deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-43469
Published: 2025-11-04
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-359
References: https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635; https://support.apple.com/en-us/125636
CVE: CVE-2025-43472
Published: 2025-11-04
Description: A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635; https://support.apple.com/en-us/125636
CVE: CVE-2025-43474
Published: 2025-11-04
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to cause unexpected system termination or read kernel memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635; https://support.apple.com/en-us/125636
CVE: CVE-2025-43476
Published: 2025-11-04
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to break out of its sandbox.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635; https://support.apple.com/en-us/125636
CVE: CVE-2025-43477
Published: 2025-11-04
Description: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635; https://support.apple.com/en-us/125636
CVE: CVE-2025-43478
Published: 2025-11-04
Description: A use after free issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to cause unexpected system termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635; https://support.apple.com/en-us/125636
CVE: CVE-2025-43479
Published: 2025-11-04
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635; https://support.apple.com/en-us/125636
CVE: CVE-2025-43480
Published: 2025-11-04
Description: The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious website may exfiltrate data cross-origin.
CVSS Score: 8.1 (HIGH)
CWE: CWE-942
References: https://support.apple.com/en-us/125632; https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125637
CVE: CVE-2025-43481
Published: 2025-11-04
Description: This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to break out of its sandbox.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635
CVE: CVE-2025-43493
Published: 2025-11-04
Description: The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1. Visiting a malicious website may lead to address bar spoofing.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-290
References: https://support.apple.com/en-us/125632; https://support.apple.com/en-us/125633; https://support.apple.com/en-us/125634
CVE: CVE-2025-43495
Published: 2025-11-04
Description: The issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1. An app may be able to monitor keystrokes without user permission.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://support.apple.com/en-us/125632; https://support.apple.com/en-us/125633
CVE: CVE-2025-43496
Published: 2025-11-04
Description: The issue was addressed by adding additional logic. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Remote content may be loaded even when the 'Load Remote Images' setting is turned off.
CVSS Score: 7.5 (HIGH)
CWE: CWE-359
References: https://support.apple.com/en-us/125632; https://support.apple.com/en-us/125633; https://support.apple.com/en-us/125634
CVE: CVE-2025-43498
Published: 2025-11-04
Description: An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, visionOS 26.1. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/125632; https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635
CVE: CVE-2025-43499
Published: 2025-11-04
Description: This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/125633; https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125635
CVE: CVE-2025-43500
Published: 2025-11-04
Description: A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. An app may be able to access sensitive user data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-359
References: https://support.apple.com/en-us/125632; https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125638
CVE: CVE-2025-43502
Published: 2025-11-04
Description: A privacy issue was addressed by removing sensitive data. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1. An app may be able to bypass certain Privacy preferences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://support.apple.com/en-us/125632; https://support.apple.com/en-us/125634; https://support.apple.com/en-us/125638
CVE: CVE-2025-43503
Published: 2025-11-04
Description: An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Visiting a malicious website may lead to user interface spoofing.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-290
References: https://support.apple.com/en-us/125632; https://support.apple.com/en-us/125633; https://support.apple.com/en-us/125634
CVE: CVE-2025-43504
Published: 2025-11-04
Description: A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privileged network position may be able to cause a denial-of-service.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-119
References: https://support.apple.com/en-us/125641
CVE: CVE-2025-43505
Published: 2025-11-04
Description: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/125641
CVE: CVE-2025-43507
Published: 2025-11-04
Description: A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. An app may be able to fingerprint the user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: https://support.apple.com/en-us/125632; https://support.apple.com/en-us/125633; https://support.apple.com/en-us/125634
CVE: CVE-2025-11841
Published: 2025-11-04
Description: The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Chart Data attributes in all versions up to, and including, 12.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3386004/; https://www.wordfence.com/threat-intel/vulnerabilities/id/ee2455fb-69b9-4dbc-9c59-fd2cdd5b4d0f?source=cve
CVE: CVE-2025-12324
Published: 2025-11-04
Description: The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `table` shortcode attributes in all versions up to, and including, 3.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/tablepress/tags/3.2.4/controllers/controller-frontend.php#L605; https://www.wordfence.com/threat-intel/vulnerabilities/id/4dbd8cac-9e4b-4353-9c62-9cabb60b927c?source=cve
CVE: CVE-2025-11007
Published: 2025-11-04
Description: The CE21 Suite plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the wp_ajax_nopriv_ce21_single_sign_on_save_api_settings AJAX action in versions 2.2.1 to 2.3.1. This makes it possible for unauthenticated attackers to update the plugin's API settings including a secret key used for authentication. This allows unauthenticated attackers to create new admin accounts on an affected site.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://wordpress.org/plugins/ce21-suite/; https://www.wordfence.com/threat-intel/vulnerabilities/id/5e24feac-1812-45d7-b3c3-27787eed1cf1?source=cve
CVE: CVE-2025-11008
Published: 2025-11-04
Description: The CE21 Suite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.1 via the log file. This makes it possible for unauthenticated attackers to extract sensitive data including authentication credentials, which can be used to log in as other users as long as they have used the plugin's custom authentication feature before. This may include administrators, which makes a complete site takeover possible.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-532
References: https://wordpress.org/plugins/ce21-suite/; https://www.wordfence.com/threat-intel/vulnerabilities/id/91aa86d9-8e42-4deb-b6ca-c3b388fefcb1?source=cve
CVE: CVE-2025-12069
Published: 2025-11-04
Description: The WP Global Screen Options plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing nonce validation on the `updatewpglobalscreenoptions` action handler. This makes it possible for unauthenticated attackers to modify global screen options for all users via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/wp-global-screen-options/tags/0.2/wp_global_screen_options.php#L16; https://www.wordfence.com/threat-intel/vulnerabilities/id/dae86d7c-3bbb-4872-acd7-08ff8d437b8e?source=cve
CVE: CVE-2025-12070
Published: 2025-11-04
Description: The ViaAds plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.2. This is due to missing nonce validation on the `ViaAds_pluginHandler` function. This makes it possible for unauthenticated attackers to modify the plugin's API key and cookie consent settings via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/viaads/tags/2.1.1/apikey.php#L81; https://plugins.trac.wordpress.org/changeset/3395777/; https://www.wordfence.com/threat-intel/vulnerabilities/id/00f65117-e8f7-41d8-bdf4-c1fab03e4792?source=cve
CVE: CVE-2025-12401
Published: 2025-11-04
Description: The Label Plugins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing or incorrect nonce validation on the label_plugins_options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/label-plugins/tags/0.5/lp_admin_page.php#L35; https://plugins.trac.wordpress.org/browser/label-plugins/tags/0.5/lp_admin_page.php#L37; https://plugins.trac.wordpress.org/browser/label-plugins/tags/0.5/lp_admin_page.php#L70
CVE: CVE-2025-27064
Published: 2025-11-04
Description: Information disclosure while registering commands from clients with diag through diagHal.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2025-bulletin.html
CVE: CVE-2025-27070
Published: 2025-11-04
Description: Memory corruption while performing encryption and decryption commands.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2025-bulletin.html
CVE: CVE-2025-27074
Published: 2025-11-04
Description: Memory corruption while processing a GP command response.
CVSS Score: 8.8 (HIGH)
CWE: CWE-131
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2025-bulletin.html
CVE: CVE-2025-47352
Published: 2025-11-04
Description: Memory corruption while processing audio streaming operations.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2025-bulletin.html
CVE: CVE-2025-47353
Published: 2025-11-04
Description: Memory corruption while processing request sent from GVM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-749
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2025-bulletin.html
CVE: CVE-2025-47357
Published: 2025-11-04
Description: Information Disclosure when a user-level driver performs QFPROM read or write operations on Fuse regions.
CVSS Score: 8.0 (HIGH)
CWE: CWE-306
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2025-bulletin.html
CVE: CVE-2025-47360
Published: 2025-11-04
Description: Memory corruption while processing client message during device management.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2025-bulletin.html
CVE: CVE-2025-47361
Published: 2025-11-04
Description: Memory corruption when triggering a subsystem crash with an out-of-range identifier.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2025-bulletin.html
CVE: CVE-2025-47362
Published: 2025-11-04
Description: Information disclosure while processing message from client with invalid payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2025-bulletin.html
CVE: CVE-2025-47365
Published: 2025-11-04
Description: Memory corruption while processing large input data from a remote source via a communication interface.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2025-bulletin.html
CVE: CVE-2025-47367
Published: 2025-11-04
Description: Memory corruption while accessing a buffer during IOCTL processing.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2025-bulletin.html
CVE: CVE-2025-47368
Published: 2025-11-04
Description: Memory corruption when dereferencing an invalid userspace address in a user buffer during MCDM IOCTL processing.
CVSS Score: 7.8 (HIGH)
CWE: CWE-126
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2025-bulletin.html
CVE: CVE-2025-47370
Published: 2025-11-04
Description: Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://docs.qualcomm.com/product/publicresources/securitybulletin/november-2025-bulletin.html
CVE: CVE-2025-10896
Published: 2025-11-04
Description: Multiple plugins for WordPress with the Jewel Theme Recommended Plugins Library are vulnerable to Unrestricted Upload of File with Dangerous Type via arbitrary plugin installation in all versions up to, and including, 1.0.2.3. This is due to missing capability checks on the '*_recommended_upgrade_plugin' function which allows arbitrary plugin URLs to be installed. This makes it possible for authenticated attackers with subscriber-level access and above to upload arbitrary plugin packages to the affected site's server via a crafted plugin URL, which may make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/image-hover-effects-elementor-addon/tags/1.0.2.3/Libs/Assets.php#L70; https://plugins.trac.wordpress.org/browser/image-hover-effects-elementor-addon/tags/1.0.2.3/Libs/Recommended.php#L334; https://plugins.trac.wordpress.org/browser/image-hover-effects-elementor-addon/tags/1.0.2.3/Libs/Recommended.php#L43
CVE: CVE-2025-11704
Published: 2025-11-04
Description: The Elegance Menu plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the 'elegance-menu' attribute of the `elegance-menu` shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://plugins.trac.wordpress.org/browser/elegance-menu/trunk/public/class-elegance-menu-public.php#L222; https://plugins.trac.wordpress.org/changeset/3409312/; https://wordpress.org/plugins/elegance-menu
CVE: CVE-2025-11724
Published: 2025-11-04
Description: The EM Beer Manager plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in all versions up to, and including, 3.2.3. This is due to missing file type validation in the EMBM_Admin_Untappd_Import_image() function and missing authorization checks on the wp_ajax_embm-untappd-import action. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files including PHP files and execute code on the server granted they can provide a mock HTTP server that responds with specific JSON data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/em-beer-manager/tags/3.2.3/includes/admin/embm-admin-actions.php#L393; https://plugins.trac.wordpress.org/browser/em-beer-manager/tags/3.2.3/includes/admin/integrations/embm-integrations-untappd.php#L867; https://plugins.trac.wordpress.org/browser/em-beer-manager/tags/3.2.3/includes/admin/integrations/embm-integrations-untappd.php#L899
CVE: CVE-2025-11733
Published: 2025-11-04
Description: The Footnotes Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 3.0.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/footnotes-made-easy/tags/3.0.7/footnotes-made-easy.php#L112; https://plugins.trac.wordpress.org/changeset/3388488/; https://www.wordfence.com/threat-intel/vulnerabilities/id/c6f6662f-1013-4de1-9091-1ac330260eed?source=cve
CVE: CVE-2025-11753
Published: 2025-11-04
Description: The Bootstrap Multi-language Responsive Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/bootstrap-multi-language-responsive-portfolio/trunk/wpt-posttype-portfolio.php; https://wordpress.org/plugins/bootstrap-multi-language-responsive-portfolio/; https://www.wordfence.com/threat-intel/vulnerabilities/id/e016213f-b06f-4a9d-a2c6-3b4dd1b6b571?source=cve
CVE: CVE-2025-11758
Published: 2025-11-04
Description: The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all versions up to, and including, 2.0.3. This is due  to the plugin exposing admin-level AJAX actions to unauthenticated users via wp_ajax_nopriv_ hooks, while relying only on a nonce check without capability checks. This makes it possible for  unauthenticated attackers to create published pages, create shift records with integrity issues, and download time reports containing PII (employee names and work schedules).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/aio-time-clock-lite/tags/2.0.1/aio-time-clock-lite-actions.php#L1447; https://plugins.trac.wordpress.org/browser/aio-time-clock-lite/tags/2.0.1/aio-time-clock-lite-actions.php#L26; https://plugins.trac.wordpress.org/browser/aio-time-clock-lite/tags/2.0.1/aio-time-clock-lite-actions.php#L442
CVE: CVE-2025-11812
Published: 2025-11-04
Description: The Reuse Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reuse_builder_single_post_title' shortcode in all versions up to, and including, 1.7. This is due to insufficient input sanitization and output escaping on the 'style' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/reuse-builder/tags/1.7/shortcodes/single_post_title.php#L24; https://wordpress.org/plugins/reuse-builder/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f796ade5-db48-4334-9a76-15326f62c9a5?source=cve