Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-39387 State: PUBLISHED Published: 2025-04-24T16:08:35.023Z Last Updated: 2025-04-25T13:56:29.228Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: WPoperation Products: Opstore Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WPoperation Opstore allows PHP Local File Inclusion. This issue affects Opstore: from n/a through 1.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/opstore/vulnerability/wordpress-opstore-theme-1-4-5-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39388 State: PUBLISHED Published: 2025-05-19T16:47:44.841Z Last Updated: 2025-05-20T14:09:10.939Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Solid Plugins Products: AnalyticsWP Problem Types: CWE-862 Description: Missing Authorization vulnerability in Solid Plugins AnalyticsWP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AnalyticsWP: from n/a through 2.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/analyticswp/vulnerability/wordpress-analyticswp-plugin-2-0-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-39389 State: PUBLISHED Published: 2025-05-19T19:31:20.579Z Last Updated: 2025-05-19T21:21:00.772Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: Solid Plugins Products: AnalyticsWP Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solid Plugins AnalyticsWP allows SQL Injection.This issue affects AnalyticsWP: from n/a through 2.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/analyticswp/vulnerability/wordpress-analyticswp-2-1-2-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39390 State: PUBLISHED Published: 2025-04-24T16:08:34.464Z Last Updated: 2025-04-25T13:56:38.009Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: magepeopleteam Products: Booking and Rental Manager Problem Types: CWE-862 Description: Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Booking and Rental Manager: from n/a through 2.3.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/booking-and-rental-manager-for-woocommerce/vulnerability/wordpress-booking-and-renta
stack.com/database/wordpress/plugin/booking-and-rental-manager-for-woocommerce/vulnerability/wordpress-booking-and-rental-manager-plugin-2-3-6-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-39391 State: PUBLISHED Published: 2025-04-24T16:08:33.921Z Last Updated: 2025-04-25T13:56:45.562Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: zamartz Products: Checkout Field Visibility for WooCommerce Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zamartz Checkout Field Visibility for WooCommerce allows PHP Local File Inclusion. This issue affects Checkout Field Visibility for WooCommerce: from n/a through 1.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/checko
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/checkout-field-visibility-for-woocommerce/vulnerability/wordpress-checkout-field-visibility-for-woocommerce-plugin-1-2-3-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39392 State: PUBLISHED Published: 2025-05-19T19:29:45.931Z Last Updated: 2025-05-19T21:21:09.990Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: mojoomla Products: WPAMS Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla WPAMS allows Reflected XSS.This issue affects WPAMS: from n/a through 44.0 (17-08-2023). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/apartment-management/vulnerability/wordpress-wpams-plugin-44-0-17-08-2023-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39393 State: PUBLISHED Published: 2025-05-19T19:28:39.998Z Last Updated: 2025-05-19T21:21:16.748Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: mojoomla Products: Hospital Management System Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla Hospital Management System allows Reflected XSS.This issue affects Hospital Management System: from n/a through 47.0 (20-11-2023). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/hospital-management/vulnerability/wordpress-hospital-management-syst
- https://patchstack.com/database/wordpress/plugin/hospital-management/vulnerability/wordpress-hospital-management-system-plugin-47-0-20-11-2023-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39394 State: PUBLISHED Published: 2025-05-19T16:51:13.144Z Last Updated: 2025-05-20T14:06:30.254Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Solid Plugins Products: AnalyticsWP Problem Types: CWE-497 Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Solid Plugins AnalyticsWP allows Retrieve Embedded Sensitive Data.This issue affects AnalyticsWP: from n/a through 2.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/analyticswp/vulnerability/wordpress-analyticswp-plugin-2-1-2-sensitive-data-exposure-vulnerability?_s_i
wordpress/plugin/analyticswp/vulnerability/wordpress-analyticswp-plugin-2-1-2-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-39395 State: PUBLISHED Published: 2025-05-19T19:27:13.848Z Last Updated: 2025-05-19T21:21:22.448Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: mojoomla Products: WPAMS Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPAMS allows SQL Injection.This issue affects WPAMS: from n/a through 44.0 (17-08-2023). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/apartment-management/vulnerability/wordpress-wpams-plugin-44-0-17-08-2023-sql-injection-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-39396 State: PUBLISHED Published: 2025-05-19T17:15:08.161Z Last Updated: 2025-05-19T21:23:11.066Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Crocoblock Products: JetReviews Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetReviews allows PHP Local File Inclusion.This issue affects JetReviews: from n/a through 2.3.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-reviews/vulnerability/wordpress-jetreviews-plugin-2-3-6-local-file-inclusion-vulnerability
database/wordpress/plugin/jet-reviews/vulnerability/wordpress-jetreviews-plugin-2-3-6-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39397 State: PUBLISHED Published: 2025-04-24T16:08:33.176Z Last Updated: 2025-04-25T13:56:53.486Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: gopiplus@hotmail.com Products: Anything Popup Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus@hotmail.com Anything Popup allows Reflected XSS. This issue affects Anything Popup: from n/a through 7.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/anything-popup/vulnerability/wordpress-anything-popup-plugin-7-3-reflected-cross-site-scripti
/database/wordpress/plugin/anything-popup/vulnerability/wordpress-anything-popup-plugin-7-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39398 State: PUBLISHED Published: 2025-05-19T17:22:42.989Z Last Updated: 2025-05-19T21:23:05.624Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Themovation Products: Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue Problem Types: CWE-862 Description: Missing Authorization vulnerability in Themovation Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue.This issue affects Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue: from n/a through 4.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/bellevuex/vulnerability/wordpress-hotel-bed-and-breakfast
References: - https://patchstack.com/database/wordpress/theme/bellevuex/vulnerability/wordpress-hotel-bed-and-breakfast-booking-calendar-theme-bellevue-theme-4-2-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-39399 State: PUBLISHED Published: 2025-04-24T16:08:32.610Z Last Updated: 2025-04-25T13:57:00.973Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Ashraful Sarkar Naiem Products: License For Envato Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ashraful Sarkar Naiem License For Envato allows PHP Local File Inclusion. This issue affects License For Envato: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/license-envato/vulnerability/wordpress-license-
richment: References: - https://patchstack.com/database/wordpress/plugin/license-envato/vulnerability/wordpress-license-for-envato-plugin-1-0-0-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39400 State: PUBLISHED Published: 2025-04-24T16:08:32.039Z Last Updated: 2025-04-25T13:57:08.406Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: wpeverest Products: User Registration Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration allows Reflected XSS. This issue affects User Registration: from n/a through n/a. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/user-registration/vulnerability/wordpress-user-registration-plugin-4-2-0-reflected-cross-site-scripting-xs
dpress/plugin/user-registration/vulnerability/wordpress-user-registration-plugin-4-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39401 State: PUBLISHED Published: 2025-05-19T19:26:17.917Z Last Updated: 2025-05-19T21:21:27.784Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: mojoomla Products: WPAMS Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS allows Upload a Web Shell to a Web Server.This issue affects WPAMS: from n/a through 44.0 (17-08-2023). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/apartment-management/vulnerability/wordpress-wpams-plugin-44-0-17-08-2023-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-39402 State: PUBLISHED Published: 2025-05-19T19:24:47.800Z Last Updated: 2025-05-19T21:21:33.088Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: mojoomla Products: WPAMS Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS allows Upload a Web Shell to a Web Server.This issue affects WPAMS: from n/a through 44.0 (17-08-2023). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/apartment-management/vulnerability/wordpress-wpams-plugin-44-0-17-08-2023-arbitrary-file-upload-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-39403 State: PUBLISHED Published: 2025-05-19T19:10:31.919Z Last Updated: 2025-05-19T21:21:38.469Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: mojoomla Products: WPAMS Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPAMS allows SQL Injection.This issue affects WPAMS: from n/a through 44.0 (17-08-2023). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/apartment-management/vulnerability/wordpress-wpams-plugin-44-0-17-08-2023-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39404 State: PUBLISHED Published: 2025-04-24T16:08:31.465Z Last Updated: 2025-04-25T13:57:15.670Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: Heateor Support Products: Sassy Social Share Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Heateor Support Sassy Social Share allows Phishing. This issue affects Sassy Social Share: from n/a through 3.3.73. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/sassy-social-share/vulnerability/wordpress-sassy-social-share-plugin-3-3-73-open-redirection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39405 State: PUBLISHED Published: 2025-05-19T19:09:20.995Z Last Updated: 2025-05-19T21:21:43.911Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: mojoomla Products: WPAMS Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in mojoomla WPAMS allows Privilege Escalation.This issue affects WPAMS: from n/a through 44.0 (17-08-2023). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/apartment-management/vulnerability/wordpress-wpams-plugin-44-0-17-08-2023-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-39406 State: PUBLISHED Published: 2025-05-19T19:07:25.329Z Last Updated: 2025-05-19T21:21:49.934Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: mojoomla Products: WPAMS Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla WPAMS allows PHP Local File Inclusion.This issue affects WPAMS: from n/a through 44.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/apartment-management/vulnerability/wordpress-wpams-plugin-44-0-local-file-inclusion-to-privilege-escalation-vu
ss/plugin/apartment-management/vulnerability/wordpress-wpams-plugin-44-0-local-file-inclusion-to-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-39407 State: PUBLISHED Published: 2025-05-19T19:06:22.751Z Last Updated: 2025-05-29T17:24:27.206Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Caseproof, LLC Products: Memberpress Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Caseproof, LLC Memberpress allows Reflected XSS.This issue affects Memberpress: from n/a before 1.12.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/memberpress/vulnerability/wordpress-memberpress-plugin-1-11-37-reflected-cross-site-scripting-xss-vulnerability?_
plugin/memberpress/vulnerability/wordpress-memberpress-plugin-1-11-37-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39408 State: PUBLISHED Published: 2025-04-24T16:08:30.866Z Last Updated: 2025-04-25T13:57:24.112Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: EverPress Products: BruteGuard – Brute Force Login Protection Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress BruteGuard – Brute Force Login Protection allows Reflected XSS. This issue affects BruteGuard – Brute Force Login Protection: from n/a through 0.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bruteguard/vulnerability/wordpre
- CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/bruteguard/vulnerability/wordpress-bruteguard-brute-force-login-protection-plugin-0-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39409 State: PUBLISHED Published: 2025-05-19T19:03:42.917Z Last Updated: 2025-05-19T21:22:04.299Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: pressaholic Products: WordPress Video Robot - The Ultimate Video Importer Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pressaholic WordPress Video Robot - The Ultimate Video Importer.This issue affects WordPress Video Robot - The Ultimate Video Importer: from n/a through 1.20.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-video-robot/vuln
alyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-video-robot/vulnerability/wordpress-wordpress-video-robot-the-ultimate-video-importer-plugin-1-20-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39410 State: PUBLISHED Published: 2025-05-19T18:58:46.039Z Last Updated: 2025-05-19T21:22:11.654Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: themegusta Products: Smart Sections Theme Builder - WPBakery Page Builder Addon Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in themegusta Smart Sections Theme Builder - WPBakery Page Builder Addon.This issue affects Smart Sections Theme Builder - WPBakery Page Builder Addon: from n/a through 1.7.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/visucom-smart-sections/vulnerability/wordpress-
richment: References: - https://patchstack.com/database/wordpress/plugin/visucom-smart-sections/vulnerability/wordpress-smart-sections-theme-builder-wpbakery-page-builder-addon-plugin-1-7-8-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-39411 State: PUBLISHED Published: 2025-05-19T18:58:01.600Z Last Updated: 2025-05-19T21:22:17.908Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Indie_Plugins Products: WhatsApp Click to Chat Plugin for WordPress Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Indie_Plugins WhatsApp Click to Chat Plugin for WordPress.This issue affects WhatsApp Click to Chat Plugin for WordPress: from n/a through 2.2.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpt-whatsapp/vulnera
lyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpt-whatsapp/vulnerability/wordpress-whatsapp-click-to-chat-plugin-for-wordpress-plugin-2-2-12-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-39412 State: PUBLISHED Published: 2025-05-19T17:25:26.205Z Last Updated: 2025-05-20T13:12:12.409Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Averta Products: Master Slider Problem Types: CWE-862 Description: Missing Authorization vulnerability in Averta Master Slider.This issue affects Master Slider: from n/a through 3.10.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/master-slider/vulnerability/wordpress-master-slider-plugin-3-10-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-39413 State: PUBLISHED Published: 2025-04-30T17:18:59.319Z Last Updated: 2025-04-30T17:38:04.905Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: David Gwyer Products: Simple Sitemap – Create a Responsive HTML Sitemap Problem Types: CWE-862 Description: Missing Authorization vulnerability in David Gwyer Simple Sitemap – Create a Responsive HTML Sitemap.This issue affects Simple Sitemap – Create a Responsive HTML Sitemap: from n/a through 3.5.14. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/simple-sitemap/vulnerability/wordpress-simple-sitemap-create-a-responsive-html-sitema
tack.com/database/wordpress/plugin/simple-sitemap/vulnerability/wordpress-simple-sitemap-create-a-responsive-html-sitemap-plugin-3-5-14-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-39414 State: PUBLISHED Published: 2025-04-17T15:17:13.931Z Last Updated: 2025-04-17T15:49:46.207Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Mike Products: spam-stopper Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Mike spam-stopper allows Stored XSS. This issue affects spam-stopper: from n/a through 3.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/spam-stopper/vulnerability/wordpress-spam-stopper-plugin-3-1-3-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39415 State: PUBLISHED Published: 2025-04-17T15:17:13.043Z Last Updated: 2025-04-17T18:43:52.425Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Jayesh Parejiya Products: Social Media Links Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Jayesh Parejiya Social Media Links allows Stored XSS. This issue affects Social Media Links: from n/a through 1.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/social-media-links/vulnerability/wordpress-social-media-links-plugin-1-0-3-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39416 State: PUBLISHED Published: 2025-04-17T15:17:12.154Z Last Updated: 2025-04-17T18:44:01.294Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Ichi Products: translit it! Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Ichi translit it! allows Stored XSS. This issue affects translit it!: from n/a through 1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/translit-it/vulnerability/wordpress-translit-it-plugin-1-6-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-39417 State: PUBLISHED Published: 2025-04-17T15:17:11.289Z Last Updated: 2025-04-17T18:44:17.185Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Eslam Mahmoud Products: Redirect wordpress to welcome or landing page Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Eslam Mahmoud Redirect wordpress to welcome or landing page allows Stored XSS. This issue affects Redirect wordpress to welcome or landing page: from n/a through 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/redirect-to-welcome-or-landing-page/vulnerability/wordpress-redirec