Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-28402 State: PUBLISHED Published: 2025-04-07T00:00:00.000Z Last Updated: 2025-04-08T19:40:25.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yangzongzhuan/RuoYi - https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28402.md
CVE ID: CVE-2025-28403 State: PUBLISHED Published: 2025-04-07T00:00:00.000Z Last Updated: 2025-04-08T19:39:33.734Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has administrative privileges before allowing modifications to system configuration settings Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yangzongzhuan/RuoYi - https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28403.md
CVE ID: CVE-2025-28405 State: PUBLISHED Published: 2025-04-07T00:00:00.000Z Last Updated: 2025-04-08T19:38:11.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yangzongzhuan/RuoYi - https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28405.md
CVE ID: CVE-2025-28406 State: PUBLISHED Published: 2025-04-07T00:00:00.000Z Last Updated: 2025-04-08T19:37:05.101Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameter Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yangzongzhuan/RuoYi - https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28406.md
CVE ID: CVE-2025-28407 State: PUBLISHED Published: 2025-04-07T00:00:00.000Z Last Updated: 2025-04-08T19:36:15.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not properly validate whether the requesting user has permission to modify the specified dictId Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yangzongzhuan/RuoYi - https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28407.md
CVE ID: CVE-2025-28408 State: PUBLISHED Published: 2025-04-07T00:00:00.000Z Last Updated: 2025-04-08T19:34:46.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endpoint does not properly validate the deptId parameter Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yangzongzhuan/RuoYi - https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28408.md
CVE ID: CVE-2025-28409 State: PUBLISHED Published: 2025-04-07T00:00:00.000Z Last Updated: 2025-04-08T19:33:50.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not properly validate whether the requesting user has permission to add a menu item under the specified parentId Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yangzongzhuan/RuoYi - https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28408.md
CVE ID: CVE-2025-28410 State: PUBLISHED Published: 2025-04-07T00:00:00.000Z Last Updated: 2025-04-08T19:32:22.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whether the requesting user has administrative privileges Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yangzongzhuan/RuoYi - https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28409.md
CVE ID: CVE-2025-28411 State: PUBLISHED Published: 2025-04-07T00:00:00.000Z Last Updated: 2025-04-08T19:30:30.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yangzongzhuan/RuoYi - https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28411.md
CVE ID: CVE-2025-28412 State: PUBLISHED Published: 2025-04-07T00:00:00.000Z Last Updated: 2025-04-08T19:29:12.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yangzongzhuan/RuoYi - https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28412.md
CVE ID: CVE-2025-28413 State: PUBLISHED Published: 2025-04-07T00:00:00.000Z Last Updated: 2025-04-08T16:05:26.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yangzongzhuan/RuoYi - https://github.com/20210607/cve_public/blob/main/ruoyi_case/CVE-2025-28413.md
CVE ID: CVE-2025-28855 State: PUBLISHED Published: 2025-03-26T14:24:21.408Z Last Updated: 2025-04-03T13:05:31.744Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Teleport Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Teleport allows Reflected XSS. This issue affects Teleport: from n/a through 1.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/teleport/vulnerability/wordpress-teleport-plugin-1-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-28856 State: PUBLISHED Published: 2025-03-11T21:00:30.006Z Last Updated: 2025-03-12T15:06:55.298Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: dangrossman Products: W3Counter Free Real-Time Web Stats Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in dangrossman W3Counter Free Real-Time Web Stats allows Cross Site Request Forgery. This issue affects W3Counter Free Real-Time Web Stats: from n/a through 4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/blog-stats-by-w3counter/vulnerability/wordpress-w3counter-free-real-time-web-stats-plu
ack.com/database/wordpress/plugin/blog-stats-by-w3counter/vulnerability/wordpress-w3counter-free-real-time-web-stats-plugin-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-28857 State: PUBLISHED Published: 2025-03-11T21:00:30.828Z Last Updated: 2025-03-12T15:06:49.216Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: rankchecker Products: Rankchecker.io Integration Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in rankchecker Rankchecker.io Integration allows Stored XSS. This issue affects Rankchecker.io Integration: from n/a through 1.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/rankchecker-io-integration/vulnerability/wordpress-rankchecker-io-integration-plugin-1-0-9-csrf-to-stored-cross-site-scripting
ecker-io-integration/vulnerability/wordpress-rankchecker-io-integration-plugin-1-0-9-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-28858 State: PUBLISHED Published: 2025-03-26T14:24:21.625Z Last Updated: 2025-03-26T16:21:00.200Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Arrow Plugins Products: Arrow Maps Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arrow Plugins Arrow Maps allows Reflected XSS. This issue affects Arrow Maps: from n/a through 1.0.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ap-google-maps/vulnerability/wordpress-arrow-maps-plugin-1-0-9-reflected-cross-site-scripting-xss-vulnerability?_s_id
in/ap-google-maps/vulnerability/wordpress-arrow-maps-plugin-1-0-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-28859 State: PUBLISHED Published: 2025-03-11T21:00:31.578Z Last Updated: 2025-03-12T15:06:41.006Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: CodeVibrant Products: Maintenance Notice Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in CodeVibrant Maintenance Notice allows Cross Site Request Forgery. This issue affects Maintenance Notice: from n/a through 1.0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/maintenance-notice/vulnerability/wordpress-maintenance-notice-plugin-1-0-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-28860 State: PUBLISHED Published: 2025-03-11T21:00:32.290Z Last Updated: 2025-03-12T15:06:33.675Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: PPDPurveyor Products: Google News Editors Picks Feed Generator Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in PPDPurveyor Google News Editors Picks Feed Generator allows Stored XSS. This issue affects Google News Editors Picks Feed Generator: from n/a through 2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/google-news-editors-picks-news-feeds/vulnerability/wordpress-google-news-editors-picks
ack.com/database/wordpress/plugin/google-news-editors-picks-news-feeds/vulnerability/wordpress-google-news-editors-picks-feed-generator-plugin-2-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-28861 State: PUBLISHED Published: 2025-03-11T21:00:33.023Z Last Updated: 2025-03-12T15:06:27.688Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: bhzad Products: WP jQuery Persian Datepicker Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in bhzad WP jQuery Persian Datepicker allows Stored XSS. This issue affects WP jQuery Persian Datepicker: from n/a through 0.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpjqp-datepicker/vulnerability/wordpress-wp-jquery-persian-datepicker-plugin-0-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-28862 State: PUBLISHED Published: 2025-03-11T21:00:33.838Z Last Updated: 2025-03-12T15:06:21.109Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Venugopal Products: Comment Date and Gravatar remover Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Comment Date and Gravatar remover allows Cross Site Request Forgery. This issue affects Comment Date and Gravatar remover: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/remove-date-and-gravatar-under-comment/vulnerability/wordpress-comment-date-and-gravatar-remo
/database/wordpress/plugin/remove-date-and-gravatar-under-comment/vulnerability/wordpress-comment-date-and-gravatar-remover-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-28863 State: PUBLISHED Published: 2025-03-11T21:00:34.607Z Last Updated: 2025-03-12T15:06:14.490Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Carlos Minatti Products: Delete Original Image Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Carlos Minatti Delete Original Image allows Cross Site Request Forgery. This issue affects Delete Original Image: from n/a through 0.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/delete-original-image/vulnerability/wordpress-delete-original-image-plugin-0-4-cross-site-request-forgery-csrf-vulnerab
/delete-original-image/vulnerability/wordpress-delete-original-image-plugin-0-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-28864 State: PUBLISHED Published: 2025-03-11T21:00:35.309Z Last Updated: 2025-03-12T15:06:08.480Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Planet Studio Products: Builder for Contact Form 7 by Webconstruct Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Planet Studio Builder for Contact Form 7 by Webconstruct allows Cross Site Request Forgery. This issue affects Builder for Contact Form 7 by Webconstruct: from n/a through 1.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cf7-builder/vulnerability/wordpress-builder-for-contact-
References: - https://patchstack.com/database/wordpress/plugin/cf7-builder/vulnerability/wordpress-builder-for-contact-form-7-by-webconstruct-plugin-1-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-28865 State: PUBLISHED Published: 2025-03-26T14:24:21.770Z Last Updated: 2025-03-26T16:18:52.448Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: lionelroux Products: WP Colorful Tag Cloud Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lionelroux WP Colorful Tag Cloud allows Reflected XSS. This issue affects WP Colorful Tag Cloud: from n/a through 2.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-colorful-tag-cloud/vulnerability/wordpress-wp-colorful-tag-cloud-plugin-2-0-1-reflected
com/database/wordpress/plugin/wp-colorful-tag-cloud/vulnerability/wordpress-wp-colorful-tag-cloud-plugin-2-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-28866 State: PUBLISHED Published: 2025-03-11T21:00:36.058Z Last Updated: 2025-03-12T15:05:59.895Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: smerriman Products: Login Logger Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in smerriman Login Logger allows Cross Site Request Forgery. This issue affects Login Logger: from n/a through 1.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/login-logger/vulnerability/wordpress-login-logger-plugin-1-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-28867 State: PUBLISHED Published: 2025-03-11T21:00:36.818Z Last Updated: 2025-03-12T15:05:53.463Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: stesvis Products: Frontpage category filter Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in stesvis Frontpage category filter allows Cross Site Request Forgery. This issue affects Frontpage category filter: from n/a through 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/frontpage-category-filter/vulnerability/wordpress-frontpage-category-filter-plugin-1-0-2-cross-site-request-forgery-csr
/frontpage-category-filter/vulnerability/wordpress-frontpage-category-filter-plugin-1-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-28868 State: PUBLISHED Published: 2025-03-11T21:01:57.929Z Last Updated: 2025-03-12T14:08:00.629Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ZipList Products: ZipList Recipe Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ZipList ZipList Recipe allows Cross Site Request Forgery. This issue affects ZipList Recipe: from n/a through 3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ziplist-recipe-plugin/vulnerability/wordpress-ziplist-recipe-plugin-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-28869 State: PUBLISHED Published: 2025-03-26T14:24:21.942Z Last Updated: 2025-03-26T16:06:56.018Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: NextGEN Gallery Voting Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound NextGEN Gallery Voting allows Reflected XSS. This issue affects NextGEN Gallery Voting: from n/a through 2.7.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/nextgen-gallery-voting/vulnerability/wordpress-nextgen-gallery-voting-plugin-2-7-6-reflecte
om/database/wordpress/plugin/nextgen-gallery-voting/vulnerability/wordpress-nextgen-gallery-voting-plugin-2-7-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-28870 State: PUBLISHED Published: 2025-03-11T21:00:38.190Z Last Updated: 2025-03-12T15:05:46.947Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: amocrm Products: amoCRM WebForm Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in amocrm amoCRM WebForm allows DOM-Based XSS. This issue affects amoCRM WebForm: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/amocrm-webform/vulnerability/wordpress-amocrm-webform-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-28871 State: PUBLISHED Published: 2025-03-11T21:00:38.920Z Last Updated: 2025-03-12T13:52:46.656Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: jwpegram Products: Block Spam By Math Reloaded Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jwpegram Block Spam By Math Reloaded allows Stored XSS. This issue affects Block Spam By Math Reloaded: from n/a through 2.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/block-spam-by-math-reloaded/vulnerability/wordpress-block-spam-by-math-reload
//patchstack.com/database/wordpress/plugin/block-spam-by-math-reloaded/vulnerability/wordpress-block-spam-by-math-reloaded-plugin-2-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-28872 State: PUBLISHED Published: 2025-03-11T21:00:39.635Z Last Updated: 2025-03-12T13:52:39.865Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: jwpegram Products: Block Spam By Math Reloaded Problem Types: CWE-862 Description: Missing Authorization vulnerability in jwpegram Block Spam By Math Reloaded allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Block Spam By Math Reloaded: from n/a through 2.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/block-spam-by-math-reloaded/vulnerability/wordpress-block-spam-by-math-reloaded-plugin-2-2-4-
/database/wordpress/plugin/block-spam-by-math-reloaded/vulnerability/wordpress-block-spam-by-math-reloaded-plugin-2-2-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-28873 State: PUBLISHED Published: 2025-03-26T14:24:22.109Z Last Updated: 2025-03-26T15:48:18.518Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: NotFound Products: Shuffle Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Shuffle allows Blind SQL Injection. This issue affects Shuffle: from n/a through 0.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/shuffle/vulnerability/wordpress-shuffle-plugin-0-5-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-28874 State: PUBLISHED Published: 2025-03-11T21:00:40.315Z Last Updated: 2025-03-12T13:52:32.939Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: shanebp Products: BP Email Assign Templates Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in shanebp BP Email Assign Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects BP Email Assign Templates: from n/a through 1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bp-email-assign-templates/vulnerability/wordpress-bp-email-assign-te
- https://patchstack.com/database/wordpress/plugin/bp-email-assign-templates/vulnerability/wordpress-bp-email-assign-templates-by-shanebp-plugin-1-6-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2025-28875 State: PUBLISHED Published: 2025-03-11T21:00:41.047Z Last Updated: 2025-03-12T13:52:26.708Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: shanebp Products: BP Email Assign Templates Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Email Assign Templates allows Stored XSS. This issue affects BP Email Assign Templates: from n/a through 1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bp-email-assign-templates/vulnerability/wordpress-bp-email-assign-templates-by-shanebp-
ck.com/database/wordpress/plugin/bp-email-assign-templates/vulnerability/wordpress-bp-email-assign-templates-by-shanebp-plugin-1-6-cross-site-scripting-vulnerability?_s_id=cve
CVE ID: CVE-2025-28876 State: PUBLISHED Published: 2025-03-11T21:00:41.723Z Last Updated: 2025-03-12T13:52:20.917Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Skrill_Team Products: Skrill Official Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Skrill_Team Skrill Official allows Cross Site Request Forgery. This issue affects Skrill Official: from n/a through 1.0.65. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/official-skrill-woocommerce/vulnerability/wordpress-skrill-official-plugin-1-0-65-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-28877 State: PUBLISHED Published: 2025-03-26T14:24:22.263Z Last Updated: 2025-03-26T15:34:25.532Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: NotFound Products: Key4ce osTicket Bridge Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Key4ce osTicket Bridge allows Reflected XSS. This issue affects Key4ce osTicket Bridge: from n/a through 1.4.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/key4ce-osticket-bridge/vulnerability/wordpress-key4ce-osticket-bridge-plugin-1-4-0-reflecte
om/database/wordpress/plugin/key4ce-osticket-bridge/vulnerability/wordpress-key4ce-osticket-bridge-plugin-1-4-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve