Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ps://patchstack.com/database/wordpress/plugin/nertworks-all-in-one-social-share-tools/vulnerability/wordpress-nertworks-all-in-one-social-share-tools-1-26-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-31448 State: PUBLISHED Published: 2025-03-28T11:54:15.160Z Last Updated: 2025-03-28T14:44:11.084Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: misteraon Products: Simple Trackback Disabler Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in misteraon Simple Trackback Disabler allows Cross Site Request Forgery. This issue affects Simple Trackback Disabler: from n/a through 1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-trackback-disabler/vulnerability/wordpress-simple-trackback-disabler-1-4-cross-site-request-forgery-csrf-vulne
in/simple-trackback-disabler/vulnerability/wordpress-simple-trackback-disabler-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-31449 State: PUBLISHED Published: 2025-03-28T11:54:14.548Z Last Updated: 2025-03-28T14:45:13.455Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: EricH Products: The Visitor Counter Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in EricH The Visitor Counter allows Stored XSS. This issue affects The Visitor Counter: from n/a through 1.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/the-visitor-counter/vulnerability/wordpress-the-visitor-counter-plugin-1-4-3-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31450 State: PUBLISHED Published: 2025-03-28T11:54:13.920Z Last Updated: 2025-03-28T14:47:45.699Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: phantom.omaga Products: Toggle Box Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phantom.omaga Toggle Box allows Stored XSS. This issue affects Toggle Box: from n/a through 1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/toggle-box/vulnerability/wordpress-toggle-box-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31451 State: PUBLISHED Published: 2025-03-28T11:54:13.268Z Last Updated: 2025-03-28T14:51:44.237Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: kevinweber Products: wBounce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kevinweber wBounce allows Stored XSS. This issue affects wBounce: from n/a through 1.8.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wbounce/vulnerability/wordpress-wbounce-1-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31452 State: PUBLISHED Published: 2025-03-28T11:54:12.630Z Last Updated: 2025-03-28T14:55:39.605Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Mindshare Labs, Inc. Products: WP Ultimate Search Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mindshare Labs, Inc. WP Ultimate Search allows Stored XSS. This issue affects WP Ultimate Search: from n/a through 2.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-ultimate-search/vulnerability/wordpress-wp-ultimate-search-2-0-3-cross-site-s
atchstack.com/database/wordpress/plugin/wp-ultimate-search/vulnerability/wordpress-wp-ultimate-search-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31453 State: PUBLISHED Published: 2025-03-28T11:54:12.005Z Last Updated: 2025-03-28T14:57:12.932Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Stian Andreassen Products: YouTube SimpleGallery Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stian Andreassen YouTube SimpleGallery allows Stored XSS. This issue affects YouTube SimpleGallery: from n/a through 2.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/youtube-simplegallery/vulnerability/wordpress-youtube-simplegallery-2-0-6-cross
patchstack.com/database/wordpress/plugin/youtube-simplegallery/vulnerability/wordpress-youtube-simplegallery-2-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31454 State: PUBLISHED Published: 2025-04-01T20:58:10.502Z Last Updated: 2025-04-02T16:12:31.408Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Delete Post Revision Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Delete Post Revision allows Reflected XSS. This issue affects Delete Post Revision: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/delete-post-revision/vulnerability/wordpress-delete-post-revision-plugin-1-1-reflected-cross-site-s
ase/wordpress/plugin/delete-post-revision/vulnerability/wordpress-delete-post-revision-plugin-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31455 State: PUBLISHED Published: 2025-04-01T20:58:10.662Z Last Updated: 2025-04-02T16:10:22.598Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Limit Max IPs Per User Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Limit Max IPs Per User allows DOM-Based XSS. This issue affects Limit Max IPs Per User: from n/a through 1.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/limit-max-ips-per-user/vulnerability/wordpress-limit-max-ips-per-user-plugin-1-5-reflected-cr
/database/wordpress/plugin/limit-max-ips-per-user/vulnerability/wordpress-limit-max-ips-per-user-plugin-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31456 State: PUBLISHED Published: 2025-03-28T11:54:11.374Z Last Updated: 2025-03-28T15:00:23.831Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: bsndev Products: Ultimate Security Checker Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in bsndev Ultimate Security Checker allows Cross Site Request Forgery. This issue affects Ultimate Security Checker: from n/a through 4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ultimate-security-checker/vulnerability/wordpress-ultimate-security-checker-plugin-4-2-cross-site-request-forgery-csrf-to-s
imate-security-checker/vulnerability/wordpress-ultimate-security-checker-plugin-4-2-cross-site-request-forgery-csrf-to-security-rescan-vulnerability?_s_id=cve
CVE ID: CVE-2025-31457 State: PUBLISHED Published: 2025-03-28T11:54:10.747Z Last Updated: 2025-03-28T13:34:03.582Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Aurélien LWS Products: LWS SMS Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Aurélien LWS LWS SMS allows Cross Site Request Forgery. This issue affects LWS SMS: from n/a through 2.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/lws-sms/vulnerability/wordpress-lws-sms-2-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-31458 State: PUBLISHED Published: 2025-03-28T11:54:10.116Z Last Updated: 2025-03-28T13:35:39.402Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: forsgren Products: Video Embedder Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in forsgren Video Embedder allows Stored XSS. This issue affects Video Embedder: from n/a through 1.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/video-embedder/vulnerability/wordpress-video-embedder-plugin-1-7-1-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31459 State: PUBLISHED Published: 2025-03-28T11:54:09.505Z Last Updated: 2025-03-28T13:39:43.577Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: PasqualePuzio Products: Login Alert Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in PasqualePuzio Login Alert allows Stored XSS. This issue affects Login Alert: from n/a through 0.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/login-alert/vulnerability/wordpress-login-alert-plugin-0-2-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31460 State: PUBLISHED Published: 2025-03-28T11:54:08.859Z Last Updated: 2025-03-28T13:47:50.365Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: danielmuldernl Products: OmniLeads Scripts and Tags Manager Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in danielmuldernl OmniLeads Scripts and Tags Manager allows Stored XSS. This issue affects OmniLeads Scripts and Tags Manager: from n/a through 1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/omnileads-scripts-and-tags-manager/vulnerability/wordpress-omnileads-scripts-and-tags-manager-plug
base/wordpress/plugin/omnileads-scripts-and-tags-manager/vulnerability/wordpress-omnileads-scripts-and-tags-manager-plugin-1-3-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31461 State: PUBLISHED Published: 2025-04-01T20:58:10.861Z Last Updated: 2025-04-10T14:44:32.781Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: NanoSupport Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound NanoSupport allows Reflected XSS. This issue affects NanoSupport: from n/a through 0.6.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/nanosupport/vulnerability/wordpress-nanosupport-plugin-0-6-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31462 State: PUBLISHED Published: 2025-04-01T20:58:11.039Z Last Updated: 2025-04-10T14:42:17.545Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: rzfarrell Products: CGM Event Calendar Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rzfarrell CGM Event Calendar allows Reflected XSS. This issue affects CGM Event Calendar: from n/a through 0.8.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cgm-event-calendar/vulnerability/wordpress-cgm-event-calendar-0-8-5-cross-site-scripting-xss-vulnerab
e/wordpress/plugin/cgm-event-calendar/vulnerability/wordpress-cgm-event-calendar-0-8-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31463 State: PUBLISHED Published: 2025-03-28T11:54:08.216Z Last Updated: 2025-03-28T13:48:14.127Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Preetinder Singh Products: TGG WP Optimizer Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Preetinder Singh TGG WP Optimizer allows Stored XSS. This issue affects TGG WP Optimizer: from n/a through 1.22. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/tgg-wp-optimizer/vulnerability/wordpress-tgg-wp-optimizer-1-22-cross-site-scripting-xss-vulnera
atabase/wordpress/plugin/tgg-wp-optimizer/vulnerability/wordpress-tgg-wp-optimizer-1-22-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31464 State: PUBLISHED Published: 2025-03-28T11:54:07.604Z Last Updated: 2025-03-28T13:49:10.983Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Nazmur Rahman Products: Text Selection Color Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nazmur Rahman Text Selection Color allows Stored XSS. This issue affects Text Selection Color: from n/a through 1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/text-selection-color/vulnerability/wordpress-text-selection-color-1-6-cross-site-scripting
com/database/wordpress/plugin/text-selection-color/vulnerability/wordpress-text-selection-color-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31465 State: PUBLISHED Published: 2025-03-28T11:54:06.845Z Last Updated: 2025-03-28T14:02:04.854Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: cornershop Products: Better Section Navigation Widget Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in cornershop Better Section Navigation Widget allows Stored XSS. This issue affects Better Section Navigation Widget: from n/a through 1.6.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/better-section-navigation/vulnerability/wordpress-better-section-
es: - https://patchstack.com/database/wordpress/plugin/better-section-navigation/vulnerability/wordpress-better-section-navigation-widget-1-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31466 State: PUBLISHED Published: 2025-03-28T11:54:06.197Z Last Updated: 2025-03-28T14:03:15.710Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: Falcon Solutions Products: Duplicate Page and Post Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Falcon Solutions Duplicate Page and Post allows Blind SQL Injection. This issue affects Duplicate Page and Post: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/duplicate-post-and-page/vulnerability/wordpress-duplicate-page-and-p
- https://patchstack.com/database/wordpress/plugin/duplicate-post-and-page/vulnerability/wordpress-duplicate-page-and-post-1-0-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-31467 State: PUBLISHED Published: 2025-04-03T13:27:10.045Z Last Updated: 2025-04-03T15:08:30.916Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Flickr Photostream Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Flickr Photostream allows Reflected XSS. This issue affects Flickr Photostream: from n/a through 3.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/flickr-photostream/vulnerability/wordpress-flickr-photostream-plugin-3-1-8-reflected-cross-site-scripti
wordpress/plugin/flickr-photostream/vulnerability/wordpress-flickr-photostream-plugin-3-1-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31468 State: PUBLISHED Published: 2025-04-03T13:27:10.201Z Last Updated: 2025-04-03T15:08:18.214Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: WP_Identicon Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WP_Identicon allows Reflected XSS. This issue affects WP_Identicon: from n/a through 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-identicon/vulnerability/wordpress-wp-identicon-plugin-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31469 State: PUBLISHED Published: 2025-03-28T11:54:05.439Z Last Updated: 2025-03-28T14:03:44.396Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: webrangers Products: Clear Sucuri Cache Problem Types: CWE-862 Description: Missing Authorization vulnerability in webrangers Clear Sucuri Cache allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Clear Sucuri Cache: from n/a through 1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/clear-sucuri-cache/vulnerability/wordpress-clear-sucuri-cache-1-4-broken-access-control-vulnerability?_s_id=cv
ss/plugin/clear-sucuri-cache/vulnerability/wordpress-clear-sucuri-cache-1-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-31470 State: PUBLISHED Published: 2025-03-28T11:54:04.803Z Last Updated: 2025-03-28T14:06:31.959Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: FancyThemes Products: Page Takeover Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FancyThemes Page Takeover allows Stored XSS. This issue affects Page Takeover: from n/a through 1.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/page-takeover/vulnerability/wordpress-page-takeover-1-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31471 State: PUBLISHED Published: 2025-03-28T11:54:04.185Z Last Updated: 2025-04-03T12:57:42.700Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Falcon Solutions Products: Duplicate Page and Post Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Falcon Solutions Duplicate Page and Post allows Stored XSS. This issue affects Duplicate Page and Post: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/duplicate-post-and-page/vulnerability/wordpress-duplicate-page-and-post-1-0
s://patchstack.com/database/wordpress/plugin/duplicate-post-and-page/vulnerability/wordpress-duplicate-page-and-post-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31472 State: PUBLISHED Published: 2025-03-28T11:54:03.559Z Last Updated: 2025-03-28T15:21:43.545Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Michele Marri Products: Flatty Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michele Marri Flatty allows Stored XSS. This issue affects Flatty: from n/a through 2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/flatty-flat-admin-theme/vulnerability/wordpress-flatty-2-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31473 State: PUBLISHED Published: 2025-03-28T11:54:02.878Z Last Updated: 2025-03-28T15:33:14.816Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: matthewprice1178 Products: WP Database Optimizer Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matthewprice1178 WP Database Optimizer allows Stored XSS. This issue affects WP Database Optimizer: from n/a through 1.2.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-database-optimizer/vulnerability/wordpress-wp-database-optimizer-1-2-1-3-c
//patchstack.com/database/wordpress/plugin/wp-database-optimizer/vulnerability/wordpress-wp-database-optimizer-1-2-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-31474 State: PUBLISHED Published: 2025-03-28T11:54:02.063Z Last Updated: 2025-03-28T15:33:51.592Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: matthewprice1178 Products: WP Database Optimizer Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in matthewprice1178 WP Database Optimizer allows Cross Site Request Forgery. This issue affects WP Database Optimizer: from n/a through 1.2.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-database-optimizer/vulnerability/wordpress-wp-database-optimizer-1-2-1-3-cross-site-request-forgery-csrf-vul
s/plugin/wp-database-optimizer/vulnerability/wordpress-wp-database-optimizer-1-2-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-31475 State: PUBLISHED Published: 2025-04-07T14:48:25.164Z Last Updated: 2025-04-07T15:49:42.400Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: AmauriC Products: tarteaucitron.js Problem Types: CWE-1321 Description: tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where the addOrUpdate function, used for applying custom texts, did not properly validate input. This allowed an attacker with direct access to the site's source code or a CMS plugin to manipulate JavaScript object prototypes, leading to potential security risks such as data corruption or unintended
n to manipulate JavaScript object prototypes, leading to potential security risks such as data corruption or unintended code execution. An attacker with high privileges could exploit this vulnerability to modify object prototypes, affecting core JavaScript behavior, cause application crashes or unexpected behavior, or potentially introduce further security vulnerabilities depending on the application's architecture. This vulnerability is fixed in 1.20.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-4hwx-xcc5-2hfc - https://github.com/AmauriC/tarteaucitron.js/commit/74c354c413ee3f82dff97a15a0a43942887c2b5
isories/GHSA-4hwx-xcc5-2hfc - https://github.com/AmauriC/tarteaucitron.js/commit/74c354c413ee3f82dff97a15a0a43942887c2b5b
CVE ID: CVE-2025-31476 State: PUBLISHED Published: 2025-04-07T14:52:12.728Z Last Updated: 2025-06-12T21:03:38.700Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: AmauriC Products: tarteaucitron.js Problem Types: CWE-79 Description: tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site's source code or a CMS plugin) to enter a URL containing an insecure scheme such as javascript:alert(). Before the fix, URL validation was insufficient, which could allow arbitrary JavaScript execution if a user clicked on a malicious link. An attacker with high
ufficient, which could allow arbitrary JavaScript execution if a user clicked on a malicious link. An attacker with high privileges could insert a link exploiting an insecure URL scheme, leading to execution of arbitrary JavaScript code, theft of sensitive data through phishing attacks, or modification of the user interface behavior. This vulnerability is fixed in 1.20.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-p5g4-v748-6fh8 - https://github.com/AmauriC/tarteaucitron.js/commit/2fa1e01023bce2e4b813200600bb1619d56ceb02