deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-2099
Published: 2025-05-19
Description: A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service (ReDoS) attack. The regular expression used to process code blocks in docstrings contains nested quantifiers, leading to exponential backtracking when processing input with a large number of newline characters. An attacker can exploit this by providing a specially crafted payload, causing high CPU usage and potential application downtime, effectively resulting in a Denial of Service (DoS) scenario.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://github.com/huggingface/transformers/commit/8cb522b4190bd556ce51be[PII_REDACTED]0b1a3e57; https://huntr.com/bounties/97b780f3-ffca-424f-ad5d-0e1c57a5bde4
CVE: CVE-2025-4930
Published: 2025-05-19
Description: A vulnerability classified as critical has been found in Campcodes Online Shopping Portal 1.0. Affected is an unknown function of the file /my-cart.php. The manipulation of the argument billingaddress leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/N1sa26/CVE/issues/2; https://vuldb.com/?ctiid.309492; https://vuldb.com/?id.309492
CVE: CVE-2025-4931
Published: 2025-05-19
Description: A vulnerability classified as critical was found in projectworlds Online Lawyer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /user_registation.php. The manipulation of the argument email leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/hhhanxx/attack/issues/11; https://vuldb.com/?ctiid.309493; https://vuldb.com/?id.309493
CVE: CVE-2025-4932
Published: 2025-05-19
Description: A vulnerability, which was classified as critical, has been found in projectworlds Online Lawyer Management System 1.0. Affected by this issue is some unknown functionality of the file /lawyer_registation.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/hhhanxx/attack/issues/12; https://vuldb.com/?ctiid.309494; https://vuldb.com/?id.309494
CVE: CVE-2025-4933
Published: 2025-05-19
Description: A vulnerability, which was classified as critical, was found in ponaravindb Hospital-Management-System 1.0. This affects an unknown part of the file /doctor-panel.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/zylv0002/SQLi-ponaravindb-HMS; https://vuldb.com/?ctiid.309495; https://vuldb.com/?id.309495
CVE: CVE-2024-4878
Published: 2025-05-19
Description: Rejected reason: Unused CVE record, incorrectly reserved
CVE: CVE-2025-28371
Published: 2025-05-19
Description: EnGenius ENH500 AP 2T2R V3.0 FW3.7.22 is vulnerable to Incorrect Access Control via the password change function. The device fails to validate the current password, allowing an attacker to submit a password change request with an invalid current password and set a new password.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://drive.google.com/file/d/1kQFOyFQYycKynIBjbU8bMx2gYTG3Bxi2/view?usp=sharing; https://pastebin.com/raw/EnL1XT2n; https://pastebin.com/raw/hziq1nGH
CVE: CVE-2025-44108
Published: 2025-05-19
Description: A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions component. An attacker with admin privileges can inject a malicious JavaScript payload into the system, which is then stored persistently.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/flatpressblog/flatpress/commit/24a6feacf1747ec19725b52c097715c8ab9c4559; https://github.com/flatpressblog/flatpress/releases/tag/1.3.1; https://github.com/flatpressblog/flatpress/releases/tag/1.4.rc2
CVE: CVE-2025-4934
Published: 2025-05-19
Description: A vulnerability has been found in PHPGurukul User Registration & Login and User Management System 3.3 and classified as critical. This vulnerability affects unknown code of the file /edit-profile.php. The manipulation of the argument Contact leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/LitBot123/mycve/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.309496
CVE: CVE-2025-4935
Published: 2025-05-19
Description: A vulnerability was found in SourceCodester Stock Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /php_action/changePassword.php. The manipulation of the argument user_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/hubCVE2025/CVE/issues/2; https://vuldb.com/?ctiid.309497; https://vuldb.com/?id.309497
CVE: CVE-2024-51106
Published: 2025-05-19
Description: A cross-site scripting (XSS) vulnerability in the component mcgs/admin/aboutus.php of PHPGURUKUL Medical Card Generation System using PHP and MySQL v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the pagetitle parameter.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://github.com/0xBhushan/Writeups/blob/main/CVE/phpGurukul/Medical%20Card%20Generation%20System/Stored%20XSS-About%20Us.pdf
CVE: CVE-2024-55063
Published: 2025-05-19
Description: Multiple Code Injection vulnerabilities in EasyVirt DC NetScope <= 8.7.0 allows remote authenticated attackers to execute arbitrary code via the (1) lang parameter to /international/keyboard/options; the (2) keyboard_layout or (3) keyboard_variant parameter to /international/settings/keyboard; the (4) timezone parameter to /international/settings/timezone.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/Elymaro/CVE/blob/main/EasyVirt/CVE-2024-55063.md
CVE: CVE-2025-30072
Published: 2025-05-19
Description: Tiiwee X1 Alarm System TWX1HAKV2 allows Authentication Bypass by Capture-replay, leading to physical Access to the protected facilities without triggering an alarm.
CVSS Score: 7.6 (HIGH)
CWE: CWE-294
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-006.txt; https://www.tiiwee.com/collections/x1-alarm-systems; http://seclists.org/fulldisclosure/2025/May/20
CVE: CVE-2025-3908
Published: 2025-05-19
Description: The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destination directory.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-59
References: https://community.openvpn.net/Security%20Announcements/CVE-2025-3908; http://www.openwall.com/lists/oss-security/2025/05/20/2
CVE: CVE-2025-43714
Published: 2025-05-19
Description: The ChatGPT system through 2025-03-30 performs inline rendering of SVG documents (instead of, for example, rendering them as text inside a code block), which enables HTML injection within most modern graphical web browsers.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-77
References: https://medium.com/@zer0dac/chatgpt-a-potential-phishing-vector-via-html-injection-bf703c79590a
CVE: CVE-2025-48232
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Addons For Beaver Builder – Lite xpro-addons-beaver-builder-elementor allows Stored XSS.This issue affects Xpro Addons For Beaver Builder – Lite: from n/a through <= 1.5.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/xpro-addons-beaver-builder-elementor/vulnerability/wordpress-xpro-addons-for-beaver-builder-lite-1-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48233
Published: 2025-05-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in affmngr Affiliates Manager Google reCAPTCHA Integration affiliates-manager-google-recaptcha-integration allows Stored XSS.This issue affects Affiliates Manager Google reCAPTCHA Integration: from n/a through <= 1.0.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/affiliates-manager-google-recaptcha-integration/vulnerability/wordpress-affiliates-manager-google-recaptcha-integration-plugin-1-0-6-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48234
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Blocks Ultimate Blocks ultimate-blocks allows DOM-Based XSS.This issue affects Ultimate Blocks: from n/a through <= 3.3.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-blocks/vulnerability/wordpress-ultimate-blocks-3-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48235
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bogdan Bendziukov WP Image Mask wp-image-mask allows DOM-Based XSS.This issue affects WP Image Mask: from n/a through <= 3.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-image-mask/vulnerability/wordpress-wp-image-mask-3-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48236
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bunny.net bunny.net bunnycdn allows Stored XSS.This issue affects bunny.net: from n/a through <= 2.3.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bunnycdn/vulnerability/wordpress-bunny-net-2-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48237
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce allows Stored XSS.This issue affects Wishlist for WooCommerce: from n/a through <= 3.2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wish-list-for-woocommerce/vulnerability/wordpress-wishlist-for-woocommerce-3-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48238
Published: 2025-05-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in awcode AWcode Toolkit awcode-toolkit allows Stored XSS.This issue affects AWcode Toolkit: from n/a through <= 1.0.18.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/awcode-toolkit/vulnerability/wordpress-awcode-toolkit-plugin-1-0-18-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48239
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Product Notes Tab & Private Admin Notes for WooCommerce product-notes-for-woocommerce allows Stored XSS.This issue affects Product Notes Tab & Private Admin Notes for WooCommerce: from n/a through <= 3.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/product-notes-for-woocommerce/vulnerability/wordpress-product-notes-tab-private-admin-notes-for-woocommerce-3-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48240
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Cost of Goods for WooCommerce cost-of-goods-for-woocommerce allows Stored XSS.This issue affects Cost of Goods for WooCommerce: from n/a through <= 3.7.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cost-of-goods-for-woocommerce/vulnerability/wordpress-cost-of-goods-for-woocommerce-3-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48242
Published: 2025-05-19
Description: Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Legal Pages: from n/a through <= 1.4.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/legal-pages/vulnerability/wordpress-legal-pages-1-4-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48243
Published: 2025-05-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in sminozzi reCAPTCHA for all recaptcha-for-all allows Cross Site Request Forgery.This issue affects reCAPTCHA for all: from n/a through <= 2.26.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/recaptcha-for-all/vulnerability/wordpress-recaptcha-for-all-2-26-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-48244
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor exclusive-addons-for-elementor allows Stored XSS.This issue affects Exclusive Addons Elementor: from n/a through <= 2.7.9.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/exclusive-addons-for-elementor/vulnerability/wordpress-exclusive-addons-elementor-2-7-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48246
Published: 2025-05-19
Description: Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through <= 6.11.2.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/the-events-calendar/vulnerability/wordpress-the-events-calendar-6-11-2-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48247
Published: 2025-05-19
Description: Missing Authorization vulnerability in Blair Williams Shortlinks by Pretty Links pretty-link allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortlinks by Pretty Links: from n/a through <= 3.6.15.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/pretty-link/vulnerability/wordpress-shortlinks-by-pretty-links-3-6-15-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48248
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Sitewide Discount for WooCommerce: Apply Discount to All Products global-shop-discount-for-woocommerce allows Stored XSS.This issue affects Sitewide Discount for WooCommerce: Apply Discount to All Products: from n/a through <= 2.2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/global-shop-discount-for-woocommerce/vulnerability/wordpress-sitewide-discount-for-woocommerce-apply-discount-to-all-products-2-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48249
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory EAN for WooCommerce ean-for-woocommerce allows Stored XSS.This issue affects EAN for WooCommerce: from n/a through <= 5.4.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ean-for-woocommerce/vulnerability/wordpress-ean-for-woocommerce-5-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48250
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Coupons & Add to Cart by URL Links for WooCommerce url-coupons-for-woocommerce-by-algoritmika allows Stored XSS.This issue affects Coupons & Add to Cart by URL Links for WooCommerce: from n/a through <= 1.7.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/url-coupons-for-woocommerce-by-algoritmika/vulnerability/wordpress-coupons-add-to-cart-by-url-links-for-woocommerce-1-7-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48251
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Emails & Recipients for WooCommerce custom-emails-for-woocommerce allows Stored XSS.This issue affects Additional Custom Emails & Recipients for WooCommerce: from n/a through <= 3.5.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/custom-emails-for-woocommerce/vulnerability/wordpress-additional-custom-emails-recipients-for-woocommerce-3-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48252
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Back Button Widget back-button-widget allows Stored XSS.This issue affects Back Button Widget: from n/a through <= 1.6.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/back-button-widget/vulnerability/wordpress-back-button-widget-1-6-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48253
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Free Shipping Bar: Amount Left for Free Shipping for WooCommerce amount-left-free-shipping-woocommerce allows Stored XSS.This issue affects Free Shipping Bar: Amount Left for Free Shipping for WooCommerce: from n/a through <= 2.4.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/amount-left-free-shipping-woocommerce/vulnerability/wordpress-free-shipping-bar-amount-left-for-free-shipping-for-woocommerce-2-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48254
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Change Add to Cart Button Text for WooCommerce add-to-cart-button-labels-for-woocommerce allows Stored XSS.This issue affects Change Add to Cart Button Text for WooCommerce: from n/a through <= 2.2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/add-to-cart-button-labels-for-woocommerce/vulnerability/wordpress-change-add-to-cart-button-text-for-woocommerce-2-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48255
Published: 2025-05-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Cross Site Request Forgery.This issue affects Broadcast Live Video: from n/a through <= 6.2.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/videowhisper-live-streaming-integration/vulnerability/wordpress-broadcast-live-video-live-streaming-webrtc-hls-rtsp-rtmp-6-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-48256
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes Import Social Events import-facebook-events allows Stored XSS.This issue affects Import Social Events: from n/a through <= 1.8.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/import-facebook-events/vulnerability/wordpress-import-social-events-1-8-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48257
Published: 2025-05-19
Description: Missing Authorization vulnerability in Projectopia Projectopia projectopia-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Projectopia: from n/a through <= 5.1.17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/projectopia-core/vulnerability/wordpress-projectopia-5-1-17-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48258
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jetmonsters Mega Menu Block getwid-megamenu allows Stored XSS.This issue affects Mega Menu Block: from n/a through <= 1.0.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/getwid-megamenu/vulnerability/wordpress-mega-menu-block-1-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48259
Published: 2025-05-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in Juan Carlos WP Mapa Politico España wp-mapa-politico-spain allows Cross Site Request Forgery.This issue affects WP Mapa Politico España: from n/a through <= 3.8.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-mapa-politico-spain/vulnerability/wordpress-wp-mapa-politico-espana-plugin-3-8-0-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-48260
Published: 2025-05-19
Description: Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/ninja-gdpr-compliance/vulnerability/wordpress-gdpr-ccpa-compliance-support-2-7-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48262
Published: 2025-05-19
Description: Missing Authorization vulnerability in M.Code Url Rewrite Analyzer url-rewrite-analyzer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Url Rewrite Analyzer: from n/a through <= 1.3.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/url-rewrite-analyzer/vulnerability/wordpress-url-rewrite-analyzer-1-3-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48263
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Stored XSS.This issue affects MultiVendorX: from n/a through <= 4.2.22.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/dc-woocommerce-multi-vendor/vulnerability/wordpress-multivendorx-4-2-22-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48264
Published: 2025-05-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in artiosmedia Product Code for WooCommerce product-code-for-woocommerce allows Cross Site Request Forgery.This issue affects Product Code for WooCommerce: from n/a through <= 1.5.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/product-code-for-woocommerce/vulnerability/wordpress-product-code-for-woocommerce-plugin-1-5-0-csrf-to-database-update-vulnerability?_s_id=cve