Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-12634 State: PUBLISHED Published: 2025-11-25T07:28:27.011Z Last Updated: 2025-11-25T07:28:27.011Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: sunarc Products: Refund Request for WooCommerce Problem Types: CWE-862 Description: The Refund Request for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_refund_status' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update refund statuses to approved or rejected. References: - https://www.wordfence.com/threat-intel/
cess and above, to update refund statuses to approved or rejected. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f15b4596-8e00-4e66-8b51-f49ede1ff307?source=cve - https://wordpress.org/plugins/refund-request-for-woocommerce/
CVE ID: CVE-2025-12636 State: PUBLISHED Published: 2025-11-06T22:15:01.130Z Last Updated: 2025-11-07T13:24:09.996Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Ubia Products: Ubox Problem Types: CWE-522 Description: The Ubia camera ecosystem fails to adequately secure API credentials, potentially enabling an attacker to connect to backend services. The attacker would then be able to gain unauthorized access to available cameras, enabling the viewing of live feeds or modification of settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-310-02 - https://github.com/cisagov/CSAF/blob
ent: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-310-02 - https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-310-02.json
CVE ID: CVE-2025-12637 State: PUBLISHED Published: 2025-11-11T03:30:50.343Z Last Updated: 2025-11-12T20:05:15.227Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: koopersmith Products: Elastic Theme Editor Problem Types: CWE-94 Description: The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the process_theme function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CI
itrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e158a13d-5452-492a-875e-53791e1ff840?source=cve - https://plugins.trac.wordpress.org/browser/elastic-theme-editor/trunk/editor/class-elastic-editor.php
CVE ID: CVE-2025-12639 State: PUBLISHED Published: 2025-11-18T09:27:39.489Z Last Updated: 2025-11-18T21:10:14.550Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: sundayfanz Products: wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions | for WooCommerce Problem Types: CWE-862 Description: The wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to access sensitive information via the AJAX endpoint. This makes it possible for authenticated attackers, with sub
ized to access sensitive information via the AJAX endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive information including user emails, usernames, roles, capabilities, and WooCommerce data such as products and payment methods. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/979001c4-45dd-4168-8749-c8eebe237b60?source=cve - https://plugins.trac.wordpress.org/browser/catalog-mode-pricing-enquiry-forms-promotions/tags/1.2.1/framework/reon/core/class.reon.core.ajax.php#L12 - https://plugins.trac.wordpress.org/browser/catalog-mode-pricing-enquiry-forms
k/reon/core/class.reon.core.ajax.php#L12 - https://plugins.trac.wordpress.org/browser/catalog-mode-pricing-enquiry-forms-promotions/tags/1.2.1/framework/reon/core/class.reon.core.ajax.php#L29 - https://plugins.trac.wordpress.org/browser/catalog-mode-pricing-enquiry-forms-promotions/tags/1.2.1/framework/reon/core/class.reon.core.ajax.php#L165 - https://plugins.trac.wordpress.org/changeset/3392651/catalog-mode-pricing-enquiry-forms-promotions/trunk?contextall=1&old=3390779&old_path=%2Fcatalog-mode-pricing-enquiry-forms-promotions%2Ftrunk#file11
CVE ID: CVE-2025-12642 State: PUBLISHED Published: 2025-11-03T19:36:17.011Z Last Updated: 2025-11-03T19:44:09.174Z Vendors: lighttpd Products: lighttpd Problem Types: CWE-444 Description: lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: * Bypass access control rules * Inject unsafe input into backend logic that trusts request headers * Execute HTTP Request Smuggling attacks under some conditions This issue affects lighttpd1.4.80 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lighttpd/lighttpd1.
s lighttpd1.4.80 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lighttpd/lighttpd1.4/commit/35cb89c103877de62d6b63d0804255475d77e5e1
CVE ID: CVE-2025-12643 State: PUBLISHED Published: 2025-11-08T09:28:10.300Z Last Updated: 2025-11-10T14:13:54.175Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: saphali Products: Saphali LiqPay for donate Problem Types: CWE-79 Description: The Saphali LiqPay for donate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saphali_liqpay' shortcode in all versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute
nticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/63d73de6-56ac-41ab-a673-4e379eeed26c?source=cve - https://plugins.trac.wordpress.org/browser/saphali-liqpay-for-donate/tags/1.0.2/liqpay-d.php#L102 - https://plugins.trac.wordpress.org/changeset/3391235/saphali-liqpay-for-donate/
CVE ID: CVE-2025-12644 State: PUBLISHED Published: 2025-11-11T03:30:37.739Z Last Updated: 2025-11-12T20:07:53.036Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpcox Products: Nonaki – Drag and Drop Email Template builder and Newsletter plugin for WordPress Problem Types: CWE-79 Description: The Nonaki – Drag and Drop Email Template builder and Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nonaki' shortcode in all versions up to, and including, 1.0.11. This is due to insufficient input sanitization and output escaping on user supplied custom field values that are retrieved and rendered by the shortcode. This makes i
and output escaping on user supplied custom field values that are retrieved and rendered by the shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/467261ba-f41f-4e94-8941-e5b3d8392fdb?source=cve - https://plugins.trac.wordpress.org/browser/nonaki-email-template-customizer/tags/1.0.11/includes/shortcode.php#L21 - https://plugins.trac.wordpress.org/browser/nonaki-email-template-customizer/tags/1.0.11/includes/helper.php
de.php#L21 - https://plugins.trac.wordpress.org/browser/nonaki-email-template-customizer/tags/1.0.11/includes/helper.php#L108
CVE ID: CVE-2025-12645 State: PUBLISHED Published: 2025-11-25T07:28:25.635Z Last Updated: 2025-11-25T07:28:25.635Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: karthiksg Products: Inline frame – Iframe Problem Types: CWE-79 Description: The Inline frame – Iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embedsite' shortcode in all versions up to, and including, 0.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a us
ckers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ceda1e49-4e65-4038-9207-ef4647838f53?source=cve - https://plugins.trac.wordpress.org/browser/inline-frame-iframe/tags/0.1/iframe.php#L76
CVE ID: CVE-2025-12646 State: PUBLISHED Published: 2025-11-19T05:45:12.700Z Last Updated: 2025-11-19T20:23:14.530Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: jackdewey Products: Community Events Problem Types: CWE-89 Description: The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'dayofyear' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive informatio
ttackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/579b6eb0-dbb7-4586-aecc-f295889a2b2b?source=cve - https://plugins.trac.wordpress.org/changeset/3396731/community-events/trunk/community-events.php
CVE ID: CVE-2025-12651 State: PUBLISHED Published: 2025-11-11T03:30:53.197Z Last Updated: 2025-11-14T15:29:54.335Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: eggemplo Products: Live Photos on WordPress Problem Types: CWE-79 Description: The Live Photos on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_src', 'img_src', and 'class' parameters in the livephotos_photo shortcode in all versions up to, and including, 0.1. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to injec
pplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute when a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fba3090f-2cc2-4e40-8080-ae83ba321a67?source=cve - https://plugins.trac.wordpress.org/browser/live-photos/tags/0.1/core/class-livephotos-shortcodes.php#L42
CVE ID: CVE-2025-12652 State: PUBLISHED Published: 2025-11-11T03:30:34.413Z Last Updated: 2025-11-12T20:08:47.796Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: oscaruribe Products: Ungapped Widgets Problem Types: CWE-79 Description: The Ungapped Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'prefillvalues' parameter in the ungapped-form shortcode in all versions up to, and including, 1. This is due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wi
e for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute when a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/25d0921b-39b1-4abb-9197-952fc55f80e6?source=cve - https://plugins.trac.wordpress.org/browser/ungapped-widgets/tags/1/ungapped-widgets-plugin.php#L38
CVE ID: CVE-2025-12657 State: PUBLISHED Published: 2025-11-03T21:03:25.384Z Last Updated: 2025-11-03T21:26:22.750Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H) Vendors: MongoDB Inc. Products: MongoDB Server Problem Types: CWE-754 Description: The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access violations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-101230
CVE ID: CVE-2025-12658 State: PUBLISHED Published: 2025-11-11T03:30:48.132Z Last Updated: 2025-11-14T15:30:37.671Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mmdeveloper Products: Preload Current Images Problem Types: CWE-79 Description: The Preload Current Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'complete' parameter in the 'preload_progress_bar' shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scrip
is makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b9909373-48d7-425b-a20b-bb8bf2a80e9b?source=cve - https://wordpress.org/plugins/preload-current-images/ - https://plugins.trac.wordpress.org/browser/preload-current-images/tags/1.3/preload-current-images.php#L31
CVE ID: CVE-2025-12660 State: PUBLISHED Published: 2025-11-21T07:31:45.915Z Last Updated: 2025-11-21T14:57:46.249Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: coffeebite Products: Padlet Shortcode Problem Types: CWE-79 Description: The Padlet Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'key' parameter in the 'wallwisher' shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execut
henticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/09989141-43ba-446c-8230-0485add7a1e2?source=cve - https://wordpress.org/plugins/wallwisher-shortcode/ - https://plugins.trac.wordpress.org/browser/wallwisher-shortcode/tags/1.3/wallwisher.php#L22
CVE ID: CVE-2025-12661 State: PUBLISHED Published: 2025-11-21T07:31:46.699Z Last Updated: 2025-11-21T14:57:35.194Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: qzzr Products: Pollcaster Shortcode Plugin Problem Types: CWE-79 Description: The Pollcaster Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter in the 'pollcaster' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that
ible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/120ba9e5-9594-4a4f-b475-ef3fcf5f4565?source=cve - https://wordpress.org/plugins/pollcaster-shortcode/ - https://plugins.trac.wordpress.org/browser/pollcaster-shortcode/tags/1.0/pollcaster.php#L33
CVE ID: CVE-2025-12662 State: PUBLISHED Published: 2025-11-11T03:30:51.766Z Last Updated: 2025-11-12T20:04:42.551Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: andrico Products: Coon Google Maps Problem Types: CWE-79 Description: The Coon Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter in the 'map' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whene
ted attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f0d0eaa0-ad8f-418c-bb61-eb209ba0249b?source=cve - https://wordpress.org/plugins/coon-google-maps/ - https://plugins.trac.wordpress.org/browser/coon-google-maps/tags/1.0/coon-google-maps.php#L71
CVE ID: CVE-2025-12663 State: PUBLISHED Published: 2025-11-11T03:30:49.630Z Last Updated: 2025-11-14T15:30:11.959Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: jahed Products: Jeba Cute forkit Problem Types: CWE-79 Description: The Jeba Cute forkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' parameter in the 'jeba_forkit' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute w
ticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d4aa9303-953f-4bc3-8069-8e9a967461a9?source=cve - https://wordpress.org/plugins/jeba-cute-forkit/ - https://plugins.trac.wordpress.org/browser/jeba-cute-forkit/tags/1.0/jeba-forkit-index.php#L58
CVE ID: CVE-2025-12665 State: PUBLISHED Published: 2025-11-11T03:30:46.636Z Last Updated: 2025-11-12T20:05:39.808Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: lovelightplugins Products: Ninja Countdown | Fastest Countdown Builder Problem Types: CWE-862 Description: The Ninja Countdown | Fastest Countdown Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ninja_countdown_admin_ajax' AJAX endpoint in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary countdowns. Additional Analyst Notes: - CIS
cated attackers, with Subscriber-level access and above, to delete arbitrary countdowns. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9b0b6433-5651-4a9d-8356-5d02d51830f4?source=cve - https://wordpress.org/plugins/ninja-countdown/
CVE ID: CVE-2025-12667 State: PUBLISHED Published: 2025-11-11T03:30:53.548Z Last Updated: 2025-11-14T15:29:48.651Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: paul1999 Products: GitHub Gist Shortcode Plugin Problem Types: CWE-79 Description: The GitHub Gist Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'gist' shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an
ntributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fc6468bf-37b6-4dd7-b2e5-e880e3cc3c32?source=cve - https://wordpress.org/plugins/github-gist-shortcode/ - https://plugins.trac.wordpress.org/browser/github-gist-shortcode/tags/0.2/github-gist-shortcode-plugin.php#L33
CVE ID: CVE-2025-12668 State: PUBLISHED Published: 2025-11-11T03:30:48.513Z Last Updated: 2025-11-14T15:30:31.321Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sitedin Products: WP Count Down Timer Problem Types: CWE-79 Description: The WP Count Down Timer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_countdown_timer' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user access
th Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bcbcad73-ce2a-4eb2-9b7f-91d47a93e16d?source=cve - https://wordpress.org/plugins/wp-count-down-timer/ - https://plugins.trac.wordpress.org/browser/wp-count-down-timer/tags/1.0.1/wp-count-down-timer.php#L69
CVE ID: CVE-2025-12671 State: PUBLISHED Published: 2025-11-11T03:30:46.108Z Last Updated: 2025-11-12T20:05:45.853Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mrx3k1 Products: WP-Iconics Problem Types: CWE-79 Description: The WP-Iconics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'wp_iconics' shortcode in all versions up to, and including, 0.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additi
and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/90ec6c64-f2c6-483e-9d8b-25e65ccb4a90?source=cve - https://wordpress.org/plugins/wp-iconics/ - https://plugins.trac.wordpress.org/browser/wp-iconics/tags/0.0.4/wp-iconics.php#L47