deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-30951
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Stored XSS.This issue affects BlockStrap Page Builder - Bootstrap Blocks: from n/a through <= 0.1.36.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/blockstrap-page-builder-blocks/vulnerability/wordpress-blockstrap-page-builder-bootstrap-blocks-0-1-36-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30952
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdive Nexa Blocks nexa-blocks allows Stored XSS.This issue affects Nexa Blocks: from n/a through <= 1.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/nexa-blocks/vulnerability/wordpress-nexa-blocks-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30953
Published: 2025-06-06
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Salesforce gf-salesforce-crmperks allows Phishing.This issue affects WP Gravity Forms Salesforce: from n/a through <= 1.4.7.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/gf-salesforce-crmperks/vulnerability/wordpress-wp-gravity-forms-salesforce-1-4-7-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2025-30954
Published: 2025-06-06
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Phishing.This issue affects WP Gravity Forms Constant Contact Plugin: from n/a through <= 1.1.0.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/gf-constant-contact/vulnerability/wordpress-wp-gravity-forms-constant-contact-plugin-1-1-0-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2025-30956
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Booqable Rental Software Booqable Rental booqable-rental-reservations allows Cross Site Request Forgery.This issue affects Booqable Rental: from n/a through <= 2.4.25.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/booqable-rental-reservations/vulnerability/wordpress-booqable-rental-2-4-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-30957
Published: 2025-06-06
Description: Missing Authorization vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through <= 1.1.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/bp-activity-plus-reloaded/vulnerability/wordpress-activity-plus-reloaded-for-buddypress-1-1-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-30958
Published: 2025-06-06
Description: Missing Authorization vulnerability in onOffice GmbH onOffice for WP-Websites onoffice-for-wp-websites allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects onOffice for WP-Websites: from n/a through <= 6.5.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/onoffice-for-wp-websites/vulnerability/wordpress-onoffice-for-wp-websites-5-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-30968
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in jokerbr313 Advanced Post List advanced-post-list allows Cross Site Request Forgery.This issue affects Advanced Post List: from n/a through <= 0.5.6.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/advanced-post-list/vulnerability/wordpress-advanced-post-list-0-5-6-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-30974
Published: 2025-06-06
Description: Missing Authorization vulnerability in Akhtarujjaman Shuvo Post Grid Master ajax-filter-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid Master: from n/a through <= 3.4.17.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/ajax-filter-posts/vulnerability/wordpress-post-grid-master-3-4-13-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-30976
Published: 2025-06-06
Description: Server-Side Request Forgery (SSRF) vulnerability in wpdive Nexa Blocks nexa-blocks allows Server Side Request Forgery.This issue affects Nexa Blocks: from n/a through <= 1.1.1.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/nexa-blocks/vulnerability/wordpress-nexa-blocks-1-1-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-30977
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chaport Live Chat Chaport chaport allows Stored XSS.This issue affects Chaport: from n/a through <= 1.1.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/chaport/vulnerability/wordpress-wp-live-chat-chatbots-plugin-for-wordpress-chaport-1-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30978
Published: 2025-06-06
Description: Missing Authorization vulnerability in Dor Zuberi Slack Notifications by dorzki dorzki-notifications-to-slack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slack Notifications by dorzki: from n/a through <= 2.0.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/dorzki-notifications-to-slack/vulnerability/wordpress-slack-notifications-by-dorzki-2-0-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-30980
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Alessandro Piconi Simple Keyword to Link simple-keyword-to-link allows Cross Site Request Forgery.This issue affects Simple Keyword to Link: from n/a through <= 1.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/simple-keyword-to-link/vulnerability/wordpress-simple-keyword-to-link-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-30981
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in tggfref WP-Recall allows Privilege Escalation. This issue affects WP-Recall: from n/a through 16.26.14.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/wordpress/plugin/wp-recall/vulnerability/wordpress-wp-recall-plugin-16-26-14-csrf-to-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-30986
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in _CreativeMedia_ Elite Video Player elite-video-player allows Cross Site Request Forgery.This issue affects Elite Video Player: from n/a through <= 10.0.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/elite-video-player/vulnerability/wordpress-elite-video-player-10-0-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-30989
Published: 2025-06-06
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Renzo Tejada Libro de Reclamaciones y Quejas libro-de-reclamaciones-y-quejas allows SQL Injection.This issue affects Libro de Reclamaciones y Quejas: from n/a through <= 0.9.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/libro-de-reclamaciones-y-quejas/vulnerability/wordpress-libro-de-reclamaciones-y-quejas-0-9-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30990
Published: 2025-06-06
Description: Missing Authorization vulnerability in ThemeHunk ThemeHunk themehunk-megamenu-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeHunk: from n/a through <= 1.2.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/themehunk-megamenu-plus/vulnerability/wordpress-themehunk-1-1-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-30991
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages allows Stored XSS.This issue affects WPDM – Premium Packages: from n/a through <= 6.0.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpdm-premium-packages/vulnerability/wordpress-premium-packages-6-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30994
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Cross Site Request Forgery.This issue affects CubeWP: from n/a through <= 1.1.29.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/cubewp-framework/vulnerability/wordpress-cubewp-all-in-one-dynamic-content-framework-plugin-1-1-23-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-30995
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light allows Stored XSS.This issue affects Widgetize Pages Light: from n/a through <= 3.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/widgetize-pages-light/vulnerability/wordpress-widgetize-pages-light-plugin-3-0-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30997
Published: 2025-06-06
Description: Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Car Repair Services car-repair-services allows Server Side Request Forgery.This issue affects Car Repair Services: from n/a through <= 5.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Theme/car-repair-services/vulnerability/wordpress-car-repair-services-5-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-30999
Published: 2025-06-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fahad Mahmood External Store for Shopify wp-shopify allows PHP Local File Inclusion.This issue affects External Store for Shopify: from n/a through <= 1.5.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/wp-shopify/vulnerability/wordpress-wp-shopify-1-5-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-31000
Published: 2025-06-06
Description: Missing Authorization vulnerability in Miguel Fuentes Payment QR WooCommerce payment-qr-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment QR WooCommerce: from n/a through <= 1.1.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/payment-qr-woo/vulnerability/wordpress-payment-qr-woocommerce-1-1-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31025
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blocksera Image Hover Effects Block image-hover-effects-block allows Stored XSS.This issue affects Image Hover Effects Block: from n/a through <= 1.4.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/image-hover-effects-block/vulnerability/wordpress-image-hover-effects-block-1-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-38000
Published: 2025-06-06
Description: In the Linux kernel, the following vulnerability has been resolved:

sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()

When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the
child qdisc's peek() operation before incrementing sch->q.qlen and
sch->qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may
trigger an immediate dequeue and potential packet drop. In such cases,
qdisc_tree_reduce_backlog() is called, but the HFSC qdisc's qlen and backlog
have not yet been updated, leading to inconsistent queue accounting. This
can leave an empty HFSC class in the active list, causing further
consequences like use-after-free.

This patch fixes the bug by moving the increment of sch->q.qlen and
sch->qstats.backlog before the call to the child qdisc's peek() operation.
This ensures that queue length and backlog are always accurate when packet
drops or dequeues are triggered during the peek.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/1034e3310752e8675e313f7271b[PII_REDACTED]19a; https://git.kernel.org/stable/c/3f3a22eebbc32b4fa8ce9c1d5f9db214b45b9335; https://git.kernel.org/stable/c/3f981138109f63232a5fb7165938d4c945cc1b9d
CVE: CVE-2025-49072
Published: 2025-06-06
Description: Deserialization of Untrusted Data vulnerability in AncoraThemes Mr. Murphy mr-murphy allows Object Injection.This issue affects Mr. Murphy: from n/a through < 1.2.12.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Theme/mr-murphy/vulnerability/wordpress-mr-murphy-1-2-12-1-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49073
Published: 2025-06-06
Description: Deserialization of Untrusted Data vulnerability in axiomthemes Sweet Dessert sweet-dessert allows Object Injection.This issue affects Sweet Dessert: from n/a through < 1.1.13.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Theme/sweet-dessert/vulnerability/wordpress-sweet-dessert-1-1-13-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49235
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rometheme RTMKit rometheme-for-elementor allows Stored XSS.This issue affects RTMKit: from n/a through <= 1.6.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/rometheme-for-elementor/vulnerability/wordpress-rtmkit-addons-for-elementor-plugin-1-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49236
Published: 2025-06-06
Description: Missing Authorization vulnerability in raychat Raychat raychat allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Raychat: from n/a through <= 2.1.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/raychat/vulnerability/wordpress-raychat-2-1-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49237
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in POEditor POEditor poeditor allows Path Traversal.This issue affects POEditor: from n/a through <= 0.9.10.
CVSS Score: 7.4 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/poeditor/vulnerability/wordpress-poeditor-plugin-0-9-10-csrf-to-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-49238
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in everestthemes Everest Backup everest-backup allows Cross Site Request Forgery.This issue affects Everest Backup: from n/a through <= 2.3.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/everest-backup/vulnerability/wordpress-everest-backup-2-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49239
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Cross Site Request Forgery.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.5.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-delivery-notes/vulnerability/wordpress-print-invoice-delivery-notes-for-woocommerce-5-5-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49240
Published: 2025-06-06
Description: Missing Authorization vulnerability in nK DocsPress docspress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DocsPress: from n/a through <= 2.5.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/docspress/vulnerability/wordpress-docspress-2-5-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49241
Published: 2025-06-06
Description: Missing Authorization vulnerability in bobbingwide oik oik allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects oik: from n/a through <= 4.15.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/oik/vulnerability/wordpress-oik-4-15-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49242
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark Bellows Accordion Menu bellows-accordion-menu allows Stored XSS.This issue affects Bellows Accordion Menu: from n/a through <= 1.4.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bellows-accordion-menu/vulnerability/wordpress-bellows-accordion-menu-1-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49243
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark ShiftNav – Responsive Mobile Menu shiftnav-responsive-mobile-menu allows Stored XSS.This issue affects ShiftNav – Responsive Mobile Menu: from n/a through <= 1.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/shiftnav-responsive-mobile-menu/vulnerability/wordpress-shiftnav-responsive-mobile-menu-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49244
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vova Shortcodes Ultimate shortcodes-ultimate allows Stored XSS.This issue affects Shortcodes Ultimate: from n/a through <= 7.3.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/shortcodes-ultimate/vulnerability/wordpress-shortcodes-ultimate-7-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49246
Published: 2025-06-06
Description: Missing Authorization vulnerability in cmoreira Testimonials Showcase testimonials-showcase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonials Showcase: from n/a through <= 1.9.16.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/testimonials-showcase/vulnerability/wordpress-testimonials-showcase-1-9-16-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49248
Published: 2025-06-06
Description: Missing Authorization vulnerability in cmoreira Team Showcase team-showcase-cm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team Showcase: from n/a through < 25.05.13.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/team-showcase-cm/vulnerability/wordpress-team-showcase-25-05-13-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49250
Published: 2025-06-06
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in cmoreira Team Showcase team-showcase-cm allows Code Injection.This issue affects Team Showcase: from n/a through < 25.05.13.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/team-showcase-cm/vulnerability/wordpress-team-showcase-plugin-25-05-13-arbitrary-shortcode-execution-vulnerability?_s_id=cve
CVE: CVE-2025-49262
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shaonsina Sina Extension for Elementor sina-extension-for-elementor allows Stored XSS.This issue affects Sina Extension for Elementor: from n/a through <= 3.6.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sina-extension-for-elementor/vulnerability/wordpress-sina-extension-for-elementor-3-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49263
Published: 2025-06-06
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WCVendors WC Vendors Marketplace wc-vendors allows Blind SQL Injection.This issue affects WC Vendors Marketplace: from n/a through <= 2.5.6.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wc-vendors/vulnerability/wordpress-wc-vendors-marketplace-2-5-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49268
Published: 2025-06-06
Description: Missing Authorization vulnerability in Soft8Soft LLC Verge3D verge3d allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Verge3D: from n/a through <= 4.9.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/verge3d/vulnerability/wordpress-verge3d-4-9-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49269
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Anton Vanyukov Market Exporter market-exporter allows Cross Site Request Forgery.This issue affects Market Exporter: from n/a through <= 2.0.22.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/market-exporter/vulnerability/wordpress-market-exporter-2-0-22-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49270
Published: 2025-06-06
Description: Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP-CRM System: from n/a through <= 3.4.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-crm-system/vulnerability/wordpress-wp-crm-system-3-4-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49272
Published: 2025-06-06
Description: Missing Authorization vulnerability in sergiotrinity Trinity Audio trinity-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trinity Audio: from n/a through <= 5.20.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/trinity-audio/vulnerability/wordpress-trinity-audio-5-20-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49273
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in sminozzi WP Tools wptools allows Cross Site Request Forgery.This issue affects WP Tools: from n/a through <= 5.24.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wptools/vulnerability/wordpress-wp-tools-5-24-cross-site-request-forgery-csrf-vulnerability?_s_id=cve