deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-39358
Published: 2025-06-06
Description: Deserialization of Untrusted Data vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Object Injection.This issue affects WP Posts Carousel: from n/a through <= 1.3.12.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/wp-posts-carousel/vulnerability/wordpress-wp-posts-carousel-1-3-12-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-41360
Published: 2025-06-06
Description: Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The device is vulnerable to a packet flooding denial of service attack.
CWE: CWE-400
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zivs-idf-and-zlf-products
CVE: CVE-2025-41361
Published: 2025-06-06
Description: Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The devices improperly handle TLS requests associated with PROCOME sockets, so TLS requests sent to those PROCOME ports could cause the device to reboot and result in a denial of service. To exploit this vulnerability, PROCOME ports must be configured and active, with communications encryption active.
CWE: CWE-400
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zivs-idf-and-zlf-products
CVE: CVE-2025-41362
Published: 2025-06-06
Description: Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission.
CWE: CWE-94
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zivs-idf-and-zlf-products
CVE: CVE-2025-41363
Published: 2025-06-06
Description: In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission.
CWE: CWE-942
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zivs-idf-and-zlf-products
CVE: CVE-2025-41364
Published: 2025-06-06
Description: Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission.
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zivs-idf-and-zlf-products
CVE: CVE-2025-41365
Published: 2025-06-06
Description: Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed only with permissions higher than the view permission.
CWE: CWE-94
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zivs-idf-and-zlf-products
CVE: CVE-2025-41366
Published: 2025-06-06
Description: In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability requires authenticating to the device and executing certain commands that can only be executed with permissions higher than the view permission.
CWE: CWE-942
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zivs-idf-and-zlf-products
CVE: CVE-2025-41367
Published: 2025-06-06
Description: Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can only be executed with permissions higher than the view permission.
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zivs-idf-and-zlf-products
CVE: CVE-2025-47584
Published: 2025-06-06
Description: Deserialization of Untrusted Data vulnerability in ThemeGoods Photography.This issue affects Photography: from n/a through 7.5.2.
CVSS Score: 8.5 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/wordpress/theme/photography/vulnerability/wordpress-photography-theme-7-5-2-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-47586
Published: 2025-06-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors - Events stm-motors-events allows PHP Local File Inclusion.This issue affects Motors - Events: from n/a through <= 1.4.7.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/stm-motors-events/vulnerability/wordpress-motors-events-plugin-1-4-7-unauthenticated-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-48328
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows Cross Site Request Forgery.This issue affects Real Time Validation for Gravity Forms: from n/a through <= 1.7.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/real-time-validation-for-gravity-forms/vulnerability/wordpress-real-time-validation-for-gravity-forms-plugin-1-7-0-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-48329
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows Reflected XSS.This issue affects Real Time Validation for Gravity Forms: from n/a through <= 1.7.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/real-time-validation-for-gravity-forms/vulnerability/wordpress-real-time-validation-for-gravity-forms-plugin-1-7-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48335
Published: 2025-06-06
Description: Missing Authorization vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Plus: from n/a through <= 3.2.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/responsive-add-ons/vulnerability/wordpress-responsive-plus-plugin-3-2-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48337
Published: 2025-06-06
Description: Missing Authorization vulnerability in QuickcabWP QuickCab.This issue affects QuickCab: from n/a through 1.3.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/quickcab/vulnerability/wordpress-quickcab-plugin-1-3-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49067
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Nasa Core nasa-core allows Stored XSS.This issue affects Nasa Core: from n/a through < 6.4.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/nasa-core/vulnerability/wordpress-nasa-core-plugin-6-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49068
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oceanwp Ocean Extra ocean-extra allows Stored XSS.This issue affects Ocean Extra: from n/a through <= 2.4.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ocean-extra/vulnerability/wordpress-ocean-extra-plugin-2-4-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49074
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abu Huraira Bin Aman WidgetKit widgetkit-for-elementor allows Stored XSS.This issue affects WidgetKit: from n/a through <= 2.5.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/widgetkit-for-elementor/vulnerability/wordpress-widgetkit-plugin-2-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49075
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Wishlist wishlist allows Stored XSS.This issue affects Wishlist: from n/a through <= 1.0.43.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wishlist/vulnerability/wordpress-wishlist-plugin-1-0-43-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49076
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 6.2.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/the-plus-addons-for-elementor-page-builder/vulnerability/wordpress-the-plus-addons-for-elementor-page-builder-lite-plugin-6-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49077
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in ThemeHigh Dynamic Pricing and Discount Rules discount-and-dynamic-pricing allows Cross Site Request Forgery.This issue affects Dynamic Pricing and Discount Rules: from n/a through <= 2.2.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/discount-and-dynamic-pricing/vulnerability/wordpress-dynamic-pricing-and-discount-rules-plugin-2-2-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-5239
Published: 2025-06-06
Description: The Domain For Sale plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class_name’ parameter in all versions up to, and including, 3.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/domain-for-sale/trunk/src/Admin/GutenbergBlock/Gutenberg_Block_Init.php#L278; https://plugins.trac.wordpress.org/changeset/3306141/; https://wordpress.org/plugins/domain-for-sale/#developers
CVE: CVE-2025-5760
Published: 2025-06-06
Description: The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the append_debug_info_to_context() function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $_POST (and sometimes raw request bodies or $_GET) without redacting any password‐related keys. As a result, whenever a user submits a login form, whether via native wp_login or a third‐party login widget, their actual password is written in clear text into the logs. An authenticated attacker or any user whose actions generate a login event will have their password recorded; an administrator (or anyone with database read access) can then read those logs and retrieve every captured password.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-256
References: https://github.com/bonny/WordPress-Simple-History/commit/68eab0cab6882eafef4bfece884093eeda5ac018; https://github.com/bonny/WordPress-Simple-History/issues/546; https://plugins.trac.wordpress.org/changeset/3267487/
CVE: CVE-2025-5761
Published: 2025-06-06
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul BP Monitoring Management System 1.0. This issue affects some unknown processing of the file /edit-family-member.php. The manipulation of the argument memberage leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/qingchuana/q1ngchuan/issues/5; https://phpgurukul.com/; https://vuldb.com/?ctiid.311303
CVE: CVE-2025-5762
Published: 2025-06-06
Description: A vulnerability, which was classified as critical, was found in code-projects Patient Record Management System 1.0. Affected is an unknown function of the file view_hematology.php. The manipulation of the argument itr_no leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/bazhahei123/CVE/blob/main/sql_cve_6_5.pdf; https://vuldb.com/?ctiid.311304
CVE: CVE-2025-5763
Published: 2025-06-06
Description: A vulnerability has been found in Tenda CP3 11.10.00[PII_REDACTED] and classified as critical. Affected by this vulnerability is the function sub_F3C8C of the file apollo. The manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://blog.kevgen.ru/posts/rce_in_tenda_cp3_camera; https://github.com/k3vg3n/researches/blob/main/RCE_in_Tenda_CP3_camera.md; https://vuldb.com/?ctiid.311305
CVE: CVE-2023-25995
Published: 2025-06-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in choicehomemortgage AI Mortgage Calculator allows PHP Local File Inclusion. This issue affects AI Mortgage Calculator: from n/a through 1.0.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/wordpress/plugin/ai-mortgage-calculator/vulnerability/wordpress-ai-mortgage-calculator-1-0-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2023-25997
Published: 2025-06-06
Description: Missing Authorization vulnerability in SolaPlugins Sola Support Ticket allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sola Support Ticket: from n/a through 3.17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/sola-support-tickets/vulnerability/wordpress-sola-support-ticket-3-17-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2023-26000
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hanhdo205 Bang tinh vay allows Stored XSS. This issue affects Bang tinh vay: from n/a through 1.0.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/bang-tinh-lai-suat/vulnerability/wordpress-bang-tinh-vay-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-26001
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marchetti Design Next Event Calendar allows Stored XSS. This issue affects Next Event Calendar: from n/a through 1.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/next-event-calendar/vulnerability/wordpress-next-event-calendar-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-26002
Published: 2025-06-06
Description: Missing Authorization vulnerability in 6Storage 6Storage Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects 6Storage Rentals: from n/a through 2.19.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/6storage-rentals/vulnerability/wordpress-6storage-rentals-2-19-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2023-26003
Published: 2025-06-06
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vipul Jariwala WP Post Corrector allows SQL Injection. This issue affects WP Post Corrector: from n/a through 1.0.2.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/wordpress/plugin/wp-post-corrector/vulnerability/wordpress-wp-post-corrector-1-0-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-23969
Published: 2025-06-06
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in whassan KI Live Video Conferences ki-live-video-conferences allows Retrieve Embedded Sensitive Data.This issue affects KI Live Video Conferences: from n/a through <= 5.5.15.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/ki-live-video-conferences/vulnerability/wordpress-ki-live-video-conferences-5-5-15-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-23971
Published: 2025-06-06
Description: Missing Authorization vulnerability in whassan KI Live Video Conferences ki-live-video-conferences allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KI Live Video Conferences: from n/a through <= 5.5.15.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/ki-live-video-conferences/vulnerability/wordpress-ki-live-video-conferences-5-5-15-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24762
Published: 2025-06-06
Description: Missing Authorization vulnerability in facturaone TicketBAI Facturas para WooCommerce wp-ticketbai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TicketBAI Facturas para WooCommerce: from n/a through <= 3.45.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-ticketbai/vulnerability/wordpress-ticketbai-facturas-para-woocommerce-3-19-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24763
Published: 2025-06-06
Description: Missing Authorization vulnerability in Pascal Casier bbPress API bbp-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects bbPress API: from n/a through <= 1.0.14.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/bbp-api/vulnerability/wordpress-bbpress-api-1-0-14-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24772
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7 allows Cross Site Request Forgery.This issue affects Pay with Contact Form 7: from n/a through <= 1.0.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/pay-with-contact-form-7/vulnerability/wordpress-pay-with-contact-form-7-1-0-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-24776
Published: 2025-06-06
Description: Missing Authorization vulnerability in codelobster Responsive Flipbooks responsive-flipbooks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Flipbooks: from n/a through <= 1.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/responsive-flipbooks/vulnerability/wordpress-responsive-flipbooks-1-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24778
Published: 2025-06-06
Description: Missing Authorization vulnerability in De paragon No Spam At All no-spam-at-all allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects No Spam At All: from n/a through <= 1.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/no-spam-at-all/vulnerability/wordpress-no-spam-at-all-1-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-26590
Published: 2025-06-06
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nir Complete Google Seo Scan complete-google-seo-scan allows SQL Injection.This issue affects Complete Google Seo Scan: from n/a through <= 3.5.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/complete-google-seo-scan/vulnerability/wordpress-complete-google-seo-scan-3-5-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-26593
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in FasterThemes FastBook fastbook-responsive-appointment-booking-and-scheduling-system allows Cross Site Request Forgery.This issue affects FastBook: from n/a through <= 1.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/fastbook-responsive-appointment-booking-and-scheduling-system/vulnerability/wordpress-fastbook-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-27334
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ángel C. Simple Google Static Map simple-google-static-map allows DOM-Based XSS.This issue affects Simple Google Static Map: from n/a through <= 1.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-google-static-map/vulnerability/wordpress-simple-google-static-map-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27359
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Seerox WP Media File Type Manager wp-media-file-type-manager allows Cross Site Request Forgery.This issue affects WP Media File Type Manager: from n/a through <= 2.3.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-media-file-type-manager/vulnerability/wordpress-wp-media-file-type-manager-plugin-2-3-0-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-27360
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Corner Quick Event Calendar quick-event-calendar allows Cross Site Request Forgery.This issue affects Quick Event Calendar: from n/a through <= 1.4.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/quick-event-calendar/vulnerability/wordpress-quick-event-calendar-1-4-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-28948
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in codedraft Mediabay - WordPress Media Library Folders allows Reflected XSS. This issue affects Mediabay - WordPress Media Library Folders: from n/a through 1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/wordpress/plugin/mediabay/vulnerability/wordpress-mediabay-wordpress-media-library-folders-plugin-1-4-csrf-to-reflected-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28950
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in David Shabtai Post Author post-author allows Stored XSS.This issue affects Post Author: from n/a through <= 1.1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/post-author/vulnerability/wordpress-post-author-1-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve