Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-57958 State: PUBLISHED Published: 2025-09-22T18:24:46.091Z Last Updated: 2025-09-24T14:09:08.511Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: WPXPO Products: WowAddons Problem Types: CWE-862 Description: Missing Authorization vulnerability in WPXPO WowAddons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WowAddons: from n/a through 1.0.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/product-addons/vulnerability/wordpress-wowaddons-plugin-1-0-17-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-57959 State: PUBLISHED Published: 2025-09-22T18:24:45.372Z Last Updated: 2025-09-24T15:19:10.766Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: tmatsuur Products: Slightly troublesome permalink Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tmatsuur Slightly troublesome permalink allows Stored XSS. This issue affects Slightly troublesome permalink: from n/a through 1.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/slightly-troublesome-permalink/vulnerability/wordpress-slightly-trou
- https://patchstack.com/database/wordpress/plugin/slightly-troublesome-permalink/vulnerability/wordpress-slightly-troublesome-permalink-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-57960 State: PUBLISHED Published: 2025-09-22T18:24:44.565Z Last Updated: 2025-09-24T15:19:33.154Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: TravelMap Products: Travel Map Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in TravelMap Travel Map allows Cross Site Request Forgery. This issue affects Travel Map: from n/a through 1.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/travelmap-blog/vulnerability/wordpress-travel-map-plugin-1-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-57961 State: PUBLISHED Published: 2025-09-22T18:24:43.882Z Last Updated: 2025-09-24T15:23:50.019Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Codexpert, Inc Products: CoDesigner Problem Types: CWE-862 Description: Missing Authorization vulnerability in Codexpert, Inc CoDesigner allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CoDesigner: from n/a through 4.25.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woolementor/vulnerability/wordpress-codesigner-plugin-4-25-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-57962 State: PUBLISHED Published: 2025-09-22T18:24:43.181Z Last Updated: 2025-09-23T14:18:46.833Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: e4jvikwp Products: VikRestaurants Table Reservations and Take-Away Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRestaurants Table Reservations and Take-Away allows Stored XSS. This issue affects VikRestaurants Table Reservations and Take-Away: from n/a through 1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/vikrestaurants/vuln
alyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/vikrestaurants/vulnerability/wordpress-vikrestaurants-table-reservations-and-take-away-plugin-1-4-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-57963 State: PUBLISHED Published: 2025-09-22T18:24:42.363Z Last Updated: 2025-09-23T14:19:47.430Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Zoho Subscriptions Products: Zoho Billing Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Subscriptions Zoho Billing allows DOM-Based XSS. This issue affects Zoho Billing: from n/a through 4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/zoho-subscriptions/vulnerability/wordpress-zoho-billing-plugin-4-1-cross-site-scripting-xss-vulnerabi
e/wordpress/plugin/zoho-subscriptions/vulnerability/wordpress-zoho-billing-plugin-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-57964 State: PUBLISHED Published: 2025-09-22T18:24:41.652Z Last Updated: 2025-09-23T14:22:00.267Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: photonicgnostic Products: Library Bookshelves Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in photonicgnostic Library Bookshelves allows Stored XSS. This issue affects Library Bookshelves: from n/a through 5.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/library-bookshelves/vulnerability/wordpress-library-bookshelves-plugin-5-11-cross-site-s
k.com/database/wordpress/plugin/library-bookshelves/vulnerability/wordpress-library-bookshelves-plugin-5-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-57965 State: PUBLISHED Published: 2025-09-22T18:24:40.957Z Last Updated: 2025-09-23T14:23:08.618Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WP CodeUs Products: WP Proposals Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs WP Proposals allows Stored XSS. This issue affects WP Proposals: from n/a through 2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-proposals/vulnerability/wordpress-wp-proposals-plugin-2-3-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-57966 State: PUBLISHED Published: 2025-09-22T18:24:40.257Z Last Updated: 2025-09-23T14:24:08.656Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: GhozyLab Products: Gallery Lightbox Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery Lightbox allows Stored XSS. This issue affects Gallery Lightbox: from n/a through 1.0.0.41. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gallery-lightbox-slider/vulnerability/wordpress-gallery-lightbox-plugin-1-0-0-41-cross-site-scripting-xss-v
press/plugin/gallery-lightbox-slider/vulnerability/wordpress-gallery-lightbox-plugin-1-0-0-41-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-57967 State: PUBLISHED Published: 2025-09-22T18:24:39.559Z Last Updated: 2025-09-23T14:25:15.189Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPBean Products: WPB Quick View for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean WPB Quick View for WooCommerce allows Stored XSS. This issue affects WPB Quick View for WooCommerce: from n/a through 2.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woocommerce-lightbox/vulnerability/wordpress-wpb-quick-view-for-woocomme
ttps://patchstack.com/database/wordpress/plugin/woocommerce-lightbox/vulnerability/wordpress-wpb-quick-view-for-woocommerce-plugin-2-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-57968 State: PUBLISHED Published: 2025-09-22T18:24:38.846Z Last Updated: 2025-09-23T14:26:09.916Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: e4jvikwp Products: VikRestaurants Table Reservations and Take-Away Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRestaurants Table Reservations and Take-Away allows Reflected XSS. This issue affects VikRestaurants Table Reservations and Take-Away: from n/a through 1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/vikrestaurants/vul
nalyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/vikrestaurants/vulnerability/wordpress-vikrestaurants-table-reservations-and-take-away-plugin-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-57969 State: PUBLISHED Published: 2025-09-22T18:24:38.158Z Last Updated: 2025-09-23T14:27:33.363Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Jeremy Saxey Products: Hide WP Toolbar Problem Types: CWE-862 Description: Missing Authorization vulnerability in Jeremy Saxey Hide WP Toolbar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hide WP Toolbar: from n/a through 2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/hide-wp-toolbar/vulnerability/wordpress-hide-wp-toolbar-plugin-2-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-57970 State: PUBLISHED Published: 2025-09-22T18:24:37.463Z Last Updated: 2025-10-04T03:12:15.282Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: SALESmanago Products: SALESmanago & Leadoo Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in SALESmanago SALESmanago & Leadoo allows Cross Site Request Forgery.This issue affects SALESmanago & Leadoo: from n/a through 3.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/salesmanago/vulnerability/wordpress-salesmanago-plugin-3-8-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-57971 State: PUBLISHED Published: 2025-09-22T18:24:36.790Z Last Updated: 2025-10-04T03:14:46.540Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: SALESmanago Products: SALESmanago & Leadoo Problem Types: CWE-862 Description: Missing Authorization vulnerability in SALESmanago SALESmanago & Leadoo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALESmanago & Leadoo: from n/a through 3.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/salesmanago/vulnerability/wordpress-salesmanago-plugin-3-8-1-broken-access-control-vulnerability?_s_i
e/wordpress/plugin/salesmanago/vulnerability/wordpress-salesmanago-plugin-3-8-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-57972 State: PUBLISHED Published: 2025-09-22T18:24:36.102Z Last Updated: 2025-09-25T13:51:59.628Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: WPFactory Products: Helpdesk Support Ticket System for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in WPFactory Helpdesk Support Ticket System for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Helpdesk Support Ticket System for WooCommerce: from n/a through 2.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/support-ticket-system-for-
otes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/support-ticket-system-for-woocommerce/vulnerability/wordpress-helpdesk-support-ticket-system-for-woocommerce-plugin-2-0-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-57973 State: PUBLISHED Published: 2025-09-22T18:24:35.408Z Last Updated: 2025-09-25T13:52:16.844Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Chad Butler Products: WP-Members Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chad Butler WP-Members allows Stored XSS. This issue affects WP-Members: from n/a through 3.5.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-members/vulnerability/wordpress-wp-members-plugin-3-5-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-57974 State: PUBLISHED Published: 2025-09-22T18:24:34.679Z Last Updated: 2025-09-25T13:52:30.992Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: tuyennv Products: TZ PlusGallery Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tuyennv TZ PlusGallery allows Stored XSS. This issue affects TZ PlusGallery: from n/a through 1.5.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/tz-plus-gallery/vulnerability/wordpress-tz-plusgallery-plugin-1-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-57975 State: PUBLISHED Published: 2025-09-22T18:24:33.974Z Last Updated: 2025-09-25T13:52:46.829Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: RadiusTheme Products: Team Problem Types: CWE-862 Description: Missing Authorization vulnerability in RadiusTheme Team allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Team: from n/a through 5.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/tlp-team/vulnerability/wordpress-team-plugin-5-0-6-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-57976 State: PUBLISHED Published: 2025-09-22T18:24:33.264Z Last Updated: 2025-09-25T13:53:06.485Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: CardCom Products: CardCom Payment Gateway Problem Types: CWE-862 Description: Missing Authorization vulnerability in CardCom CardCom Payment Gateway allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CardCom Payment Gateway: from n/a through 3.5.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woo-cardcom-payment-gateway/vulnerability/wordpress-cardcom-payment-gateway-plugin-3-5-0-4-broken
abase/wordpress/plugin/woo-cardcom-payment-gateway/vulnerability/wordpress-cardcom-payment-gateway-plugin-3-5-0-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-57977 State: PUBLISHED Published: 2025-09-22T18:24:32.572Z Last Updated: 2025-09-25T13:53:22.538Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) Vendors: wpdesk Products: Flexible PDF Invoices for WooCommerce &amp; WordPress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in wpdesk Flexible PDF Invoices for WooCommerce &amp; WordPress allows Cross Site Request Forgery. This issue affects Flexible PDF Invoices for WooCommerce &amp; WordPress: from n/a through 6.0.13. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/flexible-invoices/vulnerability/wordpr
ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/flexible-invoices/vulnerability/wordpress-flexible-pdf-invoices-for-woocommerce-wordpress-plugin-6-0-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-57978 State: PUBLISHED Published: 2025-09-22T18:24:31.892Z Last Updated: 2025-09-25T13:53:37.974Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: themespride Products: Advanced Appointment Booking &amp; Scheduling Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in themespride Advanced Appointment Booking &amp; Scheduling allows Cross Site Request Forgery. This issue affects Advanced Appointment Booking &amp; Scheduling: from n/a through 1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/advanced-appointment-booking-scheduling/vulnerability
nt: References: - https://patchstack.com/database/wordpress/plugin/advanced-appointment-booking-scheduling/vulnerability/wordpress-advanced-appointment-booking-scheduling-plugin-1-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-57979 State: PUBLISHED Published: 2025-09-22T18:24:31.213Z Last Updated: 2025-09-25T13:53:50.491Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Russell Jamieson Products: AuthorSure Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson AuthorSure allows Stored XSS. This issue affects AuthorSure: from n/a through 2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/authorsure/vulnerability/wordpress-authorsure-plugin-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-57980 State: PUBLISHED Published: 2025-09-22T18:24:30.525Z Last Updated: 2025-09-23T14:28:04.711Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Tomas Cordero Products: Safety Exit Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomas Cordero Safety Exit allows Stored XSS. This issue affects Safety Exit: from n/a through 1.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/safety-exit/vulnerability/wordpress-safety-exit-plugin-1-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-57981 State: PUBLISHED Published: 2025-09-22T18:24:29.794Z Last Updated: 2025-09-23T14:29:29.031Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: catchsquare Products: WP Social Widget Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget allows Stored XSS. This issue affects WP Social Widget: from n/a through 2.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-social-widget/vulnerability/wordpress-wp-social-widget-plugin-2-3-1-cross-site-scripting-xss-vulnerab
ordpress/plugin/wp-social-widget/vulnerability/wordpress-wp-social-widget-plugin-2-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-57982 State: PUBLISHED Published: 2025-09-22T18:24:29.104Z Last Updated: 2025-09-25T13:54:06.520Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: WPBean Products: Advance Portfolio Grid Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean Advance Portfolio Grid allows Stored XSS. This issue affects Advance Portfolio Grid: from n/a through 1.07.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/advance-portfolio-grid/vulnerability/wordpress-advance-portfolio-grid-plugin-1-07-6-cross-site-
atabase/wordpress/plugin/advance-portfolio-grid/vulnerability/wordpress-advance-portfolio-grid-plugin-1-07-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-57983 State: PUBLISHED Published: 2025-09-22T18:24:28.401Z Last Updated: 2025-09-25T13:54:21.289Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Damian Products: BP Disable Activation Reloaded Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Damian BP Disable Activation Reloaded allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects BP Disable Activation Reloaded: from n/a through 1.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bp-disable-activation-reloaded/vulnerability/wordpress-bp-disable-activation
://patchstack.com/database/wordpress/plugin/bp-disable-activation-reloaded/vulnerability/wordpress-bp-disable-activation-reloaded-plugin-1-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-57984 State: PUBLISHED Published: 2025-09-22T18:24:27.700Z Last Updated: 2025-09-23T14:33:12.105Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Pratik Ghela Products: MakeStories (for Google Web Stories) Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Pratik Ghela MakeStories (for Google Web Stories) allows Server Side Request Forgery. This issue affects MakeStories (for Google Web Stories): from n/a through 3.0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/makestories-helper/vulnerability/wordpress-makestories-for-google-web-stor
ps://patchstack.com/database/wordpress/plugin/makestories-helper/vulnerability/wordpress-makestories-for-google-web-stories-plugin-3-0-4-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-57985 State: PUBLISHED Published: 2025-09-22T18:24:27.010Z Last Updated: 2025-09-23T14:34:22.124Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: MantraBrain Products: Ultimate Watermark Problem Types: CWE-862 Description: Missing Authorization vulnerability in MantraBrain Ultimate Watermark allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Watermark: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ultimate-watermark/vulnerability/wordpress-ultimate-watermark-plugin-1-1-broken-access-control-vulnerability
ress/plugin/ultimate-watermark/vulnerability/wordpress-ultimate-watermark-plugin-1-1-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-57986 State: PUBLISHED Published: 2025-09-22T18:24:26.244Z Last Updated: 2025-09-23T17:52:59.930Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: husani Products: WP Subtitle Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in husani WP Subtitle allows Stored XSS. This issue affects WP Subtitle: from n/a through 3.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-subtitle/vulnerability/wordpress-wp-subtitle-plugin-3-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-57987 State: PUBLISHED Published: 2025-09-22T18:24:25.391Z Last Updated: 2025-09-23T14:11:36.820Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: ThimPress Products: WP Events Manager Problem Types: CWE-862 Description: Missing Authorization vulnerability in ThimPress WP Events Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Events Manager: from n/a through 2.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-events-manager/vulnerability/wordpress-wp-events-manager-plugin-2-2-1-broken-access-control-vulnerability?_s_i
plugin/wp-events-manager/vulnerability/wordpress-wp-events-manager-plugin-2-2-1-broken-access-control-vulnerability?_s_id=cve