deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-6164
Published: 2025-06-17
Description: A vulnerability was found in TOTOLINK A3002R 4.0.0-B20[PII_REDACTED]. It has been classified as critical. This affects an unknown part of the file /boafrm/formMultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/awindog/cve/blob/main/688/10.md; https://github.com/awindog/cve/blob/main/688/10.md#poc; https://vuldb.com/?ctiid.312639
CVE: CVE-2025-6165
Published: 2025-06-17
Description: A vulnerability was found in TOTOLINK X15 1.0.0-B20[PII_REDACTED]. It has been declared as critical. This vulnerability affects unknown code of the file /boafrm/formTmultiAP of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/awindog/cve/blob/main/688/11.md; https://github.com/awindog/cve/blob/main/688/11.md#poc; https://vuldb.com/?ctiid.312640
CVE: CVE-2025-6166
Published: 2025-06-17
Description: A vulnerability was found in frdel Agent-Zero up to 0.8.4. It has been rated as problematic. This issue affects the function image_get of the file /python/api/image_get.py. The manipulation of the argument path leads to path traversal. Upgrading to version 0.8.4.1 is able to address this issue. The identifier of the patch is 5db74202d632306a883ccce7339c5bdba0d16c5a. It is recommended to upgrade the affected component.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: https://github.com/frdel/agent-zero/commit/5db74202d632306a883ccce7339c5bdba0d16c5a; https://github.com/frdel/agent-zero/issues/383; https://github.com/frdel/agent-zero/issues/383#issuecomment[PII_REDACTED]
CVE: CVE-2025-6167
Published: 2025-06-17
Description: A vulnerability classified as critical has been found in themanojdesai python-a2a up to 0.5.5. Affected is the function create_workflow of the file python_a2a/agent_flow/server/api.py. The manipulation leads to path traversal. Upgrading to version 0.5.6 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/themanojdesai/python-a2a/issues/40; https://github.com/themanojdesai/python-a2a/issues/40#issuecomment[PII_REDACTED]; https://github.com/themanojdesai/python-a2a/releases/tag/v0.5.6
CVE: CVE-2025-6173
Published: 2025-06-17
Description: A vulnerability classified as critical was found in Webkul QloApps 1.6.1. Affected by this vulnerability is an unknown functionality of the file /admin/ajax_products_list.php. The manipulation of the argument packItself leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirms the existence of this flaw but considers it a low-level issue due to admin privilege pre-requisites. Still, a fix is planned for a future release.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/caigo8/CVE-md/blob/main/QloApps/SQL_Injection.md; https://github.com/caigo8/CVE-md/blob/main/QloApps/SQL_Injection.md#vulnerability-recurrence; https://vuldb.com/?ctiid.312661
CVE: CVE-2025-40674
Published: 2025-06-17
Description: Reflected Cross-Site Scripting (XSS) in osCommerce v4. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the name of any parameter in /watch/en/about-us. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-oscommerce
CVE: CVE-2025-3515
Published: 2025-06-17
Description: The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the plugin's blacklist and upload .phar or other dangerous file types on the affected site's server, which may make remote code execution possible on the servers that are configured to handle .phar files as executable PHP scripts, particularly in default Apache+mod_php configurations where the file extension is not strictly validated before being passed to the PHP interpreter.
CVSS Score: 8.1 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/drag-and-drop-multiple-file-upload-contact-form-7/tags/1.3.8.8/inc/dnd-upload-cf7.php#L845; https://plugins.trac.wordpress.org/changeset/3310153/; https://www.wordfence.com/threat-intel/vulnerabilities/id/e1298242-61d2-495e-bae7-96b5e12bd03d?source=cve
CVE: CVE-2025-6050
Published: 2025-06-17
Description: Mezzanine CMS, in versions prior to 6.1.1, contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin interface. The vulnerability exists in the "displayable_links_js" function, which fails to properly sanitize blog post titles before including them in JSON responses served via "/admin/displayable_links.js". An authenticated admin user can create a blog post with a malicious JavaScript payload in the title field, then trick another admin user into clicking a direct link to the "/admin/displayable_links.js" endpoint, causing the malicious script to execute in their browser.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://advisory.checkmarx.net/advisory/CVE-2025-6050/; https://github.com/stephenmcd/mezzanine/commit/898630d8df48cf3ddb8b9942f59168b93216e3f8; https://github.com/stephenmcd/mezzanine/discussions/2080
CVE: CVE-2025-3880
Published: 2025-06-17
Description: The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on several functions in all versions up to, and including, 19.9.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to change the email address for the account connection, and disconnect the plugin. Previously created content will still be displayed and functional if the account is disconnected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://plugins.trac.wordpress.org/browser/social-polls-by-opinionstage/trunk/plugin.php; https://plugins.trac.wordpress.org/browser/social-polls-by-opinionstage/trunk/src/Modules/Admin.php; https://plugins.trac.wordpress.org/changeset/3310848/
CVE: CVE-2025-5291
Published: 2025-06-17
Description: The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's masterslider_pb and ms_slide shortcodes in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/master-slider/tags/3.10.8/includes/msp-shortcodes.php#L28; https://plugins.trac.wordpress.org/browser/master-slider/tags/3.10.8/includes/msp-shortcodes.php#L633; https://plugins.trac.wordpress.org/browser/master-slider/tags/3.10.8/includes/msp-shortcodes.php#L763
CVE: CVE-2025-5700
Published: 2025-06-17
Description: The Simple Logo Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/idesolutions/simple-logo-carousel/commit/d995b5d35e0fdc0a59307ce664e4ce1158b69bff; https://plugins.trac.wordpress.org/browser/simple-logo-carousel/trunk/includes/Base/Shortcode.php#L40; https://plugins.trac.wordpress.org/changeset/3312693/
CVE: CVE-2025-4365
Published: 2025-06-17
Description: Arbitrary file read in NetScaler Console and NetScaler SDX (SVM)
CVSS Score: 7.5 (HIGH)
CWE: CWE-1284
References: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694729
CVE: CVE-2025-5349
Published: 2025-06-17
Description: Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway
CVSS Score: 8.8 (HIGH)
CWE: CWE-1284
References: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
CVE: CVE-2025-5777
Published: 2025-06-17
Description: Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-908, CWE-457
References: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420; https://citrixbleed.com; https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/
CVE: CVE-2025-6020
Published: 2025-06-17
Description: A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://access.redhat.com/errata/RHSA-2025:10024; https://access.redhat.com/errata/RHSA-2025:10027; https://access.redhat.com/errata/RHSA-2025:10180
CVE: CVE-2025-0320
Published: 2025-06-17
Description: Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Secure Access Client for Windows
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694724
CVE: CVE-2025-49842
Published: 2025-06-17
Description: conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. Prior to version 2025.3.24, the conda_forge_webservice Docker container executes commands without specifying a user. By default, Docker containers run as the root user, which increases the risk of privilege escalation and host compromise if a vulnerability is exploited. This issue has been patched in version 2025.3.24.
CWE: CWE-276
References: https://github.com/conda-forge/conda-forge-webservices/commit/c28b67f833f32299cc47eef8ad226ca991db67ae; https://github.com/conda-forge/conda-forge-webservices/security/advisories/GHSA-3cj6-wc22-wvpv
CVE: CVE-2025-4404
Published: 2025-06-17
Description: A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-1220
References: https://access.redhat.com/errata/RHSA-2025:9184; https://access.redhat.com/errata/RHSA-2025:9185; https://access.redhat.com/errata/RHSA-2025:9186
CVE: CVE-2025-4879
Published: 2025-06-17
Description: Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694718
CVE: CVE-2025-6069
Published: 2025-06-17
Description: The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1333
References: https://github.com/python/cpython/commit/4455cbabf991e202185a25a631af206f60bbc949; https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41; https://github.com/python/cpython/commit/8d1b3dfa09135affbbf27fb8babcf3c11415df49
CVE: CVE-2025-24761
Published: 2025-06-17
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme DSK dsk allows PHP Local File Inclusion.This issue affects DSK: from n/a through < 2.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/dsk/vulnerability/wordpress-dsk-2-2-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-24773
Published: 2025-06-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce wpcrm allows SQL Injection.This issue affects WPCRM - CRM for Contact form CF7 & WooCommerce: from n/a through <= 3.2.0.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wpcrm/vulnerability/wordpress-wpcrm-crm-for-contact-form-cf7-woocommerce-3-2-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-28972
Published: 2025-06-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Suhas Surse WP Employee Attendance System wp-employee-attendance-system allows Blind SQL Injection.This issue affects WP Employee Attendance System: from n/a through <= 3.5.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-employee-attendance-system/vulnerability/wordpress-wp-employee-attendance-system-3-5-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-28991
Published: 2025-06-17
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Evon snsevon allows PHP Local File Inclusion.This issue affects Evon: from n/a through <= 3.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/snsevon/vulnerability/wordpress-evon-3-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-29002
Published: 2025-06-17
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Simen snssimen allows PHP Local File Inclusion.This issue affects Simen: from n/a through <= 4.6.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/snssimen/vulnerability/wordpress-simen-4-6-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-30562
Published: 2025-06-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdistillery Navigation Tree Elementor navigation-tree-elementor allows Blind SQL Injection.This issue affects Navigation Tree Elementor: from n/a through <= 1.0.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/navigation-tree-elementor/vulnerability/wordpress-navigation-tree-elementor-1-0-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30618
Published: 2025-06-17
Description: Deserialization of Untrusted Data vulnerability in yuliaz Rapyd Payment Extension for WooCommerce rapyd-payments allows Object Injection.This issue affects Rapyd Payment Extension for WooCommerce: from n/a through <= 1.2.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/rapyd-payments/vulnerability/wordpress-rapyd-payment-extension-for-woocommerce-1-1-9-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30988
Published: 2025-06-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _CreativeMedia_ Elite Video Player elite-video-player allows Stored XSS.This issue affects Elite Video Player: from n/a through <= 10.0.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/elite-video-player/vulnerability/wordpress-elite-video-player-10-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31919
Published: 2025-06-17
Description: Deserialization of Untrusted Data vulnerability in themeton Spare allows Object Injection. This issue affects Spare: from n/a through 1.7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/wordpress/theme/spare/vulnerability/wordpress-spare-1-7-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32510
Published: 2025-06-17
Description: Unrestricted Upload of File with Dangerous Type vulnerability in ovatheme Ovatheme Events Manager ova-events-manager allows Using Malicious Files.This issue affects Ovatheme Events Manager: from n/a through <= 1.8.4.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/ova-events-manager/vulnerability/wordpress-ovatheme-events-manager-plugin-1-7-5-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-32549
Published: 2025-06-17
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla WPGYM allows PHP Local File Inclusion. This issue affects WPGYM: from n/a through 65.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/wordpress/plugin/gym-management/vulnerability/wordpress-wpgym-65-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-34508
Published: 2025-06-17
Description: A path traversal vulnerability exists in the file dropoff functionality 
of ZendTo versions 6.15-7 and prior. This could allow a remote, authenticated attacker to retrieve the files of other ZendTo users, retrieve files on the host 
system, or cause a denial of service.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://horizon3.ai/attack-research/attack-blogs/cve-2025-34508-another-file-sharing-application-another-path-traversal/; https://www.vulncheck.com/advisories/zendto-path-traversal
CVE: CVE-2025-39479
Published: 2025-06-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in smartiolabs Smart Notification allows Blind SQL Injection. This issue affects Smart Notification: from n/a through 10.3.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/wordpress/plugin/smio-push-notification/vulnerability/wordpress-smart-notification-plugin-10-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-39486
Published: 2025-06-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Rankie valvepress-rankie allows SQL Injection.This issue affects Rankie: from n/a through < 1.8.2.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/valvepress-rankie/vulnerability/wordpress-rankie-plugin-1-8-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-39508
Published: 2025-06-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Nasa Core nasa-core allows Reflected XSS.This issue affects Nasa Core: from n/a through <= 6.4.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/nasa-core/vulnerability/wordpress-nasa-core-plugin-6-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47452
Published: 2025-06-17
Description: Unrestricted Upload of File with Dangerous Type vulnerability in RexTheme WP VR wpvr allows Upload a Web Shell to a Web Server.This issue affects WP VR: from n/a through <= 8.5.26.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/wpvr/vulnerability/wordpress-wp-vr-8-5-26-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-47559
Published: 2025-06-17
Description: Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through < 8.7.4.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/mapsvg/vulnerability/wordpress-mapsvg-plugin-8-5-32-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-47572
Published: 2025-06-17
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla School Management allows PHP Local File Inclusion. This issue affects School Management: from n/a through 93.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/wordpress/plugin/school-management/vulnerability/wordpress-school-management-93-0-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-47573
Published: 2025-06-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla School Management allows Blind SQL Injection. This issue affects School Management: from n/a through 92.0.0.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/wordpress/plugin/school-management/vulnerability/wordpress-school-management-system-plugin-92-0-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-48111
Published: 2025-06-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH PayPal Express Checkout for WooCommerce allows Cross Site Request Forgery. This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.49.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/wordpress/plugin/yith-paypal-express-checkout-for-woocommerce/vulnerability/wordpress-yith-paypal-express-checkout-for-woocommerce-plugin-1-49-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-48118
Published: 2025-06-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpExperts Hub Woocommerce Partial Shipment wc-partial-shipment allows SQL Injection.This issue affects Woocommerce Partial Shipment: from n/a through <= 3.2.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wc-partial-shipment/vulnerability/wordpress-woocommerce-partial-shipment-3-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-48145
Published: 2025-06-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michal Jaworski Track, Analyze & Optimize by WP Tao wp-tao allows Reflected XSS.This issue affects Track, Analyze & Optimize by WP Tao: from n/a through <= 1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-tao/vulnerability/wordpress-track-analyze-optimize-by-wp-tao-plugin-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48274
Published: 2025-06-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpjobportal WP Job Portal wp-job-portal allows Blind SQL Injection.This issue affects WP Job Portal: from n/a through <= 2.3.2.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-job-portal/vulnerability/wordpress-wp-job-portal-2-3-2-sql-injection-vulnerability?_s_id=cve