Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-54670 State: PUBLISHED Published: 2025-08-20T08:02:53.018Z Last Updated: 2025-08-20T15:14:48.216Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: bobbingwide Products: oik Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bobbingwide oik allows Reflected XSS. This issue affects oik: from n/a through 4.15.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/oik/vulnerability/wordpress-oik-plugin-4-15-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54671 State: PUBLISHED Published: 2025-08-14T10:34:39.773Z Last Updated: 2025-08-14T14:42:01.681Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: bobbingwide Products: oik Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in bobbingwide oik allows Cross Site Request Forgery. This issue affects oik: from n/a through 4.15.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/oik/vulnerability/wordpress-oik-plugin-plugin-4-15-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-54672 State: PUBLISHED Published: 2025-08-14T10:34:40.287Z Last Updated: 2025-08-14T15:02:03.905Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Jordy Meow Products: Photo Engine Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Jordy Meow Photo Engine allows Cross Site Request Forgery. This issue affects Photo Engine: from n/a through 6.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wplr-sync/vulnerability/wordpress-photo-engine-plugin-plugin-6-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-54673 State: PUBLISHED Published: 2025-08-14T10:34:40.829Z Last Updated: 2025-08-14T14:58:40.310Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Ays Pro Products: Chartify Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Chartify allows Cross Site Request Forgery. This issue affects Chartify: from n/a through 3.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/chart-builder/vulnerability/wordpress-chartify-plugin-plugin-3-5-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-54674 State: PUBLISHED Published: 2025-08-14T10:34:41.383Z Last Updated: 2025-08-14T14:41:55.689Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: mklacroix Products: Product Configurator for WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in mklacroix Product Configurator for WooCommerce allows Cross Site Request Forgery. This issue affects Product Configurator for WooCommerce: from n/a through 1.4.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/product-configurator-for-woocommerce/vulnerability/wordpress-product-configurator-
chstack.com/database/wordpress/plugin/product-configurator-for-woocommerce/vulnerability/wordpress-product-configurator-for-woocommerce-plugin-plugin-1-4-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-54675 State: PUBLISHED Published: 2025-08-14T10:34:41.898Z Last Updated: 2025-08-14T14:41:50.413Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: YITHEMES Products: YITH WooCommerce Popup Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH WooCommerce Popup allows Cross Site Request Forgery. This issue affects YITH WooCommerce Popup: from n/a through 1.48.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/yith-woocommerce-popup/vulnerability/wordpress-yith-woocommerce-popup-plugin-plugin-1-48-0-cross-site-request-forgery-csrf-vu
woocommerce-popup/vulnerability/wordpress-yith-woocommerce-popup-plugin-plugin-1-48-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-54676 State: PUBLISHED Published: 2025-08-14T10:34:42.416Z Last Updated: 2025-08-14T14:41:45.312Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: vcita Products: Online Booking & Scheduling Calendar for WordPress by vcita Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita allows Stored XSS. This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through 4.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/word
n/a through 4.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/meeting-scheduler-by-vcita/vulnerability/wordpress-online-booking-scheduling-calendar-for-by-vcita-plugin-plugin-4-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54677 State: PUBLISHED Published: 2025-08-20T08:02:52.476Z Last Updated: 2025-08-20T15:14:54.824Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: vcita Products: Online Booking & Scheduling Calendar for WordPress by vcita Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita allows Using Malicious Files. This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through 4.5.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/meeting-sc
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/meeting-scheduler-by-vcita/vulnerability/wordpress-online-booking-scheduling-calendar-for-wordpress-by-vcita-plugin-4-5-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-54678 State: PUBLISHED Published: 2025-08-14T10:34:42.955Z Last Updated: 2025-08-14T14:41:39.622Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: hassantafreshi Products: Easy Form Builder Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hassantafreshi Easy Form Builder allows Blind SQL Injection. This issue affects Easy Form Builder: from n/a through 3.8.15. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/easy-form-builder/vulnerability/wordpress-easy-form-builder-plugin-3-8-15-sql-injec
hstack.com/database/wordpress/plugin/easy-form-builder/vulnerability/wordpress-easy-form-builder-plugin-3-8-15-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-54679 State: PUBLISHED Published: 2025-08-14T10:34:43.500Z Last Updated: 2025-08-14T14:41:34.188Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: vertim Products: Neon Channel Product Customizer Free Problem Types: CWE-862 Description: Missing Authorization vulnerability in vertim Neon Channel Product Customizer Free allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Neon Channel Product Customizer Free: from n/a through 2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/neon-channel-product-customizer-free/vulnerability/wordpress-neon-
s: - https://patchstack.com/database/wordpress/plugin/neon-channel-product-customizer-free/vulnerability/wordpress-neon-channel-product-customizer-free-plugin-2-0-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2025-54680 State: PUBLISHED Published: 2025-08-14T10:34:44.021Z Last Updated: 2025-08-14T14:41:28.275Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Sparkle Themes Products: Blogger Buzz Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sparkle Themes Blogger Buzz allows Stored XSS. This issue affects Blogger Buzz: from n/a through 1.2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/blogger-buzz/vulnerability/wordpress-blogger-buzz-theme-theme-1-2-6-cross-site-scripting-xss-vulnerability?_s_i
ss/theme/blogger-buzz/vulnerability/wordpress-blogger-buzz-theme-theme-1-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54681 State: PUBLISHED Published: 2025-08-14T10:34:44.536Z Last Updated: 2025-08-14T14:41:23.035Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: CRM Perks Products: Connector for Gravity Forms and Google Sheets Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets allows Phishing. This issue affects Connector for Gravity Forms and Google Sheets: from n/a through 1.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-gravity-forms-spreadsheets/vulnerability/wordpress-c
: References: - https://patchstack.com/database/wordpress/plugin/wp-gravity-forms-spreadsheets/vulnerability/wordpress-connector-for-gravity-forms-and-google-sheets-plugin-plugin-1-2-4-open-redirection-vulnerability?_s_id=cve
CVE ID: CVE-2025-54682 State: PUBLISHED Published: 2025-08-14T10:34:46.106Z Last Updated: 2025-08-14T14:41:17.935Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: CRM Perks Products: Connector for Gravity Forms and Google Sheets Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets allows Cross Site Request Forgery. This issue affects Connector for Gravity Forms and Google Sheets: from n/a through 1.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-gravity-forms-spreadsheets/vulnerability/wordpress-c
: References: - https://patchstack.com/database/wordpress/plugin/wp-gravity-forms-spreadsheets/vulnerability/wordpress-connector-for-gravity-forms-and-google-sheets-plugin-plugin-1-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-54683 State: PUBLISHED Published: 2025-08-14T10:34:46.673Z Last Updated: 2025-08-14T14:41:12.735Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Astoundify Products: WP Modal Popup with Cookie Integration Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify WP Modal Popup with Cookie Integration allows Reflected XSS. This issue affects WP Modal Popup with Cookie Integration: from n/a through 2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-modal-popup-with-cookie-integration/
ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-modal-popup-with-cookie-integration/vulnerability/wordpress-wp-modal-popup-with-cookie-integration-plugin-plugin-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54684 State: PUBLISHED Published: 2025-08-14T10:34:47.187Z Last Updated: 2025-08-14T14:51:54.335Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: CRM Perks Products: Integration for Contact Form 7 and Constant Contact Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks Integration for Contact Form 7 and Constant Contact allows Stored XSS. This issue affects Integration for Contact Form 7 and Constant Contact: from n/a through 1.1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cf7
7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/cf7-constant-contact/vulnerability/wordpress-integration-for-contact-form-7-and-constant-contact-plugin-plugin-1-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54685 State: PUBLISHED Published: 2025-08-14T10:34:47.697Z Last Updated: 2025-08-14T14:51:10.299Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Brainstorm Force Products: SureDash Problem Types: CWE-201 Description: Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force SureDash allows Retrieve Embedded Sensitive Data. This issue affects SureDash: from n/a through 1.1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/suredash/vulnerability/wordpress-suredash-plugin-1-1-0-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2025-54686 State: PUBLISHED Published: 2025-08-14T10:34:48.233Z Last Updated: 2025-08-14T14:48:20.718Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: scriptsbundle Products: Exertio Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in scriptsbundle Exertio allows Object Injection. This issue affects Exertio: from n/a through 1.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/exertio/vulnerability/wordpress-exertio-theme-1-3-2-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-54687 State: PUBLISHED Published: 2025-08-14T10:34:48.750Z Last Updated: 2025-08-14T18:43:39.802Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Crocoblock Products: JetTabs Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs allows DOM-Based XSS. This issue affects JetTabs: from n/a through 2.2.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-tabs/vulnerability/wordpress-jettabs-plugin-plugin-2-2-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54688 State: PUBLISHED Published: 2025-08-14T10:34:49.257Z Last Updated: 2025-08-14T18:43:18.902Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Crocoblock Products: JetEngine Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.7.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-plugin-3-7-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54689 State: PUBLISHED Published: 2025-08-14T10:34:49.815Z Last Updated: 2025-08-14T18:41:24.022Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: thembay Products: Urna Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Urna allows PHP Local File Inclusion. This issue affects Urna: from n/a through 2.5.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/urna/vulnerability/wordpress-urna-theme-2-5-7-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-54690 State: PUBLISHED Published: 2025-08-14T10:34:50.330Z Last Updated: 2025-08-14T18:12:04.103Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: themeStek Products: Xinterio Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themeStek Xinterio allows PHP Local File Inclusion. This issue affects Xinterio: from n/a through 4.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/theme/xinterio/vulnerability/wordpress-xinterio-theme-4-2-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-54691 State: PUBLISHED Published: 2025-08-14T10:34:50.849Z Last Updated: 2025-08-14T17:59:40.777Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Stylemix Products: Motors Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in Stylemix Motors allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Motors: from n/a through 1.4.80. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/motors-car-dealership-classified-listings/vulnerability/wordpress-motors-plugin-plugin-1-4-80-insecure-direct-object-ref
motors-car-dealership-classified-listings/vulnerability/wordpress-motors-plugin-plugin-1-4-80-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE ID: CVE-2025-54692 State: PUBLISHED Published: 2025-08-14T10:34:51.406Z Last Updated: 2025-08-14T17:53:25.997Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: WP Swings Products: Membership For WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in WP Swings Membership For WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Membership For WooCommerce: from n/a through 2.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/membership-for-woocommerce/vulnerability/wordpress-membership-for-woocommerce-plugin-2-9-0-broke
tabase/wordpress/plugin/membership-for-woocommerce/vulnerability/wordpress-membership-for-woocommerce-plugin-2-9-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-54693 State: PUBLISHED Published: 2025-08-14T10:34:51.992Z Last Updated: 2025-08-14T17:31:57.624Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: epiphyt Products: Form Block Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in epiphyt Form Block allows Upload a Web Shell to a Web Server. This issue affects Form Block: from n/a through 1.5.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/form-block/vulnerability/wordpress-form-block-plugin-1-5-5-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2025-54694 State: PUBLISHED Published: 2025-08-14T10:34:52.521Z Last Updated: 2025-08-14T14:41:07.525Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: bPlugins Products: Button Block Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in bPlugins Button Block allows Cross Site Request Forgery. This issue affects Button Block: from n/a through 1.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/button-block/vulnerability/wordpress-button-block-plugin-plugin-1-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-54695 State: PUBLISHED Published: 2025-08-14T10:34:53.074Z Last Updated: 2025-08-14T14:41:00.899Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: HasTech Products: HT Mega Problem Types: CWE-862 Description: Missing Authorization vulnerability in HasTech HT Mega allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HT Mega: from n/a through 2.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/ht-mega-for-elementor/vulnerability/wordpress-ht-mega-plugin-plugin-2-9-0-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-54696 State: PUBLISHED Published: 2025-08-14T10:34:53.631Z Last Updated: 2025-08-14T14:40:55.279Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: WPFunnels Products: WPFunnels Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels allows Stored XSS. This issue affects WPFunnels: from n/a through 3.5.26. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wpfunnels/vulnerability/wordpress-wpfunnels-plugin-plugin-3-5-26-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-54697 State: PUBLISHED Published: 2025-08-14T10:34:54.167Z Last Updated: 2025-08-14T14:40:50.243Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ben Ritner - Kadence WP Products: Kadence WooCommerce Email Designer Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in Ben Ritner - Kadence WP Kadence WooCommerce Email Designer allows Privilege Escalation. This issue affects Kadence WooCommerce Email Designer: from n/a through 1.5.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/kadence-woocommerce-email-designer/vulnerability/wordpress-kadence-woo
https://patchstack.com/database/wordpress/plugin/kadence-woocommerce-email-designer/vulnerability/wordpress-kadence-woocommerce-email-designer-plugin-1-5-16-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2025-54698 State: PUBLISHED Published: 2025-08-14T10:34:54.692Z Last Updated: 2025-08-14T13:26:09.654Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L) Vendors: RadiusTheme Products: Classified Listing Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in RadiusTheme Classified Listing allows Code Injection. This issue affects Classified Listing: from n/a through 5.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/classified-listing/vulnerability/wordpress-classified-listing-plugin-plugin-5-0-0-content-injection-v
e/wordpress/plugin/classified-listing/vulnerability/wordpress-classified-listing-plugin-plugin-5-0-0-content-injection-vulnerability?_s_id=cve
CVE ID: CVE-2025-54699 State: PUBLISHED Published: 2025-08-14T10:34:55.202Z Last Updated: 2025-08-14T13:19:32.606Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: masteriyo Products: Masteriyo - LMS Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in masteriyo Masteriyo - LMS allows Stored XSS. This issue affects Masteriyo - LMS: from n/a through 1.18.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-plugin-1-18-3-cross-site-scripting-xss
ss/plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-plugin-1-18-3-cross-site-scripting-xss-vulnerability?_s_id=cve