Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-3769 State: PUBLISHED Published: 2025-05-14T11:12:25.594Z Last Updated: 2025-05-14T13:28:22.074Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: latepoint Products: LatePoint – Calendar Booking Plugin for Appointments and Events Problem Types: CWE-639 Description: The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.92 via the 'view_booking_summary_in_lightbox' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to retrieve appointment details such as customer nam
ontrolled key. This makes it possible for unauthenticated attackers to retrieve appointment details such as customer names and email addresses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7e9acd26-c341-4ece-bcf1-102f953a4b4f?source=cve - https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/customer_cabinet_controller.php - https://plugins.trac.wordpress.org/changeset/3291162/
CVE ID: CVE-2025-3770 State: PUBLISHED Published: 2025-08-07T00:42:14.628Z Last Updated: 2025-08-07T13:28:12.175Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: TianoCore Products: EDK2 Problem Types: CWE-693 Description: EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/tianocore/edk2/security/advisories/GHSA-vx5v-4gg6-6qxr
CVE ID: CVE-2025-3771 State: PUBLISHED Published: 2025-06-26T11:05:18.669Z Last Updated: 2025-06-26T12:59:27.081Z Vendors: Trellix Products: System Information Reporter Problem Types: CWE-59 Description: A path or symbolic link manipulation vulnerability in SIR 1.0.3 and prior versions allows an authenticated non-admin local user to overwrite system files with SIR backup files, which can potentially cause a system crash. This was achieved by adding a malicious entry to the registry under the Trellix SIR registry folder or via policy or with a junction symbolic link to files that the user would not normally have permission to acces Additional Analyst Notes: - CISA ADP Vulnrichment: References
that the user would not normally have permission to acces Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://thrive.trellix.com/s/article/000014635
CVE ID: CVE-2025-3773 State: PUBLISHED Published: 2025-06-26T11:11:26.881Z Last Updated: 2025-06-26T12:58:54.131Z Vendors: Trellix Products: System Information Reporter Problem Types: CWE-530 Description: A sensitive information exposure vulnerability in System Information Reporter (SIR) 1.0.3 and prior allows an authenticated non-admin local user to extract sensitive information stored in a registry backup folder. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://thrive.trellix.com/s/article/000014635
CVE ID: CVE-2025-3774 State: PUBLISHED Published: 2025-06-17T01:44:10.303Z Last Updated: 2025-06-17T14:17:51.792Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: marcinlawrowski Products: Wise Chat Problem Types: CWE-79 Description: The Wise Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
ill execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/34fd5045-cd38-4eab-9e97-98f1e3d7423a?source=cve - https://plugins.trac.wordpress.org/browser/wise-chat/tags/3.3.3/src/admin/WiseChatKicksTab.php#L11
CVE ID: CVE-2025-3775 State: PUBLISHED Published: 2025-04-25T04:23:04.940Z Last Updated: 2025-04-25T15:10:35.126Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: devitemsllc Products: ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) Problem Types: CWE-918 Description: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.2 via the woolentor_template_proxy function. This makes it possible for unauthenticated attackers to make
ncluding, 3.1.2 via the woolentor_template_proxy function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application, and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4dfc28ec-1411-43c3-833e-a6c85a3ed767?source=cve - https://plugins.trac.wordpress.org/browser/woolentor-addons/tags/3.1.2/includes/admin-panel/includes/classes/Admin.php#L71
CVE ID: CVE-2025-3776 State: PUBLISHED Published: 2025-04-24T08:23:52.626Z Last Updated: 2025-04-24T13:06:21.124Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: cajka Products: Verification SMS with TargetSMS Problem Types: CWE-94 Description: The Verification SMS with TargetSMS plugin for WordPress is vulnerable to limited Remote Code Execution in all versions up to, and including, 1.5 via the 'targetvr_ajax_handler' function. This is due to a lack of validation on the type of function that can be called. This makes it possible for unauthenticated attackers to execute any callable function on the site, such as phpinfo(). Additional Analyst Notes: - CISA ADP
ticated attackers to execute any callable function on the site, such as phpinfo(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ed08d248-7467-4a3b-91a2-4286d91b9c50?source=cve - https://plugins.trac.wordpress.org/browser/verification-sms-targetsms/trunk/inc/ajax.php#L7 - https://plugins.trac.wordpress.org/browser/verification-sms-targetsms/trunk/inc/ajax.php#L9
CVE ID: CVE-2025-3777 State: PUBLISHED Published: 2025-07-07T09:55:38.190Z Last Updated: 2025-07-07T12:26:15.099Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: huggingface Products: huggingface/transformers Problem Types: CWE-20 Description: Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malwa
aft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/ccba0730-9248-4853-b7ff-5c20e6364f09 - https://github.com/huggingface/transformers/commit/4dda5f71b35fb70cf602187eef84bb17a50b9082
CVE ID: CVE-2025-3779 State: PUBLISHED Published: 2025-05-03T01:43:07.687Z Last Updated: 2025-05-05T14:57:49.982Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: personizely Products: A/B Testing, Popups, Website Personalization, Email Popup, Exit Intent Pop Up, Upsell Pop Up – Personizely Problem Types: CWE-79 Description: The Personizely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘widgetId’ parameter in all versions up to, and including, 0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts i
akes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f07d22ef-5afd-48a4-9e67-31a3ab3efdd6?source=cve - https://plugins.trac.wordpress.org/browser/personizely/tags/0.10/class.personizely.php#L49 - https://wordpress.org/plugins/personizely/#developers
CVE ID: CVE-2025-3780 State: PUBLISHED Published: 2025-07-08T23:22:48.619Z Last Updated: 2025-07-09T13:15:34.030Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: wclovers Products: WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible Problem Types: CWE-862 Description: The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcfm_redirect_to_setup function in all versions up to, and including, 6.7.16. This makes it possible for unauthenticated attackers to view and mod
ction in all versions up to, and including, 6.7.16. This makes it possible for unauthenticated attackers to view and modify the plugin settings, including payment details and API keys Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/26a82493-a6a5-4d8e-8322-942925a54cc3?source=cve - https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.16/core/class-wcfm-admin.php#L74 - https://plugins.trac.wordpress.org/browser/wc-frontend-manager/tags/6.7.16/core/class-wcfm-admin.php#L81
CVE ID: CVE-2025-3781 State: PUBLISHED Published: 2025-05-21T09:21:49.308Z Last Updated: 2025-05-21T10:16:49.932Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: creativefreedomau Products: Raisely Donation Form Problem Types: CWE-79 Description: The Raisely Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's raisely_donation_form shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will exec
uthenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0716485b-e94b-4e09-9c01-1059017bfcc8?source=cve - https://plugins.trac.wordpress.org/browser/raisely-donation-form/trunk/inc/base/providers/shortcodes.php#L46 - https://wordpress.org/plugins/raisely-donation-form/#developers
CVE ID: CVE-2025-3782 State: PUBLISHED Published: 2025-05-06T09:21:49.867Z Last Updated: 2025-05-06T14:18:53.580Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: cyclonecode Products: Cision Block Problem Types: CWE-79 Description: The Cision Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - C
rbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c5b8268a-f3a3-4576-b235-962de37cc388?source=cve - https://plugins.trac.wordpress.org/browser/cision-block/tags/4.3.0/src/Frontend/templates/cision-block.php#L51 - https://wordpress.org/plugins/cision-block/#developers - https://plugins.trac.wordpress.org/changeset/3288041/
CVE ID: CVE-2025-3783 State: PUBLISHED Published: 2025-04-18T05:31:05.055Z Last Updated: 2025-04-18T12:00:44.977Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Web-based Pharmacy Product Management System Problem Types: CWE-434, CWE-284 Description: A vulnerability classified as critical was found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /add-product.php. The manipulation of the argument Avatar leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA AD
be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305605 - https://vuldb.com/?ctiid.305605 - https://vuldb.com/?submit.553723 - https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/upload_in_add-product.md - https://www.sourcecodester.com/
CVE ID: CVE-2025-3785 State: PUBLISHED Published: 2025-04-18T08:31:05.721Z Last Updated: 2025-04-18T12:00:14.339Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: D-Link Products: DWR-M961 Problem Types: CWE-121, CWE-119 Description: A vulnerability has been found in D-Link DWR-M961 1.1.36 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formStaticDHCP of the component Authorization Interface. The manipulation of the argument Hostname leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.49 is able to address this issue. It is recommend
been disclosed to the public and may be used. Upgrading to version 1.1.49 is able to address this issue. It is recommended to upgrade the affected component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305608 - https://vuldb.com/?ctiid.305608 - https://vuldb.com/?submit.553547 - https://github.com/ZOKEYE/CVE/blob/main/D-link.md - https://www.dlink.com/
CVE ID: CVE-2025-3786 State: PUBLISHED Published: 2025-04-18T09:00:23.217Z Last Updated: 2025-04-18T11:59:56.744Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Tenda Products: AC15 Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in Tenda AC15 up to 15.03.05.19 and classified as critical. This issue affects the function fromSetWirelessRepeat of the file /goform/WifiExtraSet. The manipulation of the argument mac leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305609 - https://vuldb.com/?ctiid.305
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305609 - https://vuldb.com/?ctiid.305609 - https://vuldb.com/?submit.553703 - https://github.com/CH13hh/cve/tree/AC15WifiExtraSet - https://www.tenda.com.cn/
CVE ID: CVE-2025-3787 State: PUBLISHED Published: 2025-04-18T09:31:04.227Z Last Updated: 2025-04-18T11:59:41.889Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: PbootCMS Problem Types: CWE-918 Description: A vulnerability was found in PbootCMS 3.2.5. It has been classified as problematic. Affected is an unknown function of the component Image Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305610 - https://vuldb.com/?ctiid.305610 - https://vuldb.com/?submit
P Vulnrichment: References: - https://vuldb.com/?id.305610 - https://vuldb.com/?ctiid.305610 - https://vuldb.com/?submit.553731 - https://github.com/KKDT12138/CVE/blob/main/cve6.pdf
CVE ID: CVE-2025-3788 State: PUBLISHED Published: 2025-04-18T10:00:12.652Z Last Updated: 2025-04-18T11:59:34.275Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: baseweb Products: JSite Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in baseweb JSite 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /a/sys/user/save. The manipulation of the argument Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305611 - https://vuldb.com/?cti
. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305611 - https://vuldb.com/?ctiid.305611 - https://vuldb.com/?submit.554565 - https://github.com/caigo8/CVE-md/blob/main/JSite/XSS1.md
CVE ID: CVE-2025-3789 State: PUBLISHED Published: 2025-04-18T12:31:04.563Z Last Updated: 2025-04-18T13:06:07.866Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: baseweb Products: JSite Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in baseweb JSite 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /a/sys/area/save. The manipulation of the argument Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305612 - https://vuldb.com/?ctiid.305612
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305612 - https://vuldb.com/?ctiid.305612 - https://vuldb.com/?submit.554566 - https://github.com/caigo8/CVE-md/blob/main/JSite/XSS3.md
CVE ID: CVE-2025-3790 State: PUBLISHED Published: 2025-04-18T13:00:09.132Z Last Updated: 2025-04-18T13:16:23.473Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: baseweb Products: JSite Problem Types: CWE-284, CWE-266 Description: A vulnerability classified as critical has been found in baseweb JSite 1.0. This affects an unknown part of the file /druid/index.html of the component Apache Druid Monitoring Console. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.3
to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305613 - https://vuldb.com/?ctiid.305613 - https://vuldb.com/?submit.554572 - https://github.com/caigo8/CVE-md/blob/main/JSite/durid%E6%9C%AA%E6%8E%88%E6%9D%83.md
CVE ID: CVE-2025-3791 State: PUBLISHED Published: 2025-04-18T14:31:04.680Z Last Updated: 2025-04-18T14:43:56.559Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: symisc Products: UnQLite Problem Types: CWE-122, CWE-119 Description: A vulnerability classified as critical was found in symisc UnQLite up to 957c377cb691a4f617db9aba5cc46d90425071e2. This vulnerability affects the function jx9MemObjStore of the file /data/src/benchmarks/unqlite/unqlite.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases
the local host. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305614 - https://vuldb.com/?ctiid.305614 - https://vuldb.com/?submit.554574 - https://github.com/symisc/unqlite/issues/173 - https://github.com/user-attachments/files/19652580/unqlite-reproduce-heap-overflow.zip
CVE ID: CVE-2025-3792 State: PUBLISHED Published: 2025-04-18T15:00:05.436Z Last Updated: 2025-04-18T15:29:02.407Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: SeaCMS Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in SeaCMS up to 13.3. This issue affects some unknown processing of the file /admin_link.php?action=delall. The manipulation of the argument e_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305615 - https://vuldb.com/?ctiid.3056
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.305615 - https://vuldb.com/?ctiid.305615 - https://vuldb.com/?submit.554592 - https://github.com/FSRM1/CVE/blob/main/seacms_sql%E6%B3%A8%E5%85%A5.md
CVE ID: CVE-2025-3793 State: PUBLISHED Published: 2025-04-24T08:23:52.234Z Last Updated: 2025-04-24T13:06:26.570Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: lamarant Products: Buddypress Force Password Change Problem Types: CWE-620 Description: The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plugin not properly validating a user's identity prior to updating their password through the 'bp_force_password_ajax' function in all versions up to, and including, 0.1. This makes it possible for authenticated attackers, with subscriber-level access and above and under certain prerequisites, to c
es it possible for authenticated attackers, with subscriber-level access and above and under certain prerequisites, to change arbitrary user's passwords, including administrators, and leverage that to gain access to their accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e3048c4c-77b1-4778-a5d0-b532df777d06?source=cve - https://plugins.trac.wordpress.org/browser/buddy-press-force-password-change/trunk/bp-force-password-change.php#L93
CVE ID: CVE-2025-3794 State: PUBLISHED Published: 2025-05-09T22:22:12.702Z Last Updated: 2025-05-10T01:36:07.885Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: smub Products: WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More Problem Types: CWE-79 Description: The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the start_timestamp parameter in all versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contribut
insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/179eb680-e8d8-4918-96e3-e67217771c29?source=cve - https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.9.4.2/assets/js/frontend/wpforms.js#L3154