Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
k.com/database/wordpress/theme/grandtour/vulnerability/wordpress-grandtour-theme-5-5-1-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39486 State: PUBLISHED Published: 2025-06-17T15:01:35.197Z Last Updated: 2025-06-17T18:37:07.656Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: ValvePress Products: Rankie Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Rankie allows SQL Injection. This issue affects Rankie: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/valvepress-rankie/vulnerability/wordpress-rankie-plugin-1-8-2-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39487 State: PUBLISHED Published: 2025-07-04T11:18:05.595Z Last Updated: 2025-07-07T16:24:14.056Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: ValvePress Products: Rankie Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ValvePress Rankie allows Reflected XSS. This issue affects Rankie: from n/a through 1.8.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/valvepress-rankie/vulnerability/wordpress-rankie-plugin-1-8-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39488 State: PUBLISHED Published: 2025-06-27T11:52:34.402Z Last Updated: 2025-06-27T13:06:30.295Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Sneeit Products: MagOne Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sneeit MagOne allows Reflected XSS. This issue affects MagOne: from n/a through 8.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/magone/vulnerability/wordpress-magone-theme-8-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39489 State: PUBLISHED Published: 2025-05-23T12:43:54.956Z Last Updated: 2025-05-23T15:00:45.485Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: pebas Products: CouponXL Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in pebas CouponXL allows Privilege Escalation. This issue affects CouponXL: from n/a through 4.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/couponxl/vulnerability/wordpress-couponxl-4-5-0-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-39490 State: PUBLISHED Published: 2025-05-23T12:43:54.481Z Last Updated: 2025-05-23T13:24:17.888Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Mikado-Themes Products: Backpack Traveler Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Backpack Traveler allows PHP Local File Inclusion. This issue affects Backpack Traveler: from n/a through 2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/backpacktraveler/vulnerability/wordpress-backpack-traveler-2-7-local-
- https://patchstack.com/database/wordpress/theme/backpacktraveler/vulnerability/wordpress-backpack-traveler-2-7-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39491 State: PUBLISHED Published: 2025-05-16T15:45:26.153Z Last Updated: 2025-05-16T16:20:07.638Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WHMPress Products: WHMpress Problem Types: CWE-35 Description: Path Traversal vulnerability in WHMPress WHMpress allows Path Traversal. This issue affects WHMpress: from 6.2 through revision. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/whmpress/vulnerability/wordpress-whmpress-plugin-6-2-revision-9-local-file-inclusion-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-39492 State: PUBLISHED Published: 2025-05-16T15:45:25.612Z Last Updated: 2025-05-16T16:20:22.027Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: WHMPress Products: WHMpress Problem Types: CWE-35 Description: Path Traversal vulnerability in WHMPress WHMpress allows Relative Path Traversal. This issue affects WHMpress: from 6.2 through revision. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/whmpress/vulnerability/wordpress-whmpress-plugin-6-2-revision-9-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39493 State: PUBLISHED Published: 2025-05-16T15:45:25.055Z Last Updated: 2025-05-16T16:20:41.156Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: ValvePress Products: Rankie Problem Types: CWE-862 Description: Missing Authorization vulnerability in ValvePress Rankie allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rankie: from n/a through 1.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/valvepress-rankie/vulnerability/wordpress-rankie-1-8-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-39494 State: PUBLISHED Published: 2025-05-23T12:43:54.021Z Last Updated: 2025-05-23T13:29:05.194Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Mikado-Themes Products: Wilmër Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Wilmër allows PHP Local File Inclusion. This issue affects Wilmër: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/wilmer/vulnerability/wordpress-wilmer-theme-3-4-2-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39495 State: PUBLISHED Published: 2025-05-23T12:43:53.570Z Last Updated: 2025-05-23T13:29:28.909Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: BoldThemes Products: Avantage Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in BoldThemes Avantage allows Object Injection. This issue affects Avantage: from n/a through 2.4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/avantage/vulnerability/wordpress-avantage-theme-2-4-6-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39496 State: PUBLISHED Published: 2025-08-28T11:41:43.877Z Last Updated: 2025-08-28T14:48:08.423Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: WBW Products: WooBeWoo Product Filter Pro Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW WooBeWoo Product Filter Pro allows SQL Injection.This issue affects WooBeWoo Product Filter Pro: from n/a before 2.9.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woofilter-pro/vulnerability/wordpress-woobewoo-product-filter-pro-plugin-2-7-6-sql-i
stack.com/database/wordpress/plugin/woofilter-pro/vulnerability/wordpress-woobewoo-product-filter-pro-plugin-2-7-6-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39498 State: PUBLISHED Published: 2025-05-26T14:05:22.053Z Last Updated: 2025-05-27T14:13:03.151Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Spotlight Products: Spotlight - Social Media Feeds (Premium) Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Spotlight Spotlight - Social Media Feeds (Premium) allows Retrieve Embedded Sensitive Data.This issue affects Spotlight - Social Media Feeds (Premium): from n/a through 1.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/spotlight-social-photo-feeds-premium/vulnerabilit
chment: References: - https://patchstack.com/database/wordpress/plugin/spotlight-social-photo-feeds-premium/vulnerability/wordpress-spotlight-social-media-feeds-premium-plugin-1-7-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-39499 State: PUBLISHED Published: 2025-05-23T12:43:53.107Z Last Updated: 2025-07-03T11:21:47.634Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: BoldThemes Products: Medicare Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in BoldThemes Medicare allows Object Injection.This issue affects Medicare: from n/a through 2.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/medicare/vulnerability/wordpress-medicare-theme-2-1-0-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39500 State: PUBLISHED Published: 2025-05-23T12:43:52.651Z Last Updated: 2025-05-23T13:30:11.376Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: GoodLayers Products: Goodlayers Hostel Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hostel allows Object Injection. This issue affects Goodlayers Hostel: from n/a through 3.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gdlr-hostel/vulnerability/wordpress-goodlayers-hostel-plugin-3-1-2-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39501 State: PUBLISHED Published: 2025-05-23T12:43:52.186Z Last Updated: 2025-05-23T13:40:31.604Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: GoodLayers Products: Goodlayers Hostel Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GoodLayers Goodlayers Hostel allows Blind SQL Injection. This issue affects Goodlayers Hostel: from n/a through 3.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gdlr-hostel/vulnerability/wordpress-goodlayers-hostel-plugin-3-1-2-sql-injection-vulnerabili
m/database/wordpress/plugin/gdlr-hostel/vulnerability/wordpress-goodlayers-hostel-plugin-3-1-2-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39502 State: PUBLISHED Published: 2025-05-23T12:43:51.701Z Last Updated: 2025-05-23T13:40:50.852Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: GoodLayers Products: Goodlayers Hostel Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Goodlayers Hostel allows Reflected XSS. This issue affects Goodlayers Hostel: from n/a through 3.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gdlr-hostel/vulnerability/wordpress-goodlayers-hostel-plugin-3-1-2-reflected-cross-site-scripting-xss-
/wordpress/plugin/gdlr-hostel/vulnerability/wordpress-goodlayers-hostel-plugin-3-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39503 State: PUBLISHED Published: 2025-05-23T12:43:51.237Z Last Updated: 2025-05-23T13:41:09.798Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: GoodLayers Products: Goodlayers Hotel Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hotel allows Object Injection. This issue affects Goodlayers Hotel: from n/a through 3.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gdlr-hotel/vulnerability/wordpress-goodlayers-hotel-plugin-3-1-4-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39504 State: PUBLISHED Published: 2025-05-23T12:43:50.777Z Last Updated: 2025-05-23T13:41:27.955Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: GoodLayers Products: Goodlayers Hotel Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GoodLayers Goodlayers Hotel allows Blind SQL Injection. This issue affects Goodlayers Hotel: from n/a through 3.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gdlr-hotel/vulnerability/wordpress-goodlayers-hotel-plugin-3-1-4-sql-injection-vulnerability?_s
atabase/wordpress/plugin/gdlr-hotel/vulnerability/wordpress-goodlayers-hotel-plugin-3-1-4-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39505 State: PUBLISHED Published: 2025-05-23T12:43:50.263Z Last Updated: 2025-05-23T13:41:46.565Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: GoodLayers Products: Goodlayers Hotel Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Goodlayers Hotel allows Reflected XSS. This issue affects Goodlayers Hotel: from n/a through 3.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gdlr-hotel/vulnerability/wordpress-goodlayers-hotel-plugin-3-1-4-reflected-cross-site-scripting-xss-vulne
rdpress/plugin/gdlr-hotel/vulnerability/wordpress-goodlayers-hotel-plugin-3-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39506 State: PUBLISHED Published: 2025-05-23T12:43:49.805Z Last Updated: 2025-05-23T15:04:38.110Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NasaTheme Products: Nasa Core Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Nasa Core allows PHP Local File Inclusion. This issue affects Nasa Core: from n/a through 6.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/nasa-core/vulnerability/wordpress-nasa-core-plugin-6-3-2-local-file-inclusion-vulnerability-2?_s_i
base/wordpress/plugin/nasa-core/vulnerability/wordpress-nasa-core-plugin-6-3-2-local-file-inclusion-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-39507 State: PUBLISHED Published: 2025-05-16T15:45:24.437Z Last Updated: 2025-05-16T16:21:00.437Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NasaTheme Products: Nasa Core Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Nasa Core allows PHP Local File Inclusion. This issue affects Nasa Core: from n/a through 6.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/nasa-core/vulnerability/wordpress-nasa-core-plugin-6-3-2-local-file-inclusion-vulnerability?_s_id=
base/wordpress/plugin/nasa-core/vulnerability/wordpress-nasa-core-plugin-6-3-2-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39508 State: PUBLISHED Published: 2025-06-17T15:01:34.698Z Last Updated: 2025-06-17T18:37:14.129Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NasaTheme Products: Nasa Core Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Nasa Core allows Reflected XSS. This issue affects Nasa Core: from n/a through 6.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/nasa-core/vulnerability/wordpress-nasa-core-plugin-6-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39509 State: PUBLISHED Published: 2025-05-16T15:45:23.847Z Last Updated: 2025-05-16T16:47:46.099Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: ThemeNcode Products: TNC FlipBook Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode TNC FlipBook allows Stored XSS. This issue affects TNC FlipBook: from n/a through 12.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/pdf-viewer-for-wordpress/vulnerability/wordpress-tnc-flipbook-plugin-12-1-0-cross-site-scripting-xss-vulnerability?_s
in/pdf-viewer-for-wordpress/vulnerability/wordpress-tnc-flipbook-plugin-12-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39510 State: PUBLISHED Published: 2025-08-14T10:34:26.102Z Last Updated: 2025-08-14T19:37:09.458Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: ValvePress Products: Pinterest Automatic Pin Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Pinterest Automatic Pin allows SQL Injection. This issue affects Pinterest Automatic Pin: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-pinterest-automatic/vulnerability/wordpress-pinterest-automatic-pin-plugin-4-19-0-s
ack.com/database/wordpress/plugin/wp-pinterest-automatic/vulnerability/wordpress-pinterest-automatic-pin-plugin-4-19-0-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39511 State: PUBLISHED Published: 2025-05-16T15:45:23.327Z Last Updated: 2025-05-16T16:47:52.842Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: ValvePress Products: Pinterest Automatic Pin Problem Types: CWE-862 Description: Missing Authorization vulnerability in ValvePress Pinterest Automatic Pin allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pinterest Automatic Pin: from n/a through 4.18.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-pinterest-automatic/vulnerability/wordpress-pinterest-automatic-pin-4-18-2-broken-access-
m/database/wordpress/plugin/wp-pinterest-automatic/vulnerability/wordpress-pinterest-automatic-pin-4-18-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-39512 State: PUBLISHED Published: 2025-04-16T12:45:54.497Z Last Updated: 2025-04-16T13:16:32.492Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Yuya Hoshino Products: Bulk Term Editor Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Yuya Hoshino Bulk Term Editor allows Cross Site Request Forgery. This issue affects Bulk Term Editor: from n/a through 1.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bulk-term-editor/vulnerability/wordpress-bulk-term-editor-1-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-39513 State: PUBLISHED Published: 2025-04-16T12:45:53.889Z Last Updated: 2025-04-16T13:22:23.868Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: ActiveDEMAND Online Agency Marketing Automation Products: ActiveDEMAND Problem Types: CWE-862 Description: Missing Authorization vulnerability in ActiveDEMAND Online Agency Marketing Automation ActiveDEMAND allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects ActiveDEMAND: from n/a through 0.2.46. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/activedemand/vulnerability/wordpress-activedemand-0-2-46-br
ferences: - https://patchstack.com/database/wordpress/plugin/activedemand/vulnerability/wordpress-activedemand-0-2-46-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-39514 State: PUBLISHED Published: 2025-04-16T12:45:53.284Z Last Updated: 2025-04-16T13:23:03.158Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Asgaros Products: Asgaros Forum Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asgaros Asgaros Forum allows Stored XSS. This issue affects Asgaros Forum: from n/a through 3.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/asgaros-forum/vulnerability/wordpress-asgaros-forum-3-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39515 State: PUBLISHED Published: 2025-04-16T12:45:52.653Z Last Updated: 2025-04-16T13:24:15.666Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: tnomi Products: Attendance Manager Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tnomi Attendance Manager allows Stored XSS. This issue affects Attendance Manager: from n/a through 0.6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/attendance-manager/vulnerability/wordpress-attendance-manager-0-6-2-cross-site-scripting-xss-vulnerability?_s_
ss/plugin/attendance-manager/vulnerability/wordpress-attendance-manager-0-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39516 State: PUBLISHED Published: 2025-04-16T12:45:52.055Z Last Updated: 2025-04-16T13:24:43.926Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Alan Petersen Products: Author WIP Progress Bar Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alan Petersen Author WIP Progress Bar allows DOM-Based XSS. This issue affects Author WIP Progress Bar: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/author-work-in-progress-bar/vulnerability/wordpress-author-wip-progress-bar-1-
/patchstack.com/database/wordpress/plugin/author-work-in-progress-bar/vulnerability/wordpress-author-wip-progress-bar-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39517 State: PUBLISHED Published: 2025-04-16T12:45:51.423Z Last Updated: 2025-04-16T13:25:12.802Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WP Map Plugins Products: Basic Interactive World Map Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Basic Interactive World Map allows Cross Site Request Forgery. This issue affects Basic Interactive World Map: from n/a through 2.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/basic-interactive-world-map/vulnerability/wordpress-basic-interactive-world-map-plugin-2-7-cross-site
e/wordpress/plugin/basic-interactive-world-map/vulnerability/wordpress-basic-interactive-world-map-plugin-2-7-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE ID: CVE-2025-39518 State: PUBLISHED Published: 2025-04-16T12:45:50.853Z Last Updated: 2025-04-16T13:25:46.931Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: RedefiningTheWeb Products: BMA Lite Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RedefiningTheWeb BMA Lite allows SQL Injection. This issue affects BMA Lite: from n/a through 1.4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bma-lite-appointment-booking-and-scheduling/vulnerability/wordpress-bma-lite-1-4-2-sql-injection-vulnerability?_s_id=
in/bma-lite-appointment-booking-and-scheduling/vulnerability/wordpress-bma-lite-1-4-2-sql-injection-vulnerability?_s_id=cve