deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-54831
Published: 2025-09-26
Description: Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a "write-only" model for sensitive values.


In Airflow 3.0.3, this model was unintentionally violated: sensitive connection information could be viewed by users with READ permissions through both the API and the UI. This behavior also bypassed the `AIRFLOW__CORE__HIDE_SENSITIVE_VAR_CONN_FIELDS` configuration option.


This issue does not affect Airflow 2.x, where exposing sensitive information to connection editors was the intended and documented behavior.






Users of Airflow 3.0.3 are advised to upgrade Airflow to >=3.0.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-213
References: https://lists.apache.org/thread/vblmfqtydrp5zgn2q8tj3slk5podxspf; http://www.openwall.com/lists/oss-security/2025/09/25/4
CVE: CVE-2025-10858
Published: 2025-09-26
Description: An issue was discovered in GitLab CE/EE affecting all versions before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that allows unauthenticated users to cause a Denial of Service (DoS) condition while uploading specifically crafted large JSON files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/570034
CVE: CVE-2025-10867
Published: 2025-09-26
Description: An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to create a denial-of-service condition by exploiting an unprotected GraphQL API through repeated requests.
CVSS Score: 3.5 (LOW)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/517757
CVE: CVE-2025-10871
Published: 2025-09-26
Description: An issue has been discovered in GitLab EE affecting all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. Project Maintainers can exploit a vulnerability where they can assign custom roles to users with permissions exceeding their own, effectively granting themselves elevated privileges.
CVSS Score: 3.8 (LOW)
CWE: CWE-862
References: https://gitlab.com/gitlab-org/gitlab/-/issues/569482
CVE: CVE-2025-11021
Published: 2025-09-26
Description: A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw could result in unintended disclosure of memory contents, potentially exposing sensitive information from the process using libsoup.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://access.redhat.com/errata/RHSA-2025:18183; https://access.redhat.com/errata/RHSA-2025:19713; https://access.redhat.com/errata/RHSA-2025:19714
CVE: CVE-2025-1862
Published: 2025-09-26
Description: An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-controlled location on the server.


By leveraging this vulnerability, an attacker can upload a specially crafted payload and achieve remote code execution (RCE), potentially compromising the server and its data.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-434
References: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3992/
CVE: CVE-2025-27006
Published: 2025-09-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeplugs Authorsy authorsy allows Stored XSS.This issue affects Authorsy: from n/a through <= 1.0.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/authorsy/vulnerability/wordpress-authorsy-plugin-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48107
Published: 2025-09-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in undsgn Uncode uncode allows Reflected XSS.This issue affects Uncode: from n/a through < 2.9.4.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/uncode/vulnerability/wordpress-uncode-theme-2-9-4-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48326
Published: 2025-09-26
Description: Missing Authorization vulnerability in Acclectic Media Acclectic Media Organizer acclectic-media-organizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acclectic Media Organizer: from n/a through <= 1.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/acclectic-media-organizer/vulnerability/wordpress-acclectic-media-organizer-plugin-1-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-4957
Published: 2025-09-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss ProfileGrid  profilegrid-user-profiles-groups-and-communities allows Reflected XSS.This issue affects ProfileGrid : from n/a through <= 5.9.5.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/profilegrid-user-profiles-groups-and-communities/vulnerability/wordpress-profilegrid-plugin-5-9-5-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58914
Published: 2025-09-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Di Themes Di Themes Demo Site Importer di-themes-demo-site-importer allows Cross Site Request Forgery.This issue affects Di Themes Demo Site Importer: from n/a through <= 1.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/di-themes-demo-site-importer/vulnerability/wordpress-di-themes-demo-site-importer-plugin-1-2-cross-site-request-forgery-csrf-to-plugin-activation-vulnerability?_s_id=cve
CVE: CVE-2025-58917
Published: 2025-09-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick Verwymeren Quantities and Units for WooCommerce quantities-and-units-for-woocommerce allows Stored XSS.This issue affects Quantities and Units for WooCommerce: from n/a through <= 1.0.13.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/quantities-and-units-for-woocommerce/vulnerability/wordpress-quantities-and-units-for-woocommerce-plugin-1-0-13-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58919
Published: 2025-09-26
Description: Missing Authorization vulnerability in guihom Wide Banner wide-banner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wide Banner: from n/a through <= 1.0.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wide-banner/vulnerability/wordpress-wide-banner-plugin-1-0-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-59002
Published: 2025-09-26
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM Content Builder: from n/a through < 3.16.3.3.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/bm-builder/vulnerability/wordpress-bm-content-builder-plugin-3-16-3-3-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-59010
Published: 2025-09-26
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Maciej Bis Permalink Manager Lite permalink-manager allows Retrieve Embedded Sensitive Data.This issue affects Permalink Manager Lite: from n/a through <= 2.5.1.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/permalink-manager/vulnerability/wordpress-permalink-manager-lite-plugin-2-5-1-3-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-59011
Published: 2025-09-26
Description: Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through < 3.2.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/traveler/vulnerability/wordpress-traveler-theme-3-2-3-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-59012
Published: 2025-09-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler traveler allows Reflected XSS.This issue affects Traveler: from n/a through < 3.2.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/traveler/vulnerability/wordpress-traveler-theme-3-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-60040
Published: 2025-09-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fkrauthan wp-mpdf wp-mpdf allows Stored XSS.This issue affects wp-mpdf: from n/a through <= 3.9.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-mpdf/vulnerability/wordpress-wp-mpdf-plugin-3-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-60092
Published: 2025-09-26
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded Sensitive Data.This issue affects Download Manager: from n/a through <= 3.3.25.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/download-manager/vulnerability/wordpress-download-manager-plugin-3-3-24-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-60093
Published: 2025-09-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Shahjada Download Manager download-manager allows Cross Site Request Forgery.This issue affects Download Manager: from n/a through <= 3.3.24.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/download-manager/vulnerability/wordpress-download-manager-plugin-3-3-24-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-60094
Published: 2025-09-26
Description: Missing Authorization vulnerability in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stackable: from n/a through <= 3.18.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/stackable-ultimate-gutenberg-blocks/vulnerability/wordpress-stackable-plugin-3-18-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-60095
Published: 2025-09-26
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks allows Retrieve Embedded Sensitive Data.This issue affects Stackable: from n/a through <= 3.18.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/stackable-ultimate-gutenberg-blocks/vulnerability/wordpress-stackable-plugin-3-18-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-60096
Published: 2025-09-26
Description: Missing Authorization vulnerability in CodexThemes TheGem (Elementor) thegem-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TheGem (Elementor): from n/a through <= 5.10.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/thegem-elementor/vulnerability/wordpress-thegem-elementor-theme-5-10-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-60097
Published: 2025-09-26
Description: Missing Authorization vulnerability in CodexThemes TheGem thegem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TheGem: from n/a through <= 5.10.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/thegem/vulnerability/wordpress-thegem-theme-5-10-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-60098
Published: 2025-09-26
Description: Missing Authorization vulnerability in Jeff Farthing Theme My Login theme-my-login allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Theme My Login: from n/a through <= 7.1.12.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/theme-my-login/vulnerability/wordpress-theme-my-login-plugin-7-1-12-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-60099
Published: 2025-09-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awsm.in Embed Any Document embed-any-document allows Stored XSS.This issue affects Embed Any Document: from n/a through <= 2.7.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/embed-any-document/vulnerability/wordpress-embed-any-document-plugin-2-7-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-60100
Published: 2025-09-26
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through < 9.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-80
References: https://patchstack.com/database/Wordpress/Theme/xstore/vulnerability/wordpress-xstore-theme-9-5-3-content-injection-vulnerability?_s_id=cve
CVE: CVE-2025-60101
Published: 2025-09-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in duongancol Woostify woostify allows Stored XSS.This issue affects Woostify: from n/a through <= 2.4.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/woostify/vulnerability/wordpress-woostify-theme-2-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-60102
Published: 2025-09-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syam Mohan WPFront User Role Editor wpfront-user-role-editor allows Stored XSS.This issue affects WPFront User Role Editor: from n/a through <= 4.2.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpfront-user-role-editor/vulnerability/wordpress-wpfront-user-role-editor-plugin-4-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-60103
Published: 2025-09-26
Description: Missing Authorization vulnerability in CridioStudio ListingPro listingpro-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through <= 2.9.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/listingpro-plugin/vulnerability/wordpress-listingpro-plugin-2-9-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-60104
Published: 2025-09-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Gallery Custom Links gallery-custom-links allows Stored XSS.This issue affects Gallery Custom Links: from n/a through <= 2.2.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/gallery-custom-links/vulnerability/wordpress-gallery-custom-links-plugin-2-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-60105
Published: 2025-09-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through <= 3.1.58.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ditty-news-ticker/vulnerability/wordpress-ditty-plugin-3-1-58-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-60106
Published: 2025-09-26
Description: Missing Authorization vulnerability in Roxnor EmailKit emailkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EmailKit: from n/a through <= 1.6.0.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/emailkit/vulnerability/wordpress-emailkit-plugin-1-6-0-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-60107
Published: 2025-09-26
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Playlist all-in-one-bannerWithPlaylist allows Blind SQL Injection.This issue affects LambertGroup - AllInOne - Banner with Playlist: from n/a through <= 3.8.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/all-in-one-bannerWithPlaylist/vulnerability/wordpress-lambertgroup-allinone-banner-with-playlist-plugin-3-8-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-60108
Published: 2025-09-26
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Thumbnails all-in-one-thumbnailsBanner allows Blind SQL Injection.This issue affects LambertGroup - AllInOne - Banner with Thumbnails: from n/a through <= 3.8.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/all-in-one-thumbnailsBanner/vulnerability/wordpress-lambertgroup-allinone-banner-with-thumbnails-plugin-3-8-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-60109
Published: 2025-09-26
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Content Slider all-in-one-contentSlider allows Blind SQL Injection.This issue affects LambertGroup - AllInOne - Content Slider: from n/a through <= 3.8.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/all-in-one-contentSlider/vulnerability/wordpress-lambertgroup-allinone-content-slider-plugin-3-8-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-60110
Published: 2025-09-26
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup AllInOne - Banner Rotator all-in-one-bannerRotator allows SQL Injection.This issue affects AllInOne - Banner Rotator: from n/a through <= 3.8.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/all-in-one-bannerRotator/vulnerability/wordpress-allinone-banner-rotator-plugin-3-8-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-60111
Published: 2025-09-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in javothemes Javo Core javo-core allows Authentication Bypass.This issue affects Javo Core: from n/a through <= 3.0.0.266.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/javo-core/vulnerability/wordpress-javo-core-plugin-3-0-0-266-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-60112
Published: 2025-09-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows Stored XSS.This issue affects aThemes Addons for Elementor: from n/a through <= 1.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/athemes-addons-for-elementor-lite/vulnerability/wordpress-athemes-addons-for-elementor-plugin-1-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-60113
Published: 2025-09-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in grooni Groovy Menu groovy-menu-free allows Cross Site Request Forgery.This issue affects Groovy Menu: from n/a through <= 1.4.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/groovy-menu-free/vulnerability/wordpress-groovy-menu-plugin-1-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-60114
Published: 2025-09-26
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in YayCommerce YayCurrency yaycurrency allows Code Injection.This issue affects YayCurrency: from n/a through <= 3.3.1.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/yaycurrency/vulnerability/wordpress-yaycurrency-plugin-3-2-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2025-60115
Published: 2025-09-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in instapagedev Instapage Plugin instapage allows Cross Site Request Forgery.This issue affects Instapage Plugin: from n/a through <= 3.7.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/instapage/vulnerability/wordpress-instapage-plugin-plugin-3-5-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-60116
Published: 2025-09-26
Description: Missing Authorization vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-custom-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Conference Theme Custom Post Type: from n/a through < 2.6.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/grandconference-custom-post/vulnerability/wordpress-grand-conference-theme-custom-post-type-plugin-2-6-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-60117
Published: 2025-09-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in TangibleWP Vehica Core vehica-core allows Cross Site Request Forgery.This issue affects Vehica Core: from n/a through <= 1.0.100.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/vehica-core/vulnerability/wordpress-vehica-core-plugin-1-0-100-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-60118
Published: 2025-09-26
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Potenzaglobalsolutions PGS Core pgs-core allows SQL Injection.This issue affects PGS Core: from n/a through <= 5.9.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/pgs-core/vulnerability/wordpress-pgs-core-plugin-5-9-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-60119
Published: 2025-09-26
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Retrieve Embedded Sensitive Data.This issue affects CoSchedule: from n/a through <= 3.3.11.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/coschedule-by-todaymade/vulnerability/wordpress-coschedule-plugin-3-3-10-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-60120
Published: 2025-09-26
Description: Missing Authorization vulnerability in WPDirectoryKit WP Directory Kit wpdirectorykit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through <= 1.4.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wpdirectorykit/vulnerability/wordpress-wp-directory-kit-plugin-1-3-8-broken-access-control-vulnerability?_s_id=cve