deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-21891
Published: 2025-03-27
Description: In the Linux kernel, the following vulnerability has been resolved:

ipvlan: ensure network headers are in skb linear part

syzbot found that ipvlan_process_v6_outbound() was assuming
the IPv6 network header isis present in skb->head [1]

Add the needed pskb_network_may_pull() calls for both
IPv4 and IPv6 handlers.

[1]
BUG: KMSAN: uninit-value in __ipv6_addr_type+0xa2/0x490 net/ipv6/addrconf_core.c:47
  __ipv6_addr_type+0xa2/0x490 net/ipv6/addrconf_core.c:47
  ipv6_addr_type include/net/ipv6.h:555 [inline]
  ip6_route_output_flags_noref net/ipv6/route.c:2616 [inline]
  ip6_route_output_flags+0x51/0x720 net/ipv6/route.c:2651
  ip6_route_output include/net/ip6_route.h:93 [inline]
  ipvlan_route_v6_outbound+0x24e/0x520 drivers/net/ipvlan/ipvlan_core.c:476
  ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:491 [inline]
  ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:541 [inline]
  ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:605 [inline]
  ipvlan_queue_xmit+0xd72/0x1780 drivers/net/ipvlan/ipvlan_core.c:671
  ipvlan_start_xmit+0x5b/0x210 drivers/net/ipvlan/ipvlan_main.c:223
  __netdev_start_xmit include/linux/netdevice.h:5150 [inline]
  netdev_start_xmit include/linux/netdevice.h:5159 [inline]
  xmit_one net/core/dev.c:3735 [inline]
  dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3751
  sch_direct_xmit+0x399/0xd40 net/sched/sch_generic.c:343
  qdisc_restart net/sched/sch_generic.c:408 [inline]
  __qdisc_run+0x14da/0x35d0 net/sched/sch_generic.c:416
  qdisc_run+0x141/0x4d0 include/net/pkt_sched.h:127
  net_tx_action+0x78b/0x940 net/core/dev.c:5484
  handle_softirqs+0x1a0/0x7c0 kernel/softirq.c:561
  __do_softirq+0x14/0x1a kernel/softirq.c:595
  do_softirq+0x9a/0x100 kernel/softirq.c:462
  __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:389
  local_bh_enable include/linux/bottom_half.h:33 [inline]
  rcu_read_unlock_bh include/linux/rcupdate.h:919 [inline]
  __dev_queue_xmit+0x2758/0x57d0 net/core/dev.c:4611
  dev_queue_xmit include/linux/netdevice.h:3311 [inline]
  packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276
  packet_snd net/packet/af_packet.c:3132 [inline]
  packet_sendmsg+0x93e0/0xa7e0 net/packet/af_packet.c:3164
  sock_sendmsg_nosec net/socket.c:718 [inline]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908, CWE-908
References: https://git.kernel.org/stable/c/27843ce6ba3d3122b65066550fe33fb8839f8aef; https://git.kernel.org/stable/c/4ec48f812804f370f622e0874e6dd8fcc58241cd; https://git.kernel.org/stable/c/5353fd89663c48f56bdff975c562cfe78b1a2e4c
CVE: CVE-2025-22644
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce vayu-blocks allows Stored XSS.This issue affects Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: from n/a through <= 1.4.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/vayu-blocks/vulnerability/wordpress-vayu-blocks-gutenberg-blocks-plugin-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22646
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows Stored XSS.This issue affects aThemes Addons for Elementor: from n/a through <= 1.0.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/athemes-addons-for-elementor-lite/vulnerability/wordpress-athemes-addons-for-elementor-plugin-1-0-8-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22647
Published: 2025-03-27
Description: Missing Authorization vulnerability in Smackcoders Inc., AIO Performance Profiler, Monitor, Optimize, Compress & Debug all-in-one-performance-accelerator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AIO Performance Profiler, Monitor, Optimize, Compress & Debug: from n/a through <= 1.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/all-in-one-performance-accelerator/vulnerability/wordpress-aio-performance-profiler-plugin-1-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22648
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Devs Blog, Posts and Category Filter for Elementor blog-posts-and-category-for-elementor allows Stored XSS.This issue affects Blog, Posts and Category Filter for Elementor: from n/a through <= 2.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/blog-posts-and-category-for-elementor/vulnerability/wordpress-blog-posts-and-category-filter-for-elementor-plugin-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22649
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP Project Manager wedevs-project-manager allows Stored XSS.This issue affects WP Project Manager: from n/a through <= 2.6.22.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wedevs-project-manager/vulnerability/wordpress-wp-project-manager-plugin-2-6-17-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22652
Published: 2025-03-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kendysond Payment Forms for Paystack payment-forms-for-paystack allows SQL Injection.This issue affects Payment Forms for Paystack: from n/a through <= 4.0.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/payment-forms-for-paystack/vulnerability/wordpress-payment-forms-for-paystack-plugin-4-0-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-22658
Published: 2025-03-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Listings for Appfolio Listings for Appfolio listings-for-appfolio allows Stored XSS.This issue affects Listings for Appfolio: from n/a through <= 1.2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/listings-for-appfolio/vulnerability/wordpress-listings-for-appfolio-plugin-1-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22659
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fox by ThemeIsle themeisle-companion allows Stored XSS.This issue affects Orbit Fox by ThemeIsle: from n/a through <= 2.10.44.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/themeisle-companion/vulnerability/wordpress-orbit-fox-by-themeisle-plugin-2-10-44-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22660
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wolfgang Include Mastodon Feed include-mastodon-feed allows DOM-Based XSS.This issue affects Include Mastodon Feed: from n/a through <= 1.9.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/include-mastodon-feed/vulnerability/wordpress-include-mastodon-feed-plugin-1-9-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22665
Published: 2025-03-27
Description: Missing Authorization vulnerability in Shakeeb Sadikeen RapidLoad unusedcss allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RapidLoad: from n/a through <= 2.4.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/unusedcss/vulnerability/wordpress-rapidload-plugin-2-4-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22667
Published: 2025-03-27
Description: Missing Authorization vulnerability in Creative Werk Designs Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets wpsyncsheets-woocommerce.This issue affects Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets: from n/a through <= 1.8.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wpsyncsheets-woocommerce/vulnerability/wordpress-export-order-product-customer-coupon-for-woocommerce-to-google-sheets-plugin-1-8-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22668
Published: 2025-03-27
Description: Missing Authorization vulnerability in AwesomeTOGI Awesome Event Booking awesome-event-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Event Booking: from n/a through <= 2.7.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/awesome-event-booking/vulnerability/wordpress-awesome-event-booking-plugin-2-7-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22669
Published: 2025-03-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in AwesomeTOGI Awesome Event Booking awesome-event-booking allows Cross Site Request Forgery.This issue affects Awesome Event Booking: from n/a through <= 2.7.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/awesome-event-booking/vulnerability/wordpress-awesome-event-booking-plugin-2-7-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-22670
Published: 2025-03-27
Description: Missing Authorization vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.7.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/vikbooking/vulnerability/wordpress-vikbooking-hotel-booking-engine-pms-plugin-1-7-2-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-22671
Published: 2025-03-27
Description: Missing Authorization vulnerability in Leap13 Disable Elementor Editor Translation disable-elementor-editor-translation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Disable Elementor Editor Translation: from n/a through <= 1.0.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/disable-elementor-editor-translation/vulnerability/wordpress-disable-elementor-editor-translation-plugin-1-0-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-29483
Published: 2025-03-27
Description: libming v0.4.8 was discovered to contain a memory leak via the parseSWF_ENABLEDEBUGGER2 function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://github.com/libming/libming/issues/330
CVE: CVE-2025-29484
Published: 2025-03-27
Description: An out-of-memory error in the parseABC_NS_SET_INFO function of libming v0.4.8 allows attackers to cause a Denial of Service (DoS) due to allocator exhaustion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/libming/libming/issues/330; https://github.com/libming/libming/issues/330
CVE: CVE-2025-29485
Published: 2025-03-27
Description: libming v0.4.8 was discovered to contain a segmentation fault via the decompileRETURN function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SWF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/goodmow/PoC/blob/main/libming/libming-fuzz4.readme; https://github.com/libming/libming/issues/330
CVE: CVE-2025-29486
Published: 2025-03-27
Description: libming v0.4.8 was discovered to contain a memory leak via the parseSWF_PLACEOBJECT3 function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/goodmow/PoC/blob/main/libming/libming-fuzz3.readme; https://github.com/libming/libming/issues/330
CVE: CVE-2025-29487
Published: 2025-03-27
Description: An out-of-memory error in the parseABC_STRING_INFO function of libming v0.4.8 allows attackers to cause a Denial of Service (DoS) due to allocator exhaustion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/goodmow/PoC/blob/main/libming/libming-fuzz6.readme; https://github.com/libming/libming/issues/330
CVE: CVE-2025-29488
Published: 2025-03-27
Description: libming v0.4.8 was discovered to contain a memory leak via the parseSWF_INITACTION function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/goodmow/PoC/blob/main/libming/libming-fuzz5.readme; https://github.com/libming/libming/issues/330
CVE: CVE-2025-29489
Published: 2025-03-27
Description: libming v0.4.8 was discovered to contain a memory leak via the parseSWF_MORPHLINESTYLES function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/goodmow/PoC/blob/main/libming/libming-fuzz7.readme; https://github.com/libming/libming/issues/330
CVE: CVE-2025-29490
Published: 2025-03-27
Description: libming v0.4.8 was discovered to contain a segmentation fault via the decompileCALLMETHOD function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SWF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/goodmow/PoC/blob/main/libming/libming-fuzz8.readme; https://github.com/libming/libming/issues/330
CVE: CVE-2025-29491
Published: 2025-03-27
Description: An allocation-size-too-big error in the parseSWF_DEFINEBINARYDATA function of libming v0.48 allows attackers to cause a Denial of Service (DoS) via supplying a crafted SWF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-789
References: https://github.com/goodmow/PoC/blob/main/libming/libming-fuzz10.readme; https://github.com/libming/libming/issues/330; https://github.com/libming/libming/issues/330
CVE: CVE-2025-29492
Published: 2025-03-27
Description: libming v0.4.8 was discovered to contain a segmentation fault via the decompileSETVARIABLE function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/goodmow/PoC/blob/main/libming/libming-fuzz9.readme; https://github.com/libming/libming/issues/330
CVE: CVE-2025-29493
Published: 2025-03-27
Description: libming v0.4.8 was discovered to contain a segmentation fault via the decompileGETPROPERTY function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SWF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/goodmow/PoC/blob/main/libming/libming-fuzz11.readme; https://github.com/libming/libming/issues/330; https://github.com/libming/libming/issues/330
CVE: CVE-2025-29494
Published: 2025-03-27
Description: libming v0.4.8 was discovered to contain a segmentation fault via the decompileGETMEMBER function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SWF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/goodmow/PoC/blob/main/libming/libming-fuzz12.readme; https://github.com/libming/libming/issues/330; https://github.com/libming/libming/issues/330
CVE: CVE-2025-29496
Published: 2025-03-27
Description: libming v0.4.8 was discovered to contain a segmentation fault via the decompileDUPLICATECLIP function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SWF file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/goodmow/PoC/blob/main/libming/libming-fuzz14.readme; https://github.com/libming/libming/issues/330; https://github.com/libming/libming/issues/330
CVE: CVE-2025-29497
Published: 2025-03-27
Description: libming v0.4.8 was discovered to contain a memory leak via the parseSWF_MORPHFILLSTYLES function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/goodmow/PoC/blob/main/libming/libming-fuzz15.readme; https://github.com/libming/libming/issues/330
CVE: CVE-2025-2516
Published: 2025-03-27
Description: The use of a weak cryptographic key pair in the signature verification process in WPS Office (Kingsoft) on Windows allows an attacker who successfully recovered the private key to sign components.

As older versions of WPS Office did not validate the update server's certificate, an Adversary-In-The-Middle attack was possible allowing updates to be hijacked.
CWE: CWE-326
References: https://www.welivesecurity.com/en/eset-research/nspx30-sophisticated-aitm-enabled-implant-evolving-since-2005/
CVE: CVE-2025-2854
Published: 2025-03-27
Description: A vulnerability classified as critical was found in code-projects Payroll Management System 1.0. Affected by this vulnerability is an unknown functionality of the file update_employee.php. The manipulation of the argument emp_type leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/hak0neP/cve/blob/main/sql-fizz.md; https://vuldb.com/?ctiid.301501
CVE: CVE-2025-30067
Published: 2025-03-27
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. 
If an attacker gets access to Kylin's system or project admin permission, the JDBC connection configuration maybe altered to execute arbitrary code from the remote. You are fine as long as the Kylin's system and project admin access is well protected.

This issue affects Apache Kylin: from 4.0.0 through 5.0.1.

Users are recommended to upgrade to version 5.0.2 or above, which fixes the issue.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://lists.apache.org/thread/6j19pt8yoqfphf1lprtrzoqkvz1gwbnc; http://www.openwall.com/lists/oss-security/2025/03/27/4
CVE: CVE-2025-30221
Published: 2025-03-27
Description: Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction with Rack 3. The issue was fixed in Pitchfork release 0.11.0. No known workarounds are available.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-113
References: https://github.com/Shopify/pitchfork/commit/17ed9b61bf9f58957065f7405b66102daf86bf55; https://github.com/Shopify/pitchfork/security/advisories/GHSA-pfqj-w6r6-g86v
CVE: CVE-2025-30358
Published: 2025-03-27
Description: Mesop is a Python-based UI framework that allows users to build web applications. A class pollution vulnerability in Mesop prior to version 0.14.1 allows attackers to overwrite global variables and class attributes in certain Mesop modules during runtime. This vulnerability could directly lead to a denial of service (DoS) attack against the server. Additionally, it could also result in other severe consequences given the application's implementation, such as identity confusion, where an attacker could impersonate an assistant or system role within conversations. This impersonation could potentially enable jailbreak attacks when interacting with large language models (LLMs). Just like the Javascript's prototype pollution, this vulnerability could leave a way for attackers to manipulate the intended data-flow or control-flow of the application at runtime and lead to severe consequences like remote code execution when gadgets are available. Users should upgrade to version 0.14.1 to obtain a fix for the issue.
CVSS Score: 8.1 (HIGH)
CWE: CWE-915
References: https://github.com/mesop-dev/mesop/commit/748e20d4a363d89b841d62213f5b0c6b4bed788f; https://github.com/mesop-dev/mesop/security/advisories/GHSA-f3mf-hm6v-jfhh
CVE: CVE-2025-31176
Published: 2025-03-27
Description: A flaw was found in gnuplot. The plot3d_points() function may lead to a segmentation fault and cause a system crash.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-476
References: https://access.redhat.com/security/cve/CVE-2025-31176; https://bugzilla.redhat.com/show_bug.cgi?id=2355343
CVE: CVE-2025-31178
Published: 2025-03-27
Description: A flaw was found in gnuplot. The GetAnnotateString() function may lead to a segmentation fault and cause a system crash.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-476
References: https://access.redhat.com/security/cve/CVE-2025-31178; https://bugzilla.redhat.com/show_bug.cgi?id=2355341
CVE: CVE-2025-31179
Published: 2025-03-27
Description: A flaw was found in gnuplot. The xstrftime() function may lead to a segmentation fault, causing a system crash.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-476
References: https://access.redhat.com/security/cve/CVE-2025-31179; https://bugzilla.redhat.com/show_bug.cgi?id=2355340
CVE: CVE-2025-31180
Published: 2025-03-27
Description: A flaw was found in gnuplot. The CANVAS_text() function may lead to a segmentation fault and cause a system crash.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-476
References: https://access.redhat.com/security/cve/CVE-2025-31180; https://bugzilla.redhat.com/show_bug.cgi?id=2355339
CVE: CVE-2025-31181
Published: 2025-03-27
Description: A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-476
References: https://access.redhat.com/security/cve/CVE-2025-31181; https://bugzilla.redhat.com/show_bug.cgi?id=2355338
CVE: CVE-2025-22278
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yudleethemes Whitish Lite allows Stored XSS.This issue affects Whitish Lite: from n/a through 2.1.13.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/theme/whitish-lite/vulnerability/wordpress-whitish-lite-theme-2-1-13-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22496
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MarMar8x Notif Bell notif-bell allows Stored XSS.This issue affects Notif Bell: from n/a through <= 0.9.8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/notif-bell/vulnerability/wordpress-notif-bell-plugin-0-9-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22497
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bramwaas Simple Google Calendar Outlook Events Block Widget simple-google-icalendar-widget allows Stored XSS.This issue affects Simple Google Calendar Outlook Events Block Widget: from n/a through <= 2.5.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-google-icalendar-widget/vulnerability/wordpress-simple-google-calendar-outlook-events-block-widget-plugin-2-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22628
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision Filled In filled-in allows Stored XSS.This issue affects Filled In: from n/a through <= 1.9.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/filled-in/vulnerability/wordpress-filled-in-plugin-1-9-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22629
Published: 2025-03-27
Description: Missing Authorization vulnerability in iNET iNET Webkit inet-webkit allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iNET Webkit: from n/a through <= 1.2.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/inet-webkit/vulnerability/wordpress-inet-webkit-plugin-1-2-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22634
Published: 2025-03-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in MD Abu Jubayer Hossain Easy Booked – Appointment Booking and Scheduling Management System for WordPress easy-booked allows Cross Site Request Forgery.This issue affects Easy Booked – Appointment Booking and Scheduling Management System for WordPress: from n/a through <= 2.4.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/easy-booked/vulnerability/wordpress-easy-booked-plugin-2-4-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve