deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-58667
Published: 2025-09-22
Description: Missing Authorization vulnerability in CridioStudio ListingPro Reviews listingpro-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro Reviews: from n/a through < 2.9.11.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/listingpro-reviews/vulnerability/wordpress-listingpro-reviews-plugin-1-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58668
Published: 2025-09-22
Description: Missing Authorization vulnerability in VibeThemes WPLMS  wplms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLMS : from n/a through <= 4.970.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/wplms/vulnerability/wordpress-wplms-theme-4-970-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58669
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modern Minds Magento 2 WordPress Integration m2wp allows Stored XSS.This issue affects Magento 2 WordPress Integration: from n/a through <= 1.4.2.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/m2wp/vulnerability/wordpress-magento-2-wordpress-integration-plugin-1-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58670
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Shankaranand Maurya WP Content Protection wp-content-protection allows Stored XSS.This issue affects WP Content Protection: from n/a through <= 1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-content-protection/vulnerability/wordpress-wp-content-protection-plugin-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58671
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in morganrichards Auction Feed auction-feed allows Stored XSS.This issue affects Auction Feed: from n/a through <= 1.1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/auction-feed/vulnerability/wordpress-auction-feed-plugin-1-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58672
Published: 2025-09-22
Description: Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through <= 4.1.12.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-user-frontend/vulnerability/wordpress-wp-user-frontend-plugin-4-1-11-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58673
Published: 2025-09-22
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in weDevs WP User Frontend wp-user-frontend allows Code Injection.This issue affects WP User Frontend: from n/a through <= 4.1.12.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/wp-user-frontend/vulnerability/wordpress-wp-user-frontend-plugin-4-1-11-content-injection-vulnerability?_s_id=cve
CVE: CVE-2025-58675
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in tryinteract Interact: Embed A Quiz On Your Site interact-quiz-embed allows Cross Site Request Forgery.This issue affects Interact: Embed A Quiz On Your Site: from n/a through <= 3.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/interact-quiz-embed/vulnerability/wordpress-interact-embed-a-quiz-on-your-site-plugin-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58676
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in extendyourweb HORIZONTAL SLIDER horizontal-slider allows Stored XSS.This issue affects HORIZONTAL SLIDER: from n/a through <= 2.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/horizontal-slider/vulnerability/wordpress-horizontal-slider-plugin-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58677
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in puravida1976 ShrinkTheWeb (STW) Website Previews shrinktheweb-website-preview-plugin allows Stored XSS.This issue affects ShrinkTheWeb (STW) Website Previews: from n/a through <= 2.8.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/shrinktheweb-website-preview-plugin/vulnerability/wordpress-shrinktheweb-stw-website-previews-plugin-2-8-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58678
Published: 2025-09-22
Description: Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.15.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/accordions/vulnerability/wordpress-accordion-plugin-2-3-14-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58679
Published: 2025-09-22
Description: Missing Authorization vulnerability in AppMySite AppMySite appmysite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AppMySite: from n/a through <= 3.15.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/appmysite/vulnerability/wordpress-appmysite-plugin-3-14-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58680
Published: 2025-09-22
Description: Missing Authorization vulnerability in gutentor Gutentor gutentor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutentor: from n/a through <= 3.5.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/gutentor/vulnerability/wordpress-gutentor-plugin-3-5-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58681
Published: 2025-09-22
Description: Missing Authorization vulnerability in Jürgen Müller Easy Quotes easy-quotes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Quotes: from n/a through <= 1.2.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/easy-quotes/vulnerability/wordpress-easy-quotes-plugin-1-2-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58682
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timur Kamaev Kama Click Counter kama-clic-counter allows Stored XSS.This issue affects Kama Click Counter: from n/a through <= 4.0.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/kama-clic-counter/vulnerability/wordpress-kama-click-counter-plugin-4-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58683
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Luke Mlsna Last Updated Shortcode last-updated-shortcode allows Stored XSS.This issue affects Last Updated Shortcode: from n/a through <= 1.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/last-updated-shortcode/vulnerability/wordpress-last-updated-shortcode-plugin-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58684
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Logo Showcase logo-showcase allows Stored XSS.This issue affects Logo Showcase: from n/a through <= 4.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/logo-showcase/vulnerability/wordpress-logo-showcase-plugin-3-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58685
Published: 2025-09-22
Description: Missing Authorization vulnerability in cecabank Cecabank WooCommerce Plugin cecabank-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cecabank WooCommerce Plugin: from n/a through <= 0.3.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/cecabank-woocommerce/vulnerability/wordpress-cecabank-woocommerce-plugin-plugin-0-3-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58686
Published: 2025-09-22
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quadlayers Perfect Brands for WooCommerce perfect-woocommerce-brands allows SQL Injection.This issue affects Perfect Brands for WooCommerce: from n/a through <= 3.6.2.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/perfect-woocommerce-brands/vulnerability/wordpress-perfect-brands-for-woocommerce-plugin-3-6-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-58687
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP CMS Ninja Current Age Plugin current-age allows Stored XSS.This issue affects Current Age Plugin: from n/a through <= 1.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/current-age/vulnerability/wordpress-current-age-plugin-plugin-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58688
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Casengo Casengo Live Chat Support the-casengo-chat-widget allows Stored XSS.This issue affects Casengo Live Chat Support: from n/a through <= 2.1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/the-casengo-chat-widget/vulnerability/wordpress-casengo-live-chat-support-plugin-2-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58689
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tapfiliate Tapfiliate tapfiliate allows Stored XSS.This issue affects Tapfiliate: from n/a through <= 3.2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/tapfiliate/vulnerability/wordpress-tapfiliate-plugin-3-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58690
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in ptibogxiv Doliconnect doliconnect allows Stored XSS.This issue affects Doliconnect: from n/a through <= 9.5.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/doliconnect/vulnerability/wordpress-doliconnect-plugin-9-5-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58691
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson Genesis Club Lite genesis-club-lite allows Stored XSS.This issue affects Genesis Club Lite: from n/a through <= 1.17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/genesis-club-lite/vulnerability/wordpress-genesis-club-lite-plugin-1-17-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58702
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebWizards MarketKing marketking-multivendor-marketplace-for-woocommerce allows Stored XSS.This issue affects MarketKing: from n/a through <= 2.0.92.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/marketking-multivendor-marketplace-for-woocommerce/vulnerability/wordpress-marketking-plugin-2-0-92-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58703
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skyword Skyword API Plugin skyword-plugin allows Stored XSS.This issue affects Skyword API Plugin: from n/a through <= 2.5.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/skyword-plugin/vulnerability/wordpress-skyword-api-plugin-plugin-2-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58704
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ren Ventura WP Delete User Accounts wp-delete-user-accounts allows Stored XSS.This issue affects WP Delete User Accounts: from n/a through <= 1.2.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-delete-user-accounts/vulnerability/wordpress-wp-delete-user-accounts-plugin-1-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58956
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Attractive Donations System wp-attractive-donations-system-easy-stripe-paypal-donations allows Stored XSS.This issue affects WP Attractive Donations System: from n/a through < 1.29.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-attractive-donations-system-easy-stripe-paypal-donations/vulnerability/wordpress-wp-attractive-donations-system-plugin-1-29-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58957
Published: 2025-09-22
Description: Missing Authorization vulnerability in Vikas Ratudi VPSUForm v-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VPSUForm: from n/a through <= 3.2.20.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/v-form/vulnerability/wordpress-vpsuform-plugin-3-2-20-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58960
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brijeshk89 IP Based Login ip-based-login allows Stored XSS.This issue affects IP Based Login: from n/a through <= 2.4.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ip-based-login/vulnerability/wordpress-ip-based-login-plugin-2-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58962
Published: 2025-09-22
Description: Server-Side Request Forgery (SSRF) vulnerability in publitio Publitio publitio allows Server Side Request Forgery.This issue affects Publitio: from n/a through <= 2.2.1.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/publitio/vulnerability/wordpress-publitio-plugin-2-2-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-58965
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agency Dominion Inc. Fusion Page Builder : Extension – Gallery fusion-extension-gallery allows Stored XSS.This issue affects Fusion Page Builder : Extension – Gallery: from n/a through <= 1.7.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/fusion-extension-gallery/vulnerability/wordpress-fusion-page-builder-extension-gallery-plugin-1-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58968
Published: 2025-09-22
Description: Missing Authorization vulnerability in Christiaan Pieterse MaxiBlocks maxi-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MaxiBlocks: from n/a through <= 2.1.3.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/maxi-blocks/vulnerability/wordpress-maxiblocks-plugin-2-1-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58969
Published: 2025-09-22
Description: Missing Authorization vulnerability in Greg Winiarski Custom Login URL custom-login-url allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Login URL: from n/a through <= 1.0.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/custom-login-url/vulnerability/wordpress-custom-login-url-plugin-1-0-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58973
Published: 2025-09-22
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows PHP Local File Inclusion.This issue affects Easy Elementor Addons: from n/a through <= 2.2.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/easy-elementor-addons/vulnerability/wordpress-easy-elementor-addons-plugin-2-2-8-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-58974
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through <= 2.9.5.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpcomplete/vulnerability/wordpress-wpcomplete-plugin-2-9-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58992
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode Product Catalog Simple post-type-x allows Stored XSS.This issue affects Product Catalog Simple: from n/a through <= 1.8.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/post-type-x/vulnerability/wordpress-product-catalog-simple-plugin-1-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-59430
Published: 2025-09-22
Description: Mesh Connect JS SDK contains JS libraries for integrating with Mesh Connect. Prior to version 3.3.2, the lack of sanitization of URLs protocols in the createLink.openLink function enables the execution of arbitrary JavaScript code within the context of the parent page. This is technically indistinguishable from a real page at the rendering level and allows access to the parent page DOM, storage, session, and cookies. If the attacker can specify customIframeId, they can hijack the source of existing iframes. This issue has been patched in version 3.3.2.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: https://github.com/FrontFin/mesh-web-sdk/blob/cf013b85ab95d64c63cbe46d6cb[PII_REDACTED]e7/packages/link/src/Link.ts#L441; https://github.com/FrontFin/mesh-web-sdk/commit/7f22148516d58e21a8b7670dde927d614c0d15c2; https://github.com/FrontFin/mesh-web-sdk/pull/124
CVE: CVE-2025-59549
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps GetResponse Forms getresponse allows Stored XSS.This issue affects GetResponse Forms: from n/a through <= 2.6.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/getresponse/vulnerability/wordpress-getresponse-forms-plugin-2-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-59551
Published: 2025-09-22
Description: Missing Authorization vulnerability in WP Chill Revive.so revive-so allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Revive.so: from n/a through <= 2.0.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/revive-so/vulnerability/wordpress-revive-so-plugin-2-0-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-59552
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pdfcrowd Dev Team Save as PDF save-as-pdf-by-pdfcrowd allows Stored XSS.This issue affects Save as PDF: from n/a through <= 4.5.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/save-as-pdf-by-pdfcrowd/vulnerability/wordpress-save-as-pdf-plugin-4-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-59553
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Coderz Studio Custom iFrame for Elementor custom-iframe allows DOM-Based XSS.This issue affects Custom iFrame for Elementor: from n/a through <= 1.0.13.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/custom-iframe/vulnerability/wordpress-custom-iframe-for-elementor-plugin-1-0-13-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-59559
Published: 2025-09-22
Description: Missing Authorization vulnerability in payrexx Payrexx Payment Gateway for WooCommerce woo-payrexx-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payrexx Payment Gateway for WooCommerce: from n/a through <= 3.1.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/woo-payrexx-gateway/vulnerability/wordpress-payrexx-payment-gateway-for-woocommerce-plugin-3-1-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-59561
Published: 2025-09-22
Description: Missing Authorization vulnerability in hashthemes Smart Blocks smart-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Blocks: from n/a through <= 2.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/smart-blocks/vulnerability/wordpress-smart-blocks-plugin-2-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-59562
Published: 2025-09-22
Description: Authorization Bypass Through User-Controlled Key vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Academy LMS: from n/a through <= 3.3.4.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/Wordpress/Plugin/academy/vulnerability/wordpress-academy-lms-plugin-3-3-4-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2025-59565
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Stored XSS.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through <= 3.0.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/upsell-order-bump-offer-for-woocommerce/vulnerability/wordpress-upsell-order-bump-offer-for-woocommerce-plugin-3-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-59567
Published: 2025-09-22
Description: Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coupon Affiliates: from n/a through <= 6.8.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/woo-coupon-usage/vulnerability/wordpress-coupon-affiliates-plugin-6-8-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-59568
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Zoho Flow Zoho Flow zoho-flow allows Cross Site Request Forgery.This issue affects Zoho Flow: from n/a through <= 2.14.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/zoho-flow/vulnerability/wordpress-zoho-flow-plugin-2-14-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve