deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-13962
Published: 2025-12-12
Description: The Divelogs Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'latestdive' shortcode in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/divelogs-widget/tags/1.5/divelogs-widget.php#L51; https://plugins.trac.wordpress.org/browser/divelogs-widget/trunk/divelogs-widget.php#L51; https://plugins.trac.wordpress.org/changeset/3415821/
CVE: CVE-2025-13963
Published: 2025-12-12
Description: The FX Currency Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fxcc_convert' shortcode in all versions up to, and including, 0.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/fx-currency-converter/tags/0.2.0/includes/shortcode.php#L57; https://plugins.trac.wordpress.org/browser/fx-currency-converter/trunk/includes/shortcode.php#L57; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3415819%40fx-currency-converter&new=3415819%40fx-currency-converter&sfp_email=&sfph_mail=
CVE: CVE-2025-13966
Published: 2025-12-12
Description: The Paypal Payment Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttom_image' parameter of the [paypal-shortcode] shortcode in all versions up to, and including, 1.01 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/paypal-payments-shortcode/tags/1.01/sls-paypal-payments-shortcode.php#L10; https://plugins.trac.wordpress.org/browser/paypal-payments-shortcode/tags/1.01/sls-paypal-payments-shortcode.php#L55; https://plugins.trac.wordpress.org/browser/paypal-payments-shortcode/trunk/sls-paypal-payments-shortcode.php#L10
CVE: CVE-2025-13969
Published: 2025-12-12
Description: The Reviews Sorted plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'space' parameter of the [reviews-slider] shortcode in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/reviews-sorted/tags/2.4.2/functions/do.php#L138; https://plugins.trac.wordpress.org/browser/reviews-sorted/tags/2.4.2/templates/reviews-slider-1.php#L30; https://plugins.trac.wordpress.org/browser/reviews-sorted/tags/2.4.2/templates/reviews-slider-2.php#L23
CVE: CVE-2025-13971
Published: 2025-12-12
Description: The TWW Protein Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Header' setting in all versions up to, and including, 1.0.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/twwc-protein/tags/1.0.24/templates/protein-calculator-compact.php#L19; https://plugins.trac.wordpress.org/browser/twwc-protein/tags/1.0.24/templates/protein-calculator-large.php#L32; https://plugins.trac.wordpress.org/browser/twwc-protein/trunk/templates/protein-calculator-compact.php#L19
CVE: CVE-2025-13972
Published: 2025-12-12
Description: The WatchTowerHQ plugin for WordPress is vulnerable to arbitrary file read via the 'wht_download_big_object_origin' parameter in all versions up to, and including, 3.16.0. This is due to insufficient path validation in the handle_big_object_download_request function. This makes it possible for authenticated attackers, with administrator-level access and a valid access token, to read arbitrary files on the server, which can contain sensitive information such as database credentials and authentication keys.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/watchtowerhq/tags/3.15.0/src/Download.php#L104; https://plugins.trac.wordpress.org/browser/watchtowerhq/trunk/src/Download.php#L104; https://www.wordfence.com/threat-intel/vulnerabilities/id/13fcbff8-8560-48ca-82df-8b620961d9c6?source=cve
CVE: CVE-2025-13975
Published: 2025-12-12
Description: The Contact Form 7 with ChatWork plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_token' and 'roomid' settings in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses the settings page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/contact-form-7-with-chatwork/tags/1.1.0/contact-form-7-chatwork.php#L80; https://plugins.trac.wordpress.org/browser/contact-form-7-with-chatwork/tags/1.1.0/contact-form-7-chatwork.php#L89; https://plugins.trac.wordpress.org/browser/contact-form-7-with-chatwork/trunk/contact-form-7-chatwork.php#L80
CVE: CVE-2025-13987
Published: 2025-12-12
Description: The Purchase and Expense Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing nonce validation on the 'sup_pt_handle_deletion' function. This makes it possible for unauthenticated attackers to delete arbitrary purchase records via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/purchase-and-expense-manager/tags/1.1.2/purchase-and-expense-manager.php#L604; https://plugins.trac.wordpress.org/browser/purchase-and-expense-manager/trunk/purchase-and-expense-manager.php#L604; https://www.wordfence.com/threat-intel/vulnerabilities/id/c9[PII_REDACTED]-44a7-9564-832e54bf4fba?source=cve
CVE: CVE-2025-13988
Published: 2025-12-12
Description: The 评论小秘书 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.3.2. This is due to insufficient input sanitization and output escaping on the `$_SERVER['PHP_SELF']` variable in the plugin's settings page. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/comments-secretary/tags/1.3.2/tho_fetion.php#L173; https://plugins.trac.wordpress.org/browser/comments-secretary/trunk/tho_fetion.php#L173; https://www.wordfence.com/threat-intel/vulnerabilities/id/b24506c2-bf5e-4c71-94a5-c557a09f9f0d?source=cve
CVE: CVE-2025-13989
Published: 2025-12-12
Description: The WP Dropzone plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callback' shortcode attribute in all versions up to, and including, 1.1.1. This is due to insufficient input sanitization and output escaping on user-supplied 'callback' attributes, which are evaluated as JavaScript code via the `new Function()` constructor. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-dropzone/tags/1.1.1/includes/class-plugin.php#L303; https://plugins.trac.wordpress.org/browser/wp-dropzone/tags/1.1.1/js/wp-dropzone.js#L86; https://plugins.trac.wordpress.org/browser/wp-dropzone/trunk/includes/class-plugin.php#L303
CVE: CVE-2025-14032
Published: 2025-12-12
Description: The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in the 'bold_timeline_group' shortcode in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/bold-timeline-lite/tags/1.2.7/assets/views/bold_timeline_group_view.php#L79; https://plugins.trac.wordpress.org/browser/bold-timeline-lite/trunk/assets/views/bold_timeline_group_view.php#L79; https://plugins.trac.wordpress.org/changeset/3417223/
CVE: CVE-2025-14035
Published: 2025-12-12
Description: The DebateMaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the color options in the plugin settings in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page with the debate shortcode. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/debatemaster/tags/1.0.0/debatemaster.php#L30; https://plugins.trac.wordpress.org/browser/debatemaster/tags/1.0.0/debatemaster.php#L87; https://plugins.trac.wordpress.org/browser/debatemaster/trunk/debatemaster.php#L30
CVE: CVE-2025-14044
Published: 2025-12-12
Description: The Visitor Logic Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.3 via deserialization of untrusted input from the `lpblocks` cookie. This is due to the `lp_track()` function passing unsanitized cookie data directly to the `unserialize()` function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code granted they can access the WordPress site.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/logic-pro/tags/1.0.3/logic-lite.php#L131; https://plugins.trac.wordpress.org/browser/logic-pro/trunk/logic-lite.php#L131; https://www.wordfence.com/threat-intel/vulnerabilities/id/60fb6928-96fb-4c1f-989c-cc07965b5266?source=cve
CVE: CVE-2025-14045
Published: 2025-12-12
Description: The URL Media Uploader plugin for WordPress is vulnerable to unauthorized safe file uploads due to a missing capability check on the url_media_uploader_url_upload_ajax_handler() function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload safe media files.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://gist.github.com/jasoncarle/925401bb11833b1ced2342390e20718e; https://plugins.trac.wordpress.org/browser/url-media-uploader/tags/1.0.1/url-media-uploader.php#L52; https://plugins.trac.wordpress.org/browser/url-media-uploader/trunk/url-media-uploader.php#L52
CVE: CVE-2025-14048
Published: 2025-12-12
Description: The SimplyConvert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'simplyconvert_hash' option in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/simplyconvert/tags/1.0/simplyconvert.php#L137; https://plugins.trac.wordpress.org/browser/simplyconvert/trunk/simplyconvert.php#L137; https://www.wordfence.com/threat-intel/vulnerabilities/id/2d720466-e470-46a3-8129-3e58e1928f0d?source=cve
CVE: CVE-2025-14062
Published: 2025-12-12
Description: The Animated Pixel Marquee Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery via the 'marquee' parameter in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the marquee deletion function. This makes it possible for unauthenticated attackers to delete arbitrary marquees via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/animated-pixel-marquee-creator/tags/1.0.0/admin/marquees_list.php#L44; https://plugins.trac.wordpress.org/browser/animated-pixel-marquee-creator/trunk/admin/marquees_list.php#L44; https://www.wordfence.com/threat-intel/vulnerabilities/id/c727ab41-c091-4fff-8abe-f52a904cd9f0?source=cve
CVE: CVE-2025-14064
Published: 2025-12-12
Description: The BuddyTask plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple AJAX endpoints in all versions up to, and including, 1.3.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view, create, modify, and delete task boards belonging to any BuddyPress group, including private and hidden groups they are not members of.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://cwe.mitre.org/data/definitions/862.html; https://plugins.trac.wordpress.org/browser/buddytask/tags/1.3.0/buddytask.php#L458; https://plugins.trac.wordpress.org/browser/buddytask/trunk/buddytask.php#L458
CVE: CVE-2025-14119
Published: 2025-12-12
Description: The App Landing Template Blocks for WPBakery (Visual Composer) Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atvc_video_play' shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/app-template-blocks-for-wpbakery-page-builder/tags/2.0.2/modules/video-play.php#L58; https://plugins.trac.wordpress.org/browser/app-template-blocks-for-wpbakery-page-builder/trunk/modules/video-play.php#L58; https://www.wordfence.com/threat-intel/vulnerabilities/id/5c440ae0-311d-4d0a-a216-7641c2a80669?source=cve
CVE: CVE-2025-14125
Published: 2025-12-12
Description: The Complag plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/omplag/tags/1.0.2/complag.php#L37; https://plugins.trac.wordpress.org/browser/omplag/trunk/complag.php#L37; https://www.wordfence.com/threat-intel/vulnerabilities/id/1bdae07c-cb80-4566-9b90-7b144c6ceeb0?source=cve
CVE: CVE-2025-14129
Published: 2025-12-12
Description: The Like DisLike Voting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/like-dislike-voting/tags/1.0.1/files/function.php#L76; https://plugins.trac.wordpress.org/browser/like-dislike-voting/trunk/files/function.php#L76; https://wordpress.org/plugins/like-dislike-voting/
CVE: CVE-2025-14132
Published: 2025-12-12
Description: The Category Dropdown List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/dropdown-category-list/tags/1.0/settings.php#L11; https://plugins.trac.wordpress.org/browser/dropdown-category-list/trunk/settings.php#L11; https://www.wordfence.com/threat-intel/vulnerabilities/id/baac847b-3c5e-44c4-bccf-fcbde1adf37f?source=cve
CVE: CVE-2025-14137
Published: 2025-12-12
Description: The Simple AL Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/simple-al-slider/tags/1.2.10/templates/admin/header.tpl#L46; https://plugins.trac.wordpress.org/browser/simple-al-slider/trunk/templates/admin/header.tpl#L46; https://wordpress.org/plugins/simple-al-slider/
CVE: CVE-2025-14138
Published: 2025-12-12
Description: The WPLG Default Mail From plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wplg-default-mail-from/tags/1.0.0/wplg.php#L134; https://plugins.trac.wordpress.org/browser/wplg-default-mail-from/trunk/wplg.php#L134; https://www.wordfence.com/threat-intel/vulnerabilities/id/fd24b087-83a7-4f9a-8f7a-1bd94332c1f7?source=cve
CVE: CVE-2025-14143
Published: 2025-12-12
Description: The Ayo Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' parameter of the ayo_action shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ayo-shortcodes/tags/0.2/includes/ayo-shortcodes-functions.php#L55; https://plugins.trac.wordpress.org/browser/ayo-shortcodes/tags/0.2/includes/ayo-shortcodes-functions.php#L66; https://plugins.trac.wordpress.org/browser/ayo-shortcodes/trunk/includes/ayo-shortcodes-functions.php#L55
CVE: CVE-2025-14158
Published: 2025-12-12
Description: The Coding Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update plugin settings including the theme configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/coding-blocks/tags/1.1.0/admin/pages/settings.php#L11; https://plugins.trac.wordpress.org/browser/coding-blocks/trunk/admin/pages/settings.php#L11; https://wordpress.org/plugins/coding-blocks/#developers
CVE: CVE-2025-14160
Published: 2025-12-12
Description: The Upcoming for Calendly plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.4. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's Calendly API key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/upcoming-for-calendly/tags/1.2.4/includes/settings.php#L33; https://plugins.trac.wordpress.org/browser/upcoming-for-calendly/trunk/includes/settings.php#L33; https://plugins.trac.wordpress.org/changeset/3415892/
CVE: CVE-2025-14161
Published: 2025-12-12
Description: The Truefy Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce validation on the 'truefy_embed_options_update' settings update action. This makes it possible for unauthenticated attackers to update the plugin's settings, including the API key, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/truefy-embed/tags/1.1.0/truefy.php#L431; https://plugins.trac.wordpress.org/browser/truefy-embed/trunk/truefy.php#L431; https://www.wordfence.com/threat-intel/vulnerabilities/id/74ad664d-5cfa-481c-a318-30999c43e4ac?source=cve
CVE: CVE-2025-14162
Published: 2025-12-12
Description: The BMLT WordPress Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.11.4. This is due to missing nonce validation on the 'BMLTPlugin_create_option' and 'BMLTPlugin_delete_option ' action. This makes it possible for unauthenticated attackers to create new plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/bmlt-wordpress-satellite-plugin/tags/3.11.4/vendor/bmlt/bmlt-satellite-base-class/bmlt-cms-satellite-plugin.php#L848; https://plugins.trac.wordpress.org/browser/bmlt-wordpress-satellite-plugin/trunk/vendor/bmlt/bmlt-satellite-base-class/bmlt-cms-satellite-plugin.php#L848; https://www.wordfence.com/threat-intel/vulnerabilities/id/0344f49b-f5f9-4729-ade0-cba6289406de?source=cve