deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-53207
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel WP Travel Gutenberg Blocks wp-travel-blocks allows PHP Local File Inclusion.This issue affects WP Travel Gutenberg Blocks: from n/a through <= 3.9.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/wp-travel-blocks/vulnerability/wordpress-wp-travel-gutenberg-blocks-3-9-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-53208
Published: 2025-08-20
Description: Authorization Bypass Through User-Controlled Key vulnerability in paymayapg Maya Business paymaya-checkout-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maya Business: from n/a through <= 1.2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://patchstack.com/database/Wordpress/Plugin/paymaya-checkout-for-woocommerce/vulnerability/wordpress-maya-business-1-2-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2025-53210
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in bdthemes ZoloBlocks zoloblocks allows PHP Local File Inclusion.This issue affects ZoloBlocks: from n/a through <= 2.3.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/zoloblocks/vulnerability/wordpress-zoloblocks-plugin-2-3-2-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-53212
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Revolution Video Player With Bottom Playlist revolution-video-player allows Reflected XSS.This issue affects Revolution Video Player With Bottom Playlist: from n/a through <= 2.9.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/revolution-video-player/vulnerability/wordpress-revolution-video-player-with-bottom-playlist-2-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53213
Published: 2025-08-20
Description: Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ReachShip WooCommerce Multi-Carrier & Conditional Shipping elex-reachship-multi-carrier-conditional-shipping allows Using Malicious Files.This issue affects ReachShip WooCommerce Multi-Carrier & Conditional Shipping: from n/a through <= 4.3.1.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/elex-reachship-multi-carrier-conditional-shipping/vulnerability/wordpress-reachship-woocommerce-multi-carrier-conditional-shipping-4-3-1-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-53226
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitalzoomstudio Comments Capcha Box comments-capcha-box allows Reflected XSS.This issue affects Comments Capcha Box: from n/a through <= 1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/comments-capcha-box/vulnerability/wordpress-comments-capcha-box-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53299
Published: 2025-08-20
Description: Deserialization of Untrusted Data vulnerability in ThemeMakers ThemeMakers Visual Content Composer tmm_content_composer allows Object Injection.This issue affects ThemeMakers Visual Content Composer: from n/a through <= 1.5.8.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/tmm_content_composer/vulnerability/wordpress-thememakers-visual-content-composer-plugin-1-5-8-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-53319
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raptive Raptive Ads adthrive-ads allows Reflected XSS.This issue affects Raptive Ads: from n/a through <= 3.8.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/adthrive-ads/vulnerability/wordpress-raptive-ads-plugin-3-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53559
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player - Addon for WPBakery Page Builder lbg-universal-video-player-addon-visual-composer allows Reflected XSS.This issue affects Universal Video Player - Addon for WPBakery Page Builder: from n/a through <= 3.2.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/lbg-universal-video-player-addon-visual-composer/vulnerability/wordpress-universal-video-player-addon-for-wpbakery-page-builder-3-2-1-cross-site-scripting-xss-vulnerability-3?_s_id=cve
CVE: CVE-2025-53560
Published: 2025-08-20
Description: Deserialization of Untrusted Data vulnerability in rascals Noisa noisa allows Object Injection.This issue affects Noisa: from n/a through <= 2.6.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Theme/noisa/vulnerability/wordpress-noisa-2-6-0-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-53561
Published: 2025-08-20
Description: Path Traversal: '.../...//' vulnerability in miniOrange Prevent files / folders access prevent-file-access allows Path Traversal.This issue affects Prevent files / folders access: from n/a through <= 2.6.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Plugin/prevent-file-access/vulnerability/wordpress-prevent-files-folders-access-plugin-2-6-0-path-traversal-vulnerability?_s_id=cve
CVE: CVE-2025-53562
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player - Addon for WPBakery Page Builder lbg_universal_video_player_addon_visual_composer allows Reflected XSS.This issue affects Universal Video Player - Addon for WPBakery Page Builder: from n/a through <= 3.2.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/lbg_universal_video_player_addon_visual_composer/vulnerability/wordpress-universal-video-player-addon-for-wpbakery-page-builder-3-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53563
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Youtube Vimeo Video Player and Slider video_player_youtube_vimeo allows Reflected XSS.This issue affects Youtube Vimeo Video Player and Slider: from n/a through <= 3.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/video_player_youtube_vimeo/vulnerability/wordpress-youtube-vimeo-video-player-and-slider-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53564
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup HTML5 Radio Player - WPBakery Page Builder Addon lbg_radio_player_addon_visual_composer allows Reflected XSS.This issue affects HTML5 Radio Player - WPBakery Page Builder Addon: from n/a through <= 2.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/lbg_radio_player_addon_visual_composer/vulnerability/wordpress-html5-radio-player-wpbakery-page-builder-addon-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53565
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Widget for Google Reviews business-reviews-wp allows PHP Local File Inclusion.This issue affects Widget for Google Reviews: from n/a through <= 1.0.15.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/business-reviews-wp/vulnerability/wordpress-widget-for-google-reviews-1-0-15-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-53567
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Ghost Kit ghostkit allows PHP Local File Inclusion.This issue affects Ghost Kit: from n/a through <= 3.4.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/ghostkit/vulnerability/wordpress-ghost-kit-3-4-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-53577
Published: 2025-08-20
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in thehp Global DNS global-dns allows Remote Code Inclusion.This issue affects Global DNS: from n/a through <= 3.1.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/global-dns/vulnerability/wordpress-global-dns-plugin-3-1-0-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2025-53580
Published: 2025-08-20
Description: Incorrect Privilege Assignment vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Privilege Escalation.This issue affects Simple Business Directory Pro: from n/a through < 15.6.9.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/simple-business-directory-pro/vulnerability/wordpress-simple-business-directory-pro-plugin-15-6-9-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-53983
Published: 2025-08-20
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetElements For Elementor jet-elements allows Retrieve Embedded Sensitive Data.This issue affects JetElements For Elementor: from n/a through <= 2.7.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/jet-elements/vulnerability/wordpress-jetelements-for-elementor-2-7-7-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-53985
Published: 2025-08-20
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetTabs jet-tabs allows Retrieve Embedded Sensitive Data.This issue affects JetTabs: from n/a through <= 2.2.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/jet-tabs/vulnerability/wordpress-jettabs-2-2-9-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-53987
Published: 2025-08-20
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetMenu jet-menu allows Retrieve Embedded Sensitive Data.This issue affects JetMenu: from n/a through <= 2.4.11.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/jet-menu/vulnerability/wordpress-jetmenu-2-4-11-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-53988
Published: 2025-08-20
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embedded Sensitive Data.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.18.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/jet-blocks/vulnerability/wordpress-jetblocks-for-elementor-1-3-18-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-53992
Published: 2025-08-20
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetTricks jet-tricks allows Retrieve Embedded Sensitive Data.This issue affects JetTricks: from n/a through <= 1.5.4.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/jet-tricks/vulnerability/wordpress-jettricks-1-5-4-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-53993
Published: 2025-08-20
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetPopup jet-popup allows Retrieve Embedded Sensitive Data.This issue affects JetPopup: from n/a through <= 2.0.15.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/jet-popup/vulnerability/wordpress-jetpopup-2-0-15-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-53998
Published: 2025-08-20
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows Retrieve Embedded Sensitive Data.This issue affects JetWooBuilder: from n/a through <= 2.1.20.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/jet-woo-builder/vulnerability/wordpress-jetwoobuilder-2-1-20-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-54007
Published: 2025-08-20
Description: Deserialization of Untrusted Data vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Object Injection.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.11.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/post-grid/vulnerability/wordpress-post-grid-and-gutenberg-blocks-plugin-2-3-11-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-54008
Published: 2025-08-20
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Retrieve Embedded Sensitive Data.This issue affects JetSmartFilters: from n/a through <= 3.6.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/jet-smart-filters/vulnerability/wordpress-jetsmartfilters-3-6-7-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-54012
Published: 2025-08-20
Description: Deserialization of Untrusted Data vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Object Injection.This issue affects Welcart e-Commerce: from n/a through <= 2.11.16.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/usc-e-shop/vulnerability/wordpress-welcart-e-commerce-plugin-2-11-16-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-54014
Published: 2025-08-20
Description: Deserialization of Untrusted Data vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Object Injection.This issue affects MediCenter - Health Medical Clinic: from n/a through <= 15.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Theme/medicenter/vulnerability/wordpress-medicenter-health-medical-clinic-15-1-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-54017
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows PHP Local File Inclusion.This issue affects Paid Member Subscriptions: from n/a through <= 2.15.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/paid-member-subscriptions/vulnerability/wordpress-paid-member-subscriptions-2-15-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-54019
Published: 2025-08-20
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Code Injection.This issue affects Alone: from n/a through < 7.8.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Theme/alone/vulnerability/wordpress-alone-7-8-5-arbitrary-code-execution-vulnerability?_s_id=cve
CVE: CVE-2025-54021
Published: 2025-08-20
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Path Traversal.This issue affects Simple File List: from n/a through <= 6.1.14.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/simple-file-list/vulnerability/wordpress-simple-file-list-6-1-14-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2025-54025
Published: 2025-08-20
Description: Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coupon Affiliates: from n/a through <= 6.4.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/woo-coupon-usage/vulnerability/wordpress-coupon-affiliates-plugin-6-4-0-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-54027
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Schiocco Support Board supportboard allows Reflected XSS.This issue affects Support Board: from n/a through <= 3.8.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/supportboard/vulnerability/wordpress-support-board-3-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54028
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Saleswonder Team: Tobias CF7 WOW Styler cf7-styler allows PHP Local File Inclusion.This issue affects CF7 WOW Styler: from n/a through <= 1.7.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/cf7-styler/vulnerability/wordpress-cf7-wow-styler-plugin-1-7-2-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-54031
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Schiocco Support Board supportboard allows PHP Local File Inclusion.This issue affects Support Board: from n/a through <= 3.8.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/supportboard/vulnerability/wordpress-support-board-3-8-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-54032
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace Real Estate Manager Pro real-estate-manager-pro allows Reflected XSS.This issue affects Real Estate Manager Pro: from n/a through <= 12.7.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/real-estate-manager-pro/vulnerability/wordpress-real-estate-manager-pro-plugin-12-7-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54034
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Tribulant Software Newsletters newsletters-lite allows PHP Local File Inclusion.This issue affects Newsletters: from n/a through <= 4.10.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/newsletters-lite/vulnerability/wordpress-newsletters-4-10-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-54040
Published: 2025-08-20
Description: Missing Authorization vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through <= 5.1.20.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/webba-booking-lite/vulnerability/wordpress-webba-booking-5-1-20-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-54044
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _CreativeMedia_ Elite Video Player elite-video-player allows Reflected XSS.This issue affects Elite Video Player: from n/a through <= 10.0.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/elite-video-player/vulnerability/wordpress-elite-video-player-10-0-5-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2025-54046
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs Cost Calculator ql-cost-calculator allows Stored XSS.This issue affects Cost Calculator: from n/a through <= 7.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ql-cost-calculator/vulnerability/wordpress-cost-calculator-plugin-7-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54048
Published: 2025-08-20
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniOrange Custom API for WP custom-api-for-wp allows SQL Injection.This issue affects Custom API for WP: from n/a through <= 4.2.2.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/custom-api-for-wp/vulnerability/wordpress-custom-api-for-wp-4-2-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-54049
Published: 2025-08-20
Description: Incorrect Privilege Assignment vulnerability in miniOrange Custom API for WP custom-api-for-wp allows Privilege Escalation.This issue affects Custom API for WP: from n/a through <= 4.2.2.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/custom-api-for-wp/vulnerability/wordpress-custom-api-for-wp-4-2-2-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-54052
Published: 2025-08-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows PHP Local File Inclusion.This issue affects Realtyna Organic IDX plugin: from n/a through <= 5.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/real-estate-listing-realtyna-wpl/vulnerability/wordpress-realtyna-organic-idx-plugin-plugin-5-0-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-54053
Published: 2025-08-20
Description: Deserialization of Untrusted Data vulnerability in Adrian Tobey Groundhogg groundhogg allows Object Injection.This issue affects Groundhogg: from n/a through <= 4.2.2.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/groundhogg/vulnerability/wordpress-groundhogg-4-2-2-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-54055
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Druco druco allows Reflected XSS.This issue affects Druco: from n/a through <= 1.5.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/druco/vulnerability/wordpress-druco-1-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54056
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Responsive HTML5 Audio Player PRO With Playlist lbg-audio2-html5 allows Reflected XSS.This issue affects Responsive HTML5 Audio Player PRO With Playlist: from n/a through <= 3.5.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/lbg-audio2-html5/vulnerability/wordpress-responsive-html5-audio-player-pro-with-playlist-3-5-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54670
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bobbingwide oik oik allows Reflected XSS.This issue affects oik: from n/a through <= 4.15.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/oik/vulnerability/wordpress-oik-plugin-4-15-2-cross-site-scripting-xss-vulnerability?_s_id=cve