Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-22801 State: PUBLISHED Published: 2025-01-09T15:39:21.237Z Last Updated: 2025-01-10T20:41:51.405Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: HasThemes Products: Free WooCommerce Theme 99fy Extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes Free WooCommerce Theme 99fy Extension allows Stored XSS.This issue affects Free WooCommerce Theme 99fy Extension: from n/a through 1.2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/99fy-core/vulnerability/wordpress-free-woocomm
nrichment: References: - https://patchstack.com/database/wordpress/plugin/99fy-core/vulnerability/wordpress-free-woocommerce-theme-99fy-extension-plugin-1-2-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22802 State: PUBLISHED Published: 2025-01-09T15:39:20.648Z Last Updated: 2025-01-10T20:42:05.859Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: add-ons.org Products: Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail allows Stored XSS.This issue affects Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail: from n/a through 2.1.
ffects Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail: from n/a through 2.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/yeemail/vulnerability/wordpress-email-templates-customizer-yeemail-plugin-2-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22803 State: PUBLISHED Published: 2025-01-09T15:39:20.056Z Last Updated: 2025-01-10T20:42:15.266Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: VillaTheme Products: Advanced Product Information for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Advanced Product Information for WooCommerce allows Stored XSS.This issue affects Advanced Product Information for WooCommerce: from n/a through 1.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woo-advanced-product-in
t Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woo-advanced-product-information/vulnerability/wordpress-advanced-product-information-for-woocommerce-plugin-1-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22804 State: PUBLISHED Published: 2025-01-09T15:39:19.460Z Last Updated: 2025-01-10T20:42:22.978Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Paul Bearne Products: Author Avatars List/Block Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Bearne Author Avatars List/Block allows Stored XSS.This issue affects Author Avatars List/Block: from n/a through 2.1.23. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/author-avatars/vulnerability/wordpress-author-avatars-list-block-plugin-2-1-2
//patchstack.com/database/wordpress/plugin/author-avatars/vulnerability/wordpress-author-avatars-list-block-plugin-2-1-23-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22805 State: PUBLISHED Published: 2025-01-09T15:39:08.730Z Last Updated: 2025-01-10T20:42:33.806Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: ThemePoints Products: Skill Bar Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePoints Skill Bar allows Stored XSS.This issue affects Skill Bar: from n/a through 1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/skillbars/vulnerability/wordpress-skill-bar-plugin-1-2-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22806 State: PUBLISHED Published: 2025-01-09T15:39:08.166Z Last Updated: 2025-01-10T20:43:18.503Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Modernaweb Studio Products: Black Widgets For Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor allows DOM-Based XSS.This issue affects Black Widgets For Elementor: from n/a through 1.3.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/black-widgets/vulnerability/wordpress-black-widgets-for-e
References: - https://patchstack.com/database/wordpress/plugin/black-widgets/vulnerability/wordpress-black-widgets-for-elementor-plugin-1-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22807 State: PUBLISHED Published: 2025-01-09T15:39:07.596Z Last Updated: 2025-01-10T20:43:26.427Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Robert Peake Products: Responsive Flickr Slideshow Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Peake Responsive Flickr Slideshow allows Stored XSS.This issue affects Responsive Flickr Slideshow: from n/a through 2.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mobile-friendly-flickr-slideshow/vulnerability/wordpress-responsive-fl
https://patchstack.com/database/wordpress/plugin/mobile-friendly-flickr-slideshow/vulnerability/wordpress-responsive-flickr-slideshow-plugin-2-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22808 State: PUBLISHED Published: 2025-01-09T15:39:07.016Z Last Updated: 2025-01-10T20:43:38.784Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Surbma Products: Surbma | Premium WP Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Surbma Surbma | Premium WP allows DOM-Based XSS.This issue affects Surbma | Premium WP: from n/a through 9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/surbma-premium-wp/vulnerability/wordpress-surbma-premium-wp-plugin-9-0-cross-site-scripting-xss-vulnerabi
rdpress/plugin/surbma-premium-wp/vulnerability/wordpress-surbma-premium-wp-plugin-9-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22809 State: PUBLISHED Published: 2025-01-09T15:39:06.376Z Last Updated: 2025-01-10T20:43:48.265Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Gravity Master Products: PDF Catalog Woocommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gravity Master PDF Catalog Woocommerce allows DOM-Based XSS.This issue affects PDF Catalog Woocommerce: from n/a through 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/pdf-catalog-woocommerce/vulnerability/wordpress-pdf-catalog-woocommerce-plugi
//patchstack.com/database/wordpress/plugin/pdf-catalog-woocommerce/vulnerability/wordpress-pdf-catalog-woocommerce-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22810 State: PUBLISHED Published: 2025-01-09T15:39:05.823Z Last Updated: 2025-01-10T20:43:55.528Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: CBB Team Products: Content Blocks Builder Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CBB Team Content Blocks Builder allows Stored XSS.This issue affects Content Blocks Builder: from n/a through 2.7.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/content-blocks-builder/vulnerability/wordpress-content-blocks-builder-plugin-2-7-6-cross-site
/database/wordpress/plugin/content-blocks-builder/vulnerability/wordpress-content-blocks-builder-plugin-2-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22811 State: PUBLISHED Published: 2025-01-09T15:39:05.312Z Last Updated: 2025-01-10T20:44:03.305Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Modeltheme Products: MT Addons for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modeltheme MT Addons for Elementor allows Stored XSS.This issue affects MT Addons for Elementor: from n/a through 1.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mt-addons-for-elementor/vulnerability/wordpress-mt-addons-for-elementor-plugin-1-0-6-c
ack.com/database/wordpress/plugin/mt-addons-for-elementor/vulnerability/wordpress-mt-addons-for-elementor-plugin-1-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22812 State: PUBLISHED Published: 2025-01-09T15:39:04.757Z Last Updated: 2025-01-10T20:44:09.535Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: FlickDevs Products: News Ticker Widget for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlickDevs News Ticker Widget for Elementor allows Stored XSS.This issue affects News Ticker Widget for Elementor: from n/a through 1.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/news-ticker-widget-for-elementor/vulnerability/wordpress-news
rences: - https://patchstack.com/database/wordpress/plugin/news-ticker-widget-for-elementor/vulnerability/wordpress-news-ticker-widget-for-elementor-plugin-1-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22813 State: PUBLISHED Published: 2025-01-09T15:39:04.226Z Last Updated: 2025-01-10T20:44:16.620Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: ChatBot for WordPress - WPBot Products: Conversational Forms for ChatBot Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ChatBot for WordPress - WPBot Conversational Forms for ChatBot allows Stored XSS.This issue affects Conversational Forms for ChatBot: from n/a through 1.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/conversational-forms/
yst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/conversational-forms/vulnerability/wordpress-chatbot-conversational-forms-plugin-1-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22814 State: PUBLISHED Published: 2025-01-09T15:39:03.651Z Last Updated: 2025-01-10T20:44:28.484Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Dylan James Products: Zephyr Admin Theme Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Admin Theme allows Cross Site Request Forgery.This issue affects Zephyr Admin Theme: from n/a through 1.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/zephyr-modern-admin-theme/vulnerability/wordpress-zephyr-admin-theme-plugin-1-4-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22815 State: PUBLISHED Published: 2025-01-09T15:39:02.754Z Last Updated: 2025-01-10T20:44:35.864Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: bPlugins LLC Products: Button Block Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LLC Button Block allows Stored XSS.This issue affects Button Block: from n/a through 1.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/button-block/vulnerability/wordpress-button-block-plugin-1-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22816 State: PUBLISHED Published: 2025-03-27T14:03:53.906Z Last Updated: 2025-03-28T17:00:38.859Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: CodeTrendy Products: Power Mag Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeTrendy Power Mag allows DOM-Based XSS.This issue affects Power Mag: from n/a through 1.1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/power-mag/vulnerability/wordpress-power-mag-theme-1-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22817 State: PUBLISHED Published: 2025-01-09T15:39:01.733Z Last Updated: 2025-01-10T20:44:43.181Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Venutius Products: BP Profile Shortcodes Extra Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Venutius BP Profile Shortcodes Extra allows Stored XSS.This issue affects BP Profile Shortcodes Extra: from n/a through 2.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bp-profile-shortcodes-extra/vulnerability/wordpress-bp-profile-shortcodes-extr
/patchstack.com/database/wordpress/plugin/bp-profile-shortcodes-extra/vulnerability/wordpress-bp-profile-shortcodes-extra-plugin-2-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22818 State: PUBLISHED Published: 2025-01-09T15:39:01.141Z Last Updated: 2025-01-10T20:44:50.086Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: S3Bubble Products: S3Player – WooCommerce & Elementor Integration Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in S3Bubble S3Player – WooCommerce & Elementor Integration allows Stored XSS.This issue affects S3Player – WooCommerce & Elementor Integration: from n/a through 4.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/drm-protected-video-s
yst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/drm-protected-video-streaming/vulnerability/wordpress-s3player-plugin-4-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22819 State: PUBLISHED Published: 2025-01-09T15:39:00.535Z Last Updated: 2025-01-10T20:45:07.851Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: 4wpbari Products: Qr Code and Barcode Scanner Reader Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 4wpbari Qr Code and Barcode Scanner Reader allows Stored XSS.This issue affects Qr Code and Barcode Scanner Reader: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/qr-code-and-barcode-scanner-reader/vulnerability/wordpress-
ferences: - https://patchstack.com/database/wordpress/plugin/qr-code-and-barcode-scanner-reader/vulnerability/wordpress-qr-code-and-barcode-scanner-reader-plugin-1-0-0-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22820 State: PUBLISHED Published: 2025-01-09T15:38:59.889Z Last Updated: 2025-01-10T20:45:22.541Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Daniel Walmsley Products: VR Views Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Walmsley VR Views allows Stored XSS.This issue affects VR Views: from n/a through 1.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/vr-views/vulnerability/wordpress-vr-views-plugin-1-5-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22821 State: PUBLISHED Published: 2025-01-09T15:38:59.363Z Last Updated: 2025-01-10T20:47:06.718Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: vfthemes Products: StorePress Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vfthemes StorePress allows DOM-Based XSS.This issue affects StorePress: from n/a through 1.0.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/storepress/vulnerability/wordpress-storepress-theme-1-0-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22822 State: PUBLISHED Published: 2025-01-09T15:38:58.780Z Last Updated: 2025-01-10T20:48:31.825Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Bishawjit Das Products: wp custom countdown Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bishawjit Das wp custom countdown allows Stored XSS.This issue affects wp custom countdown: from n/a through 2.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-custom-countdown/vulnerability/wordpress-wp-custom-countdown-plugin-2-8-stored-cross-site-s
database/wordpress/plugin/wp-custom-countdown/vulnerability/wordpress-wp-custom-countdown-plugin-2-8-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22823 State: PUBLISHED Published: 2025-01-09T15:38:58.228Z Last Updated: 2025-01-10T20:48:59.085Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Justin Twerdy Products: Genesis Style Shortcodes Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Twerdy Genesis Style Shortcodes allows DOM-Based XSS.This issue affects Genesis Style Shortcodes: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/genesis-style-shortcodes/vulnerability/wordpress-genesis-style-shortcodes-pl
://patchstack.com/database/wordpress/plugin/genesis-style-shortcodes/vulnerability/wordpress-genesis-style-shortcodes-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22824 State: PUBLISHED Published: 2025-01-09T15:38:57.615Z Last Updated: 2025-01-10T20:49:19.632Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Lucia Intelisano Products: Live Flight Radar Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lucia Intelisano Live Flight Radar allows Stored XSS.This issue affects Live Flight Radar: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/live-flight-radar/vulnerability/wordpress-live-flight-radar-plugin-1-0-cross-site-scripting-xs
database/wordpress/plugin/live-flight-radar/vulnerability/wordpress-live-flight-radar-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22825 State: PUBLISHED Published: 2025-01-21T13:57:36.064Z Last Updated: 2025-02-12T20:31:26.302Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WP Desk Products: Flexible PDF Coupons Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Desk Flexible PDF Coupons allows Stored XSS. This issue affects Flexible PDF Coupons: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/flexible-coupons/vulnerability/wordpress-flexible-pdf-coupons-plugin-1-10-3-stored-cross-site-scriptin
/wordpress/plugin/flexible-coupons/vulnerability/wordpress-flexible-pdf-coupons-plugin-1-10-3-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22826 State: PUBLISHED Published: 2025-01-09T15:38:57.092Z Last Updated: 2025-01-10T20:50:10.630Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: wpecommerce, wp.insider Products: Sell Digital Downloads Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpecommerce, wp.insider Sell Digital Downloads allows Stored XSS.This issue affects Sell Digital Downloads: from n/a through 2.2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/sell-digital-downloads/vulnerability/wordpress-sell-digital-dow
nces: - https://patchstack.com/database/wordpress/plugin/sell-digital-downloads/vulnerability/wordpress-sell-digital-downloads-plugin-2-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22827 State: PUBLISHED Published: 2025-01-09T15:38:56.486Z Last Updated: 2025-01-10T20:50:31.827Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Joomag. Products: WP Joomag Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joomag. WP Joomag allows DOM-Based XSS.This issue affects WP Joomag: from n/a through 2.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-joomag/vulnerability/wordpress-wp-joomag-plugin-2-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-22828 State: PUBLISHED Published: 2025-01-13T12:47:51.619Z Last Updated: 2025-01-13T19:02:32.935Z Vendors: Apache Software Foundation Products: Apache CloudStack Problem Types: CWE-200 Description: CloudStack users can add and read comments (annotations) on resources they are authorised to access. Due to an access validation issue that affects Apache CloudStack versions from 4.16.0, users who have access, prior access or knowledge of resource UUIDs can list and add comments (annotations) to such resources. An attacker with a user-account and access or prior knowledge of resource UUIDs may exploit this issue to read contents of the comments (annotations) or add malicious comm
knowledge of resource UUIDs may exploit this issue to read contents of the comments (annotations) or add malicious comments (annotations) to such resources. This may cause potential loss of confidentiality of CloudStack environments and resources if the comments (annotations) contain any privileged information. However, guessing or brute-forcing resource UUIDs are generally hard to impossible and access to listing or adding comments isn't same as access to CloudStack resources, making this issue of very low severity and general low impact. CloudStack admins may also disallow listAnnotations and addAnnotation API access to non-admin roles in their environment as an interim measure. Additiona
ow listAnnotations and addAnnotation API access to non-admin roles in their environment as an interim measure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/bbsm9fdwrgfyostzojh6ghpocgdmx8rs