Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-48105 State: PUBLISHED Published: 2025-09-05T16:15:41.940Z Last Updated: 2025-09-09T13:44:12.840Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Vincent Boiardt Products: Easy Flash Embed Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Boiardt Easy Flash Embed allows Stored XSS. This issue affects Easy Flash Embed: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/easy-flash-embed/vulnerability/wordpress-easy-flash-embed-plugin-1-0-cross-site-scripting-xss-vuln
base/wordpress/plugin/easy-flash-embed/vulnerability/wordpress-easy-flash-embed-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48106 State: PUBLISHED Published: 2025-10-22T14:32:07.674Z Last Updated: 2025-11-13T10:33:39.905Z Vendors: CMSSuperHeroes Products: Clanora Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in CMSSuperHeroes Clanora clanora allows Using Malicious Files.This issue affects Clanora: from n/a through < 1.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/clanora/vulnerability/wordpress-clanora-theme-1-3-1-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-48107 State: PUBLISHED Published: 2025-09-26T08:31:13.612Z Last Updated: 2025-09-26T13:56:23.533Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: undsgn Products: Uncode Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in undsgn Uncode allows Reflected XSS. This issue affects Uncode: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/uncode/vulnerability/wordpress-uncode-theme-2-9-4-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48108 State: PUBLISHED Published: 2025-08-26T09:41:50.512Z Last Updated: 2025-08-26T15:33:43.967Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Mojoomla Products: School Management Problem Types: CWE-862 Description: Missing Authorization vulnerability in Mojoomla School Management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects School Management: from n/a through 93.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/school-management/vulnerability/wordpress-school-management-plugin-plugin-93-2-0-broken-access-control-vulnerabilit
ugin/school-management/vulnerability/wordpress-school-management-plugin-plugin-93-2-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-48109 State: PUBLISHED Published: 2025-08-28T12:36:46.381Z Last Updated: 2025-08-28T14:47:52.223Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Xavier Media Products: XM-Backup Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Xavier Media XM-Backup allows Stored XSS. This issue affects XM-Backup: from n/a through 0.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/xm-backup/vulnerability/wordpress-xm-backup-plugin-0-9-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48110 State: PUBLISHED Published: 2025-08-28T12:36:47.016Z Last Updated: 2025-08-28T14:47:45.897Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: mibuthu Products: Link View Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mibuthu Link View allows Stored XSS. This issue affects Link View: from n/a through 0.8.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/link-view/vulnerability/wordpress-link-view-plugin-0-8-0-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-48111 State: PUBLISHED Published: 2025-06-17T15:01:43.752Z Last Updated: 2025-06-17T15:39:50.617Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: YITHEMES Products: YITH PayPal Express Checkout for WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.49.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/yith-paypal-express-checkout-for-woocommerce/vulnerability/
ferences: - https://patchstack.com/database/wordpress/plugin/yith-paypal-express-checkout-for-woocommerce/vulnerability/wordpress-yith-paypal-express-checkout-for-woocommerce-plugin-1-49-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-48112 State: PUBLISHED Published: 2025-05-16T15:45:06.405Z Last Updated: 2025-05-16T16:25:37.877Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: karimmughal Products: Dot html,php,xml etc pages Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in karimmughal Dot html,php,xml etc pages allows Reflected XSS. This issue affects Dot html,php,xml etc pages: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/dot-htmlphpxml-etc-pages/vulnerability/wordpress-dot-html-php-xml-etc-pages
s://patchstack.com/database/wordpress/plugin/dot-htmlphpxml-etc-pages/vulnerability/wordpress-dot-html-php-xml-etc-pages-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48113 State: PUBLISHED Published: 2025-05-16T15:45:06.919Z Last Updated: 2025-05-16T16:24:21.503Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Broadstreet Products: Broadstreet Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Broadstreet Broadstreet allows Stored XSS. This issue affects Broadstreet: from n/a through 1.51.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/broadstreet/vulnerability/wordpress-broadstreet-1-51-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48114 State: PUBLISHED Published: 2025-05-16T15:45:07.460Z Last Updated: 2025-09-15T08:57:58.318Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: ShayanWeb Products: ShayanWeb Admin FontChanger Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ShayanWeb Admin FontChanger allows Stored XSS.This issue affects ShayanWeb Admin FontChanger: from n/a through 1.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/shayanweb-admin-fontchanger/vulnerability/wordpress-shayanweb-admin-fontchanger-plugin-1-8-1-cross-site-request-forgery-csrf-to-stored-xss
ntchanger/vulnerability/wordpress-shayanweb-admin-fontchanger-plugin-1-8-1-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48115 State: PUBLISHED Published: 2025-05-16T15:45:07.990Z Last Updated: 2025-05-16T16:23:56.393Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Javier Revilla Products: ValidateCertify Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Javier Revilla ValidateCertify allows Cross Site Request Forgery. This issue affects ValidateCertify: from n/a through 1.6.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/validar-certificados-de-cursos/vulnerability/wordpress-validatecertify-1-6-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-48116 State: PUBLISHED Published: 2025-05-16T15:45:08.523Z Last Updated: 2025-05-16T16:52:50.039Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Ashan Perera Products: EventON Problem Types: CWE-862 Description: Missing Authorization vulnerability in Ashan Perera EventON allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EventON: from n/a through 2.4.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/eventon-lite/vulnerability/wordpress-eventon-2-4-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-48117 State: PUBLISHED Published: 2025-05-16T15:45:09.119Z Last Updated: 2025-05-16T16:51:06.765Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: kilbot Products: WooCommerce POS Problem Types: CWE-862 Description: Missing Authorization vulnerability in kilbot WooCommerce POS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooCommerce POS: from n/a through 1.7.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woocommerce-pos/vulnerability/wordpress-woocommerce-pos-1-7-8-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-48118 State: PUBLISHED Published: 2025-06-17T15:01:32.252Z Last Updated: 2025-06-17T18:37:44.917Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: WpExperts Hub Products: Woocommerce Partial Shipment Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpExperts Hub Woocommerce Partial Shipment allows SQL Injection. This issue affects Woocommerce Partial Shipment: from n/a through 3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wc-partial-shipment/vulnerability/wordpress-woocommerce-partial-s
es: - https://patchstack.com/database/wordpress/plugin/wc-partial-shipment/vulnerability/wordpress-woocommerce-partial-shipment-3-2-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-48119 State: PUBLISHED Published: 2025-05-16T15:45:09.672Z Last Updated: 2025-05-16T16:50:57.760Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: RS WP THEMES Products: RS WP Book Showcase Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in RS WP THEMES RS WP Book Showcase allows Code Injection. This issue affects RS WP Book Showcase: from n/a through 6.7.41. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/rs-wp-books-showcase/vulnerability/wordpress-rs-wp-book-showcase-plugin-6-7-40-arbitrary-shortcode-execution-vulner
ugin/rs-wp-books-showcase/vulnerability/wordpress-rs-wp-book-showcase-plugin-6-7-40-arbitrary-shortcode-execution-vulnerability?_s_id=cve
CVE ID: CVE-2025-48120 State: PUBLISHED Published: 2025-05-16T15:45:10.264Z Last Updated: 2025-05-16T16:50:49.011Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: RomanCode Products: MapSVG Lite Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in RomanCode MapSVG Lite allows Code Injection. This issue affects MapSVG Lite: from n/a through 8.6.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-lite-plugin-8-5-41-arbitrary-shortcode-execution-vulnerability?_s_id=cve
CVE ID: CVE-2025-48121 State: PUBLISHED Published: 2025-05-16T15:45:10.875Z Last Updated: 2025-05-16T16:50:41.189Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Steve Puddick Products: WP Notes Widget Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Puddick WP Notes Widget allows DOM-Based XSS. This issue affects WP Notes Widget: from n/a through 1.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-notes-widget/vulnerability/wordpress-wp-notes-widget-1-0-6-cross-site-scripting-xss-vulnerability
se/wordpress/plugin/wp-notes-widget/vulnerability/wordpress-wp-notes-widget-1-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48122 State: PUBLISHED Published: 2025-06-09T15:54:06.451Z Last Updated: 2025-06-10T13:40:08.488Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: Holest Engineering Products: Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light allows SQL Injection. This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through 2.4.37. Additional Analyst Notes: - CISA ADP Vulnrich
hanger for WooCommerce and WP E-commerce – Light: from n/a through 2.4.37. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/vulnerability/wordpress-spreadsheet-price-changer-for-woocommerce-and-wp-e-commerce-light-2-4-37-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-48123 State: PUBLISHED Published: 2025-06-09T15:54:05.742Z Last Updated: 2025-06-10T13:40:50.801Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Holest Engineering Products: Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light allows Code Injection. This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through 2.4.37. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
WP E-commerce – Light: from n/a through 2.4.37. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/vulnerability/wordpress-spreadsheet-price-changer-for-woocommerce-and-wp-e-commerce-light-2-4-37-remote-code-execution-rce-vulnerability?_s_id=cve
CVE ID: CVE-2025-48124 State: PUBLISHED Published: 2025-06-09T15:54:05.023Z Last Updated: 2025-06-10T13:41:14.270Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Holest Engineering Products: Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light allows Path Traversal. This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through 2.4.37. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
r WooCommerce and WP E-commerce – Light: from n/a through 2.4.37. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/vulnerability/wordpress-spreadsheet-price-changer-for-woocommerce-and-wp-e-commerce-light-2-4-37-arbitrary-file-download-vulnerability?_s_id=cve
CVE ID: CVE-2025-48125 State: PUBLISHED Published: 2025-06-09T15:54:04.283Z Last Updated: 2025-06-10T13:41:33.327Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WP Event Manager Products: WP Event Manager Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Event Manager WP Event Manager allows PHP Local File Inclusion. This issue affects WP Event Manager: from n/a through 3.1.49. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-event-manager/vulnerability/wordpress-wp-event-manager-3-1-
ences: - https://patchstack.com/database/wordpress/plugin/wp-event-manager/vulnerability/wordpress-wp-event-manager-3-1-49-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-48126 State: PUBLISHED Published: 2025-06-09T15:54:03.530Z Last Updated: 2025-06-10T13:41:51.011Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: g5theme Products: Essential Real Estate Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate allows PHP Local File Inclusion. This issue affects Essential Real Estate: from n/a through 5.2.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/essential-real-estate/vulnerability/wordpress-essential-real-estat
s: - https://patchstack.com/database/wordpress/plugin/essential-real-estate/vulnerability/wordpress-essential-real-estate-5-2-1-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-48127 State: PUBLISHED Published: 2025-05-16T15:45:11.459Z Last Updated: 2025-05-16T16:50:35.035Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: App Cheap Products: Push notification for Mobile and Web app Problem Types: CWE-862 Description: Missing Authorization vulnerability in App Cheap Push notification for Mobile and Web app allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Push notification for Mobile and Web app: from n/a through 2.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/push-notification-mobile-and-web-app/vulnera
ulnrichment: References: - https://patchstack.com/database/wordpress/plugin/push-notification-mobile-and-web-app/vulnerability/wordpress-push-notification-for-mobile-and-web-app-2-0-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-48128 State: PUBLISHED Published: 2025-05-16T15:45:12.066Z Last Updated: 2025-05-16T16:50:28.265Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Sharespine Products: Sharespine Woocommerce Connector Problem Types: CWE-862 Description: Missing Authorization vulnerability in Sharespine Sharespine Woocommerce Connector allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sharespine Woocommerce Connector: from n/a through 4.7.55. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/sharespine-woocommerce-connector/vulnerability/wordpress-sharespi
es: - https://patchstack.com/database/wordpress/plugin/sharespine-woocommerce-connector/vulnerability/wordpress-sharespine-woocommerce-connector-4-7-55-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-48129 State: PUBLISHED Published: 2025-06-09T15:54:02.694Z Last Updated: 2025-06-10T13:42:18.370Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Holest Engineering Products: Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light allows Privilege Escalation. This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through 2.4.37. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/dat
ht: from n/a through 2.4.37. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/vulnerability/wordpress-spreadsheet-price-changer-for-woocommerce-and-wp-e-commerce-light-2-4-37-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-48130 State: PUBLISHED Published: 2025-06-09T15:54:01.031Z Last Updated: 2025-06-10T13:42:41.038Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: spicethemes Products: Spice Blocks Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spicethemes Spice Blocks allows Path Traversal. This issue affects Spice Blocks: from n/a through 2.0.7.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/spice-blocks/vulnerability/wordpress-spice-blocks-2-0-7-2-arbitrary-file-download-vulnerability?_s_id=cve
CVE ID: CVE-2025-48131 State: PUBLISHED Published: 2025-05-16T15:45:12.591Z Last Updated: 2025-05-16T16:50:21.240Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Saiful Islam Products: UltraAddons Elementor Lite Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lite allows Stored XSS. This issue affects UltraAddons Elementor Lite: from n/a through 2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ultraaddons-elementor-lite/vulnerability/wordpress-ultraaddons-elementor
ttps://patchstack.com/database/wordpress/plugin/ultraaddons-elementor-lite/vulnerability/wordpress-ultraaddons-elementor-lite-2-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48132 State: PUBLISHED Published: 2025-05-16T15:45:13.127Z Last Updated: 2025-05-16T16:50:14.389Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: pencilwp Products: X Addons for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pencilwp X Addons for Elementor allows Stored XSS. This issue affects X Addons for Elementor: from n/a through 1.0.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/x-addons-elementor/vulnerability/wordpress-x-addons-for-elementor-1-0-14-cross-site-scripti
om/database/wordpress/plugin/x-addons-elementor/vulnerability/wordpress-x-addons-for-elementor-1-0-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-48133 State: PUBLISHED Published: 2025-06-05T20:49:14.279Z Last Updated: 2025-06-06T14:41:09.528Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Uncanny Owl Products: Uncanny Automator Problem Types: CWE-862 Description: Missing Authorization vulnerability in Uncanny Owl Uncanny Automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through 6.4.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/uncanny-automator/vulnerability/wordpress-uncanny-automator-6-5-0-1-broken-access-control-vulnerability?_s_i
ress/plugin/uncanny-automator/vulnerability/wordpress-uncanny-automator-6-5-0-1-broken-access-control-vulnerability?_s_id=cve