deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-4997
Published: 2025-05-20
Description: A vulnerability, which was classified as problematic, was found in H3C R2+ProG up to 200R004. Affected is the function UpdateWanParams/AddMacList/EditMacList/AddWlanMacList/EditWlanMacList/Edit_BasicSSID/Edit_GuestSSIDFor2P4G/Edit_BasicSSID_5G/SetAPInfoById of the file /goform/aspForm of the component HTTP POST Request Handler. The manipulation of the argument param leads to denial of service. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404
References: https://github.com/CH13hh/tmp_store_cc/blob/main/H3C%20R2%2BProG/1.md; https://vuldb.com/?ctiid.309648; https://vuldb.com/?id.309648
CVE: CVE-2025-44880
Published: 2025-05-20
Description: A command injection vulnerability in the component /cgi-bin/adm.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://lafdrew.github.io/2025/03/27/Remote-Command-Execution-in-adm-cgi-of-wavlink-WL-WN579A3-Device/
CVE: CVE-2025-44882
Published: 2025-05-20
Description: A command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://lafdrew.github.io/2025/03/31/Remote-Command-Execution-in-firewall-cgi-of-wavlink-WL-WN579A3-Device/
CVE: CVE-2025-44883
Published: 2025-05-20
Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the tacIp parameter in the web_tacplus_serverEdit_post function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://lafdrew.github.io/2025/04/20/web-tacplus-serverEdit-post-tacIp/
CVE: CVE-2025-44891
Published: 2025-05-20
Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the host_ip parameter in the web_snmp_v3host_add_post function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://lafdrew.github.io/2025/04/20/web-snmp-v3host-add-post-host-ip/
CVE: CVE-2025-44894
Published: 2025-05-20
Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the radDftParamKey parameter in the web_radiusSrv_dftParam_post function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://lafdrew.github.io/2025/04/20/web-radiusSrv-dftParam-post-radDftParamKey/
CVE: CVE-2025-44896
Published: 2025-05-20
Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the bindEditMACName parameter in the web_acl_bindEdit_post function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://lafdrew.github.io/2025/04/18/web-acl-bindEdit-post-bindEditMACName-StackOverflow/
CVE: CVE-2025-44897
Published: 2025-05-20
Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the bytftp_srvip parameter in the web_tool_upgradeManager_post function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://lafdrew.github.io/2025/04/20/web-tool-upgradeManager-post-tftp-srvip/
CVE: CVE-2025-44898
Published: 2025-05-20
Description: FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the theauthName parameter in the web_aaa_loginAuthlistEdit function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://lafdrew.github.io/2025/04/18/web-aaa-loginAuthlistEdit-get-authName-StackOverflow/
CVE: CVE-2025-4998
Published: 2025-05-20
Description: A vulnerability has been found in H3C Magic R200G up to 100R002 and classified as problematic. Affected by this vulnerability is the function Edit_BasicSSID/Edit_BasicSSID_5G/SetAPWifiorLedInfoById/SetMobileAPInfoById/Asp_SetTimingtimeWifiAndLed/AddMacList/EditMacList/AddWlanMacList/EditWlanMacList of the file /goform/aspForm of the component HTTP POST Request Handler. The manipulation of the argument param leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404
References: https://github.com/CH13hh/tmp_store_cc/blob/main/H3C%20Magic%20R200G/1.md; https://vuldb.com/?ctiid.309649; https://vuldb.com/?id.309649
CVE: CVE-2025-4999
Published: 2025-05-20
Description: A vulnerability was found in Linksys FGW3000-AH and FGW3000-HK up to 1.0.17.000000 and classified as critical. Affected by this issue is the function sub_4153FC of the file /cgi-bin/sysconf.cgi of the component HTTP POST Request Handler. The manipulation of the argument supplicant_rnd_id_en leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/CH13hh/tmp_store_cc/blob/main/FGW3000/1.md; https://vuldb.com/?ctiid.309650; https://vuldb.com/?id.309650
CVE: CVE-2025-5000
Published: 2025-05-20
Description: A vulnerability was found in Linksys FGW3000-AH and FGW3000-HK up to 1.0.17.000000. It has been classified as critical. This affects the function control_panel_sw of the file /cgi-bin/sysconf.cgi of the component HTTP POST Request Handler. The manipulation of the argument filename leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/CH13hh/tmp_store_cc/blob/main/FGW3000/2.md; https://vuldb.com/?ctiid.309651; https://vuldb.com/?id.309651
CVE: CVE-2025-5001
Published: 2025-05-20
Description: A vulnerability was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. It has been declared as problematic. This vulnerability affects the function calloc of the file pspp-convert.c. The manipulation of the argument -l leads to integer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-189, CWE-190, CWE-190
References: https://drive.google.com/file/d/12IIt8eR591Z8O1ABOCkT_jdXSWaBxMZx/view?usp=drive_link; https://savannah.gnu.org/bugs/index.php?67069; https://vuldb.com/?ctiid.309652
CVE: CVE-2025-5002
Published: 2025-05-20
Description: A vulnerability, which was classified as critical, was found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_proposal_update_order.php. The manipulation of the argument order_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/laifeng-boy/cve/issues/5; https://vuldb.com/?ctiid.309657; https://vuldb.com/?id.309657
CVE: CVE-2025-5003
Published: 2025-05-20
Description: A vulnerability has been found in projectworlds Online Time Table Generator 1.0 and classified as critical. This vulnerability affects unknown code of the file /semester_ajax.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/huangyi234/CVE/issues/4; https://vuldb.com/?ctiid.309658; https://vuldb.com/?id.309658
CVE: CVE-2025-4436
Published: 2025-05-20
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-5004
Published: 2025-05-20
Description: A vulnerability was found in projectworlds Online Time Table Generator 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/add_course.php. The manipulation of the argument c/subname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/huangyi234/CVE/issues/8; https://vuldb.com/?ctiid.309659; https://vuldb.com/?id.309659
CVE: CVE-2025-5006
Published: 2025-05-20
Description: A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/category.php. The manipulation of the argument Category leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Zhaozhizhi/CVE/issues/3; https://vuldb.com/?ctiid.309660; https://vuldb.com/?id.309660
CVE: CVE-2025-5007
Published: 2025-05-20
Description: A vulnerability was found in Part-DB up to 1.17.0. It has been declared as problematic. Affected by this vulnerability is the function handleUpload of the file src/Services/Attachments/AttachmentSubmitHandler.php of the component Profile Picture Feature. The manipulation of the argument attachment leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.17.1 is able to address this issue. The identifier of the patch is 2c4f44e808500db19c391159b30cb6142896d415. It is recommended to upgrade the affected component.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/Part-DB/Part-DB-server/commit/2c4f44e808500db19c391159b30cb6142896d415; https://github.com/Part-DB/Part-DB-server/releases/tag/v1.17.1; https://github.com/b1d0ws/CVEs/blob/main/CVE-2025-XXXX.md
CVE: CVE-2025-5008
Published: 2025-05-20
Description: A vulnerability was found in projectworlds Online Time Table Generator 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/add_teacher.php. The manipulation of the argument e leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/hhhanxx/attack/issues/18; https://vuldb.com/?ctiid.309662; https://vuldb.com/?id.309662
CVE: CVE-2025-5010
Published: 2025-05-21
Description: A vulnerability classified as problematic has been found in moonlightL hexo-boot 4.3.0. This affects an unknown part of the file /admin/home/index.html of the component Blog Backend. The manipulation of the argument Description leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/trengh222/hexo-boot-xss1.0/blob/yhtt/README.md; https://vuldb.com/?ctiid.309663; https://vuldb.com/?id.309663
CVE: CVE-2025-5011
Published: 2025-05-21
Description: A vulnerability classified as problematic was found in moonlightL hexo-boot 4.3.0. This vulnerability affects unknown code of the file /admin/home/index.html of the component Dynamic List Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/trengh222/hexo-boot-xss2.0; https://vuldb.com/?ctiid.309664; https://vuldb.com/?id.309664
CVE: CVE-2025-4094
Published: 2025-05-21
Description: The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for attackers to bruteforce them.
CVSS Score: 9.8 (CRITICAL)
References: https://wpscan.com/vulnerability/b5f0a263-644b-4954-a1f0-d08e2149edbb/
CVE: CVE-2025-4969
Published: 2025-05-21
Description: A vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the termination of multipart HTTP messages. This can allow a remote attacker to send a specially crafted multipart HTTP body, causing the libsoup-consuming server to read beyond its allocated memory boundaries (out-of-bounds read).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://access.redhat.com/security/cve/CVE-2025-4969; https://bugzilla.redhat.com/show_bug.cgi?id=2367552; https://gitlab.gnome.org/GNOME/libsoup/-/issues/447
CVE: CVE-2025-5013
Published: 2025-05-21
Description: A vulnerability, which was classified as problematic, was found in HkCms up to 2.3.2.240702. This affects an unknown part of the file /index.php/search/index.html of the component Search. The manipulation of the argument keyword leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://gitee.com/Hk_Cms/HkCms/issues/IBZ2G7; https://vuldb.com/?ctiid.309729; https://vuldb.com/?id.309729
CVE: CVE-2021-25254
Published: 2025-05-21
Description: Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-116
References: https://yandex.com/bugbounty/i/hall-of-fame-browser/
CVE: CVE-2021-25255
Published: 2025-05-21
Description: Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://yandex.com/bugbounty/i/hall-of-fame-browser/
CVE: CVE-2021-25262
Published: 2025-05-21
Description: Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-116
References: https://yandex.com/bugbounty/i/hall-of-fame-browser/
CVE: CVE-2025-4524
Published: 2025-05-21
Description: The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.2 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://mangabooth.com/product/wp-manga-theme-madara/; https://www.wordfence.com/threat-intel/vulnerabilities/id/a3ee01da-218a-421d-8f9c-1dc6c056ef74?source=cve; https://www.exploit-db.com/exploits/52487
CVE: CVE-2025-4949
Published: 2025-05-21
Description: In Eclipse JGit versions 7.2.0[PII_REDACTED]40-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-611, CWE-827, CWE-611
References: https://gitlab.eclipse.org/security/cve-assignement/-/issues/64; https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281; https://projects.eclipse.org/projects/technology.jgit/releases/5.13.4
CVE: CVE-2019-16536
Published: 2025-05-21
Description: Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://clickhouse.com/docs/whats-new/security-changelog
CVE: CVE-2025-1712
Published: 2025-05-21
Description: Argument injection in special agent configuration in Checkmk <2.4.0p1, <2.3.0p32, <2.2.0p42 and 2.1.0 allows authenticated attackers to write arbitrary files
CVSS Score: 8.8 (HIGH)
CWE: CWE-88
References: https://checkmk.com/werk/17996
CVE: CVE-2024-12561
Published: 2025-05-21
Description: The Affiliate Sales in Google Analytics and other tools plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.0.0. This is due to insufficient validation on the redirect url supplied via the 'afflink' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://plugins.trac.wordpress.org/browser/wecantrack/trunk/WecantrackApp.php#L66; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3320552%40wecantrack&new=3320552%40wecantrack&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/a4b205ab-f042-46d9-a331-f[PII_REDACTED]?source=cve
CVE: CVE-2025-1415
Published: 2025-05-21
Description: A low-privileged user is able to obtain information about tasks executed on devices controlled by Proget MDM (Mobile Device Management), as well as details of the devices like their UUIDs needed for exploitation of CVE-2025-1416.

In order to perform the attack, one has to know a task_id, but since it's a low integer and there is no limit of requests an attacker can perform to a vulnerable endpoint, the task_id might be simply brute forced.

This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
CWE: CWE-863
References: https://cert.pl/en/posts/2025/05/CVE-2025-1415; https://proget.pl/en/mobile-device-management/
CVE: CVE-2025-27803
Published: 2025-05-21
Description: The devices do not implement any authentication for the web interface or the MQTT server. An attacker who has network access to the device immediately gets administrative access to the devices and can perform arbitrary administrative actions and reconfigure the devices or potentially gain access to sensitive data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: https://r.sec-consult.com/echarge; http://seclists.org/fulldisclosure/2025/May/23
CVE: CVE-2025-27804
Published: 2025-05-21
Description: Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially crafted message to a certain MQTT topic arbitrary OS commands can be executed with root permissions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78
References: https://r.sec-consult.com/echarge; http://seclists.org/fulldisclosure/2025/May/23
CVE: CVE-2025-3750
Published: 2025-05-21
Description: The Network Posts Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘post_height’ parameter in all versions up to, and including, 7.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/network-posts-extended/trunk/network-posts-extended.php#L663; https://wordpress.org/plugins/network-posts-extended/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/64a15397-0bd6-4be9-90e3-6cb1f56394ad?source=cve
CVE: CVE-2025-3781
Published: 2025-05-21
Description: The Raisely Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's raisely_donation_form shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/raisely-donation-form/trunk/inc/base/providers/shortcodes.php#L46; https://plugins.trac.wordpress.org/changeset/3302489/; https://wordpress.org/plugins/raisely-donation-form/#developers
CVE: CVE-2025-41232
Published: 2025-05-21
Description: Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass.

Your application may be affected by this if the following are true:

  *  You are using @EnableMethodSecurity(mode=ASPECTJ) and spring-security-aspects, and
  *  You have Spring Security method annotations on a private method
In that case, the target method may be able to be invoked without proper authorization.

You are not affected if:

  *  You are not using @EnableMethodSecurity(mode=ASPECTJ) or spring-security-aspects, or
  *  You have no Spring Security-annotated private methods
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-693
References: http://spring.io/security/cve-2025-41232
CVE: CVE-2025-48413
Published: 2025-05-21
Description: The `/etc/passwd` and `/etc/shadow` files reveal hard-coded password hashes for the operating system "root" user. The credentials are shipped with the update files. There is no option for deleting or changing their passwords for an enduser. An attacker can use the credentials to log into the device. Authentication can be performed via SSH backdoor or likely via physical access (UART shell).
CVSS Score: 7.7 (HIGH)
CWE: CWE-798
References: https://r.sec-consult.com/echarge; http://seclists.org/fulldisclosure/2025/May/23
CVE: CVE-2025-48414
Published: 2025-05-21
Description: There are several scripts in the web interface that are accessible via undocumented hard-coded credentials. The scripts provide access to additional administrative/debug functionality and are likely intended for debugging during development and provides an additional attack surface.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-798
References: https://r.sec-consult.com/echarge; http://seclists.org/fulldisclosure/2025/May/23
CVE: CVE-2025-4105
Published: 2025-05-21
Description: The Splitit plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions in the 'splitIt-flexfields-payment-gateway.php' file in all versions up to, and including, 4.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change plugin settings, including changing the environment from sandbox to production and vice versa.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/splitit-installment-payments/tags/4.2.6/splitIt-flexfields-payment-gateway.php#L1927; https://plugins.trac.wordpress.org/browser/splitit-installment-payments/tags/4.2.6/splitIt-flexfields-payment-gateway.php#L765; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3297893%40splitit-installment-payments&new=3297893%40splitit-installment-payments&sfp_email=&sfph_mail=
CVE: CVE-2025-4217
Published: 2025-05-21
Description: The WP YouTube Video Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ib_youtube' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-youtube-video-optimizer/trunk/wp-youtube-video-optimizer.php#L20; https://www.wordfence.com/threat-intel/vulnerabilities/id/71a933ef-f49d-4520-90d5-9957f72d7452?source=cve