnerability/wordpress-zenny-1-7-5-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-24770 State: PUBLISHED Published: 2025-06-09T15:56:55.085Z Last Updated: 2025-06-10T13:31:55.047Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: BZOTheme Products: CraftXtore Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme CraftXtore allows PHP Local File Inclusion. This issue affects CraftXtore: from n/a through 1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/bw-craftxtore/vulnerability/wordpress-craftxtore-1-7-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-24771 State: PUBLISHED Published: 2025-07-04T11:18:11.236Z Last Updated: 2025-07-07T14:58:12.258Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: OTWthemes Products: Content Manager Light Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Content Manager Light allows Reflected XSS. This issue affects Content Manager Light: from n/a through 3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/content-manager-light/vulnerability/wordpress-content-manager-light-plugin-3-2-reflected-cross
database/wordpress/plugin/content-manager-light/vulnerability/wordpress-content-manager-light-plugin-3-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24772 State: PUBLISHED Published: 2025-06-06T12:54:39.454Z Last Updated: 2025-06-06T16:23:26.160Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: cmsMinds Products: Pay with Contact Form 7 Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in cmsMinds Pay with Contact Form 7 allows Cross Site Request Forgery. This issue affects Pay with Contact Form 7: from n/a through 1.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/pay-with-contact-form-7/vulnerability/wordpress-pay-with-contact-form-7-1-0-4-cross-site-request-forgery-csrf-vulnerability
-with-contact-form-7/vulnerability/wordpress-pay-with-contact-form-7-1-0-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-24773 State: PUBLISHED Published: 2025-06-17T15:01:40.473Z Last Updated: 2025-06-17T17:35:04.696Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: mojoomla Products: WPCRM - CRM for Contact form CF7 & WooCommerce Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce allows SQL Injection. This issue affects WPCRM - CRM for Contact form CF7 & WooCommerce: from n/a through 3.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpcrm/vulnerabi
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpcrm/vulnerability/wordpress-wpcrm-crm-for-contact-form-cf7-woocommerce-3-2-0-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-24774 State: PUBLISHED Published: 2025-06-27T11:52:47.385Z Last Updated: 2025-06-27T13:41:38.816Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: mojoomla Products: WPCRM - CRM for Contact form CF7 & WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce allows Reflected XSS. This issue affects WPCRM - CRM for Contact form CF7 & WooCommerce: from n/a through 3.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpcrm/vulnerability
alyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpcrm/vulnerability/wordpress-wpcrm-crm-for-contact-form-cf7-woocommerce-plugin-3-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-24775 State: PUBLISHED Published: 2025-08-14T10:34:36.243Z Last Updated: 2025-08-14T13:27:17.673Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Made I.T. Products: Forms Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Made I.T. Forms allows Upload a Web Shell to a Web Server. This issue affects Forms: from n/a through 2.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/forms-by-made-it/vulnerability/wordpress-forms-2-9-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-24776 State: PUBLISHED Published: 2025-06-06T12:54:38.983Z Last Updated: 2025-06-06T16:23:31.706Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: codelobster Products: Responsive Flipbooks Problem Types: CWE-862 Description: Missing Authorization vulnerability in codelobster Responsive Flipbooks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Responsive Flipbooks: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/responsive-flipbooks/vulnerability/wordpress-responsive-flipbooks-1-0-broken-access-control-vulnerabil
/wordpress/plugin/responsive-flipbooks/vulnerability/wordpress-responsive-flipbooks-1-0-broken-access-control-vulnerability?_s_id=cve