deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-32534
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Workbox Workbox Video from Vimeo & Youtube workbox-video-from-vimeo-youtube-plugin allows Reflected XSS.This issue affects Workbox Video from Vimeo & Youtube: from n/a through <= 3.2.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/workbox-video-from-vimeo-youtube-plugin/vulnerability/wordpress-workbox-video-from-vimeo-youtube-plugin-plugin-3-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32536
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sandeep Verma HTML5 Video Player with Playlist html5-video-player-with-playlist allows Reflected XSS.This issue affects HTML5 Video Player with Playlist: from n/a through <= 2.50.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/html5-video-player-with-playlist/vulnerability/wordpress-html5-video-player-with-playlist-plugin-2-50-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32537
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rachel Cherry Lock Your Updates lock-your-updates allows Reflected XSS.This issue affects Lock Your Updates: from n/a through <= 1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/lock-your-updates/vulnerability/wordpress-lock-your-updates-plugin-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32538
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dev02ali Easy Post Duplicator easy-post-duplicator allows Reflected XSS.This issue affects Easy Post Duplicator: from n/a through <= 1.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/easy-post-duplicator/vulnerability/wordpress-easy-post-duplicator-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32539
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Kohlbach Store Exporter woocommerce-exporter allows Reflected XSS.This issue affects Store Exporter: from n/a through <= 2.7.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-exporter/vulnerability/wordpress-woocommerce-store-exporter-plugin-2-7-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32541
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in infosoftplugin WooCommerce Sales MIS Report woocommerce-mis-report allows Reflected XSS.This issue affects WooCommerce Sales MIS Report: from n/a through <= 4.0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-mis-report/vulnerability/wordpress-woocommerce-sales-mis-report-plugin-4-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32542
Published: 2025-04-11
Description: Missing Authorization vulnerability in EazyPlugins Eazy Plugin Manager plugins-on-steroids allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eazy Plugin Manager: from n/a through <= 4.3.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/plugins-on-steroids/vulnerability/wordpress-eazy-plugin-manager-plugin-4-3-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32551
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jaap Jansma Connector to CiviCRM with CiviMcRestFace connector-civicrm-mcrestface allows Reflected XSS.This issue affects Connector to CiviCRM with CiviMcRestFace: from n/a through <= 1.0.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/connector-civicrm-mcrestface/vulnerability/wordpress-connector-to-civicrm-with-civimcrestface-plugin-1-0-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32553
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Reflected XSS.This issue affects RestroPress: from n/a through <= 3.2.8.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/restropress/vulnerability/wordpress-restropres-plugin-3-1-8-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32558
Published: 2025-04-11
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ketanajani Duplicate Title Checker duplicate-title-checker allows Blind SQL Injection.This issue affects Duplicate Title Checker: from n/a through <= 1.2.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/duplicate-title-checker/vulnerability/wordpress-duplicate-title-checker-plugin-1-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32565
Published: 2025-04-11
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vertim Neon Product Designer neon-product-designer-for-woocommerce allows SQL Injection.This issue affects Neon Product Designer: from n/a through <= 2.2.0.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/neon-product-designer-for-woocommerce/vulnerability/wordpress-neon-product-designer-plugin-2-1-1-unauthenticated-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32567
Published: 2025-04-11
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in dev02ali Easy Post Duplicator easy-post-duplicator allows SQL Injection.This issue affects Easy Post Duplicator: from n/a through <= 1.0.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/easy-post-duplicator/vulnerability/wordpress-easy-post-duplicator-plugin-1-0-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32568
Published: 2025-04-11
Description: Deserialization of Untrusted Data vulnerability in empik EmpikPlace for Woocommerce empik-for-woocommerce allows Object Injection.This issue affects EmpikPlace for Woocommerce: from n/a through <= 1.4.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/empik-for-woocommerce/vulnerability/wordpress-empikplace-for-woocommerce-plugin-1-4-2-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32569
Published: 2025-04-11
Description: Deserialization of Untrusted Data vulnerability in RealMag777 TableOn posts-table-filterable allows Object Injection.This issue affects TableOn: from n/a through <= 1.0.4.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/posts-table-filterable/vulnerability/wordpress-tableon-plugin-1-0-2-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32577
Published: 2025-04-11
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hakeemnala Build App Online build-app-online allows PHP Local File Inclusion.This issue affects Build App Online: from n/a through <= 1.0.23.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/build-app-online/vulnerability/wordpress-build-app-online-plugin-1-0-23-local-file-inclusion-vulnerability-2?_s_id=cve
CVE: CVE-2025-32579
Published: 2025-04-11
Description: Unrestricted Upload of File with Dangerous Type vulnerability in SoftClever Limited Sync Posts sync-posts allows Upload a Web Shell to a Web Server.This issue affects Sync Posts: from n/a through <= 1.0.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/sync-posts/vulnerability/wordpress-sync-posts-plugin-1-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-32585
Published: 2025-04-11
Description: Path Traversal: '.../...//' vulnerability in Trusty Plugins Shop Products Filter trusty-woo-products-filter allows PHP Local File Inclusion.This issue affects Shop Products Filter: from n/a through <= 1.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Plugin/trusty-woo-products-filter/vulnerability/wordpress-shop-products-filter-plugin-1-2-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-32586
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ABA Bank ABA PayWay Payment Gateway for WooCommerce aba-payway-woocommerce-payment-gateway allows Reflected XSS.This issue affects ABA PayWay Payment Gateway for WooCommerce: from n/a through <= 2.1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/aba-payway-woocommerce-payment-gateway/vulnerability/wordpress-aba-payway-payment-gateway-for-woocommerce-plugin-2-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32587
Published: 2025-04-11
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in pickupp WooCommerce Pickupp wc-pickupp allows PHP Local File Inclusion.This issue affects WooCommerce Pickupp: from n/a through <= 2.4.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/wc-pickupp/vulnerability/wordpress-woocommerce-pickupp-plugin-2-4-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-32589
Published: 2025-04-11
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in odude Flexi – Guest Submit flexi allows PHP Local File Inclusion.This issue affects Flexi – Guest Submit: from n/a through <= 4.28.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/flexi/vulnerability/wordpress-flexi-guest-submit-plugin-4-28-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-32598
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Table Builder WP Table Builder wp-table-builder allows Reflected XSS.This issue affects WP Table Builder: from n/a through <= 2.0.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-table-builder/vulnerability/wordpress-wp-table-builder-plugin-2-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32599
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in miunosoft Task Scheduler task-scheduler allows Reflected XSS.This issue affects Task Scheduler: from n/a through <= 1.6.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/task-scheduler/vulnerability/wordpress-task-scheduler-plugin-1-6-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32600
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tournamatch Tournamatch tournamatch allows Reflected XSS.This issue affects Tournamatch: from n/a through <= 4.7.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/tournamatch/vulnerability/wordpress-tournamatch-plugin-4-6-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32601
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in twispay Twispay Credit Card Payments twispay allows Reflected XSS.This issue affects Twispay Credit Card Payments: from n/a through <= 2.1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/twispay/vulnerability/wordpress-twispay-credit-card-payments-plugin-2-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32603
Published: 2025-04-11
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HK WP Online Users Stats wp-online-users-stats allows Blind SQL Injection.This issue affects WP Online Users Stats: from n/a through <= 1.0.0.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-online-users-stats/vulnerability/wordpress-wp-online-users-stats-plugin-1-0-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32607
Published: 2025-04-11
Description: Deserialization of Untrusted Data vulnerability in magepeopleteam WpBookingly service-booking-manager allows Object Injection.This issue affects WpBookingly: from n/a through <= 1.3.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/service-booking-manager/vulnerability/wordpress-wpbookingly-plugin-1-2-0-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32614
Published: 2025-04-11
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ashan Perera EventON eventon-lite allows PHP Local File Inclusion.This issue affects EventON: from n/a through <= 2.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/eventon-lite/vulnerability/wordpress-eventon-plugin-2-3-2-local-file-inclusion-vulnerability-2?_s_id=cve
CVE: CVE-2025-32618
Published: 2025-04-11
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PickPlugins Wishlist wishlist allows SQL Injection.This issue affects Wishlist: from n/a through <= 1.0.46.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wishlist/vulnerability/wordpress-wishlist-plugin-1-0-43-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32627
Published: 2025-04-11
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Job Manager js-jobs allows PHP Local File Inclusion.This issue affects JS Job Manager: from n/a through <= 2.0.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/js-jobs/vulnerability/wordpress-js-job-manager-plugin-2-0-2-local-file-inclusion-vulnerability-2?_s_id=cve
CVE: CVE-2025-32629
Published: 2025-04-11
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Path Traversal.This issue affects WP-BusinessDirectory: from n/a through <= 3.1.2.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/wp-businessdirectory/vulnerability/wordpress-wp-businessdirectory-plugin-3-1-2-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-32631
Published: 2025-04-11
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in oxygensuite Oxygen MyData for WooCommerce oxygen-mydata allows Path Traversal.This issue affects Oxygen MyData for WooCommerce: from n/a through <= 1.0.64.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/oxygen-mydata/vulnerability/wordpress-oxygen-mydata-for-woocommerce-plugin-1-0-63-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-32632
Published: 2025-04-11
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaizenCoders Automatic Ban IP automatic-ban-ip allows Reflected XSS.This issue affects Automatic Ban IP: from n/a through <= 1.0.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/automatic-ban-ip/vulnerability/wordpress-automatic-ban-ip-plugin-1-0-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32633
Published: 2025-04-11
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in neoslab Database Toolset database-toolset allows Path Traversal.This issue affects Database Toolset: from n/a through <= 1.8.4.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/database-toolset/vulnerability/wordpress-database-toolset-plugin-1-8-4-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-32650
Published: 2025-04-11
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ability, Inc Accessibility Suite online-accessibility allows SQL Injection.This issue affects Accessibility Suite: from n/a through <= 4.18.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/online-accessibility/vulnerability/wordpress-accessibility-suite-by-ability-inc-plugin-4-17-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32654
Published: 2025-04-11
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Stylemix Motors motors-car-dealership-classified-listings allows PHP Local File Inclusion.This issue affects Motors: from n/a through <= 1.4.71.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/motors-car-dealership-classified-listings/vulnerability/wordpress-motors-plugin-1-4-65-local-file-inclusion-vulnerability-2?_s_id=cve
CVE: CVE-2025-32656
Published: 2025-04-11
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Testimonial Slider And Showcase Pro testimonial-slider-showcase-pro allows PHP Local File Inclusion.This issue affects Testimonial Slider And Showcase Pro: from n/a through <= 2.3.15.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/testimonial-slider-showcase-pro/vulnerability/wordpress-testimonial-slider-and-showcase-pro-plugin-2-3-15-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-32663
Published: 2025-04-11
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in roninwp FAT Cooming Soon fat-coming-soon allows PHP Local File Inclusion.This issue affects FAT Cooming Soon: from n/a through <= 1.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/fat-coming-soon/vulnerability/wordpress-fat-cooming-soon-plugin-1-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-32671
Published: 2025-04-11
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in John Weissberg Print Science Designer print-science-designer allows Path Traversal.This issue affects Print Science Designer: from n/a through <= 1.3.155.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/print-science-designer/vulnerability/wordpress-print-science-designer-plugin-1-3-155-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2025-32672
Published: 2025-04-11
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Ultimate Bootstrap Elements for Elementor ultimate-bootstrap-elements-for-elementor allows PHP Local File Inclusion.This issue affects Ultimate Bootstrap Elements for Elementor: from n/a through <= 1.4.9.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-bootstrap-elements-for-elementor/vulnerability/wordpress-ultimate-bootstrap-elements-for-elementor-plugin-1-4-9-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-32681
Published: 2025-04-11
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Guru Error Log Viewer error-log-viewer-wp allows Blind SQL Injection.This issue affects Error Log Viewer: from n/a through <= 1.0.5.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/error-log-viewer-wp/vulnerability/wordpress-error-log-viewer-by-wp-guru-plugin-1-0-5-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-3434
Published: 2025-04-11
Description: The SMTP for Amazon SES – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/smtp-amazon-ses/trunk/includes/Functions.php; https://plugins.trac.wordpress.org/browser/smtp-amazon-ses/trunk/includes/Helper/Utils.php; https://plugins.trac.wordpress.org/changeset/3270161/
CVE: CVE-2025-2128
Published: 2025-04-11
Description: The Cost Calculator Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_ids’ parameter in all versions up to, and including, 3.2.67 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/cost-calculator-builder/trunk/includes/classes/models/Payments.php#L52; https://plugins.trac.wordpress.org/changeset/3263770/; https://wordpress.org/plugins/cost-calculator-builder/#developers
CVE: CVE-2025-31362
Published: 2025-04-11
Description: Use of hard-coded cryptographic key issue exists in BizRobo! all versions. Credentials inside robot files may be obtained if the encryption key is available.
The vendor provides the workaround information and recommends to apply it to the deployment environment.
CVSS Score: 3.7 (LOW)
CWE: CWE-321
References: https://jvn.jp/en/jp/JVN30641875/; https://knowledge.bizrobo.com/hc/ja/articles/[PII_REDACTED]71; https://knowledge.bizrobo.com/hc/ja/articles/[PII_REDACTED]7145
CVE: CVE-2025-31932
Published: 2025-04-11
Description: Deserialization of untrusted data issue exists in BizRobo! all versions. If this vulnerability is exploited, an arbitrary code is executed on the Management Console.
The vendor provides the workaround information and recommends to apply it to the deployment environment.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://jvn.jp/en/jp/JVN30641875/; https://knowledge.bizrobo.com/hc/ja/articles/[PII_REDACTED]71; https://knowledge.bizrobo.com/hc/ja/articles/[PII_REDACTED]7145
CVE: CVE-2024-52282
Published: 2025-04-11
Description: A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowing any users with GET
 access to the Rancher Manager Apps Catalog to read any sensitive information that are 
contained within the Apps’ values. Additionally, the same information 
leaks into auditing logs when the audit level is set to equal or above 
2.

This issue affects rancher: from 2.8.0 before 2.8.10, from 2.9.0 before 2.9.4.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52282; https://github.com/rancher/rancher/security/advisories/GHSA-9c5p-35gj-jqp4