deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-58809
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in Nick Ciske To Lead For Salesforce salesforce-wordpress-to-lead allows Reflected XSS.This issue affects To Lead For Salesforce: from n/a through <= 2.7.3.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/salesforce-wordpress-to-lead/vulnerability/wordpress-to-lead-for-salesforce-plugin-2-7-3-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58810
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jimmywb Simple Link List Widget simple-link-list-widget allows Stored XSS.This issue affects Simple Link List Widget: from n/a through <= 0.3.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-link-list-widget/vulnerability/wordpress-simple-link-list-widget-plugin-0-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58811
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs Ultimate Client Dash ulimate-client-dash allows Stored XSS.This issue affects Ultimate Client Dash: from n/a through <= 4.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ulimate-client-dash/vulnerability/wordpress-ultimate-client-dash-plugin-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58812
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PriceListo Best Restaurant Menu by PriceListo best-restaurant-menu-by-pricelisto allows Stored XSS.This issue affects Best Restaurant Menu by PriceListo: from n/a through <= 1.4.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/best-restaurant-menu-by-pricelisto/vulnerability/wordpress-best-restaurant-menu-by-pricelisto-plugin-1-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58813
Published: 2025-09-05
Description: Missing Authorization vulnerability in themearile Consultstreet consultstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Consultstreet: from n/a through <= 3.0.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/consultstreet/vulnerability/wordpress-consultstreet-theme-3-0-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58814
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ram Ratan Maurya Stagtools stagtools allows Stored XSS.This issue affects Stagtools: from n/a through <= 2.3.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/stagtools/vulnerability/wordpress-stagtools-plugin-2-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58815
Published: 2025-09-05
Description: Deserialization of Untrusted Data vulnerability in Rubel Miah Aitasi Coming Soon aitasi-coming-soon allows Object Injection.This issue affects Aitasi Coming Soon: from n/a through <= 2.0.2.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/aitasi-coming-soon/vulnerability/wordpress-aitasi-coming-soon-plugin-2-0-2-deserialization-of-untrusted-data-vulnerability?_s_id=cve
CVE: CVE-2025-58816
Published: 2025-09-05
Description: Missing Authorization vulnerability in Plugin Devs Product Carousel Slider for Elementor ecommerce-product-carousel-slider-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Carousel Slider for Elementor: from n/a through <= 2.1.3.
CVSS Score: 3.5 (LOW)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/ecommerce-product-carousel-slider-for-elementor/vulnerability/wordpress-product-carousel-slider-for-elementor-plugin-2-1-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58817
Published: 2025-09-05
Description: Missing Authorization vulnerability in desertthemes SoftMe softme allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SoftMe: from n/a through <= 1.1.27.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/softme/vulnerability/wordpress-softme-theme-1-1-24-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58818
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in SwiftNinjaPro Developer Tools Blocker swiftninjapro-inspect-element-console-blocker allows Cross Site Request Forgery.This issue affects Developer Tools Blocker: from n/a through <= 3.2.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/swiftninjapro-inspect-element-console-blocker/vulnerability/wordpress-developer-tools-blocker-plugin-3-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58819
Published: 2025-09-05
Description: Unrestricted Upload of File with Dangerous Type vulnerability in CreedAlly Bulk Featured Image bulk-featured-image allows Upload a Web Shell to a Web Server.This issue affects Bulk Featured Image: from n/a through <= 1.2.4.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/bulk-featured-image/vulnerability/wordpress-bulk-featured-image-plugin-1-2-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-58820
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Carousel Ultimate carousel allows Stored XSS.This issue affects Carousel Ultimate: from n/a through <= 1.8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/carousel/vulnerability/wordpress-carousel-ultimate-plugin-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58821
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdever WP Notification Bell wp-notification-bell allows Stored XSS.This issue affects WP Notification Bell: from n/a through <= 1.4.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-notification-bell/vulnerability/wordpress-wp-notification-bell-plugin-1-4-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58822
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mndpsingh287 WP Mail wp-mail allows DOM-Based XSS.This issue affects WP Mail: from n/a through <= 1.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-mail/vulnerability/wordpress-wp-mail-plugin-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58823
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The African Boss Get Cash get-cash allows Stored XSS.This issue affects Get Cash: from n/a through <= 3.2.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/get-cash/vulnerability/wordpress-get-cash-plugin-3-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58824
Published: 2025-09-05
Description: Missing Authorization vulnerability in priyanshumittal Shk Corporate shk-corporate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shk Corporate: from n/a through <= 2.4.1.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/shk-corporate/vulnerability/wordpress-shk-corporate-theme-2-4-1-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58825
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Habibur Rahman Comment Form WP – Customize Default Comment Form comment-form-wp allows Stored XSS.This issue affects Comment Form WP – Customize Default Comment Form: from n/a through <= 2.0.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/comment-form-wp/vulnerability/wordpress-comment-form-wp-customize-default-comment-form-plugin-2-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58826
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric Mann WP Publication Archive  wp-publication-archive allows Stored XSS.This issue affects WP Publication Archive : from n/a through <= 3.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-publication-archive/vulnerability/wordpress-wp-publication-archive-plugin-3-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58827
Published: 2025-09-05
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in PickPlugins Job Board Manager job-board-manager allows Code Injection.This issue affects Job Board Manager: from n/a through <= 2.1.61.
CVSS Score: 3.8 (LOW)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/job-board-manager/vulnerability/wordpress-job-board-manager-plugin-2-1-61-content-injection-vulnerability?_s_id=cve
CVE: CVE-2025-58828
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codemstory 코드엠샵 소셜톡 mshop-naver-talktalk allows Stored XSS.This issue affects 코드엠샵 소셜톡: from n/a through <= 1.2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mshop-naver-talktalk/vulnerability/wordpress-plugin-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58829
Published: 2025-09-05
Description: Server-Side Request Forgery (SSRF) vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One ai-auto-tool allows Server Side Request Forgery.This issue affects Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One: from n/a through <= 2.3.3.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/ai-auto-tool/vulnerability/wordpress-ai-auto-tool-content-writing-assistant-gemini-writer-chatgpt-all-in-one-plugin-2-2-6-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-58830
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snagysandor Parallax Scrolling Enllax.js parallax-scrolling-enllax-js allows Stored XSS.This issue affects Parallax Scrolling Enllax.js: from n/a through <= 0.0.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/parallax-scrolling-enllax-js/vulnerability/wordpress-parallax-scrolling-enllax-js-plugin-0-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58831
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in snagysandor Parallax Scrolling Enllax.js parallax-scrolling-enllax-js allows Cross Site Request Forgery.This issue affects Parallax Scrolling Enllax.js: from n/a through <= 0.0.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/parallax-scrolling-enllax-js/vulnerability/wordpress-parallax-scrolling-enllax-js-plugin-0-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58832
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Search by Google search-google allows Stored XSS.This issue affects Search by Google: from n/a through <= 1.9.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/search-google/vulnerability/wordpress-search-by-google-plugin-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58833
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in INVELITY Invelity MyGLS connect invelity-mygls-connect allows Object Injection.This issue affects Invelity MyGLS connect: from n/a through <= 1.1.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/invelity-mygls-connect/vulnerability/wordpress-invelity-mygls-connect-plugin-1-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58834
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gugu short.io wp-shortcm allows DOM-Based XSS.This issue affects short.io: from n/a through <= 2.4.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-shortcm/vulnerability/wordpress-short-io-plugin-2-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58835
Published: 2025-09-05
Description: Improper Validation of Specified Quantity in Input vulnerability in calliko Bonus for Woo bonus-for-woo allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bonus for Woo: from n/a through <= 7.6.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1284
References: https://patchstack.com/database/Wordpress/Plugin/bonus-for-woo/vulnerability/wordpress-bonus-for-woo-plugin-7-4-1-other-vulnerability-type-vulnerability?_s_id=cve
CVE: CVE-2025-58836
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Franz Wieser FW Anker fw-anker allows Stored XSS.This issue affects FW Anker: from n/a through <= 1.2.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/fw-anker/vulnerability/wordpress-fw-anker-plugin-1-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58837
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shiful H SS Font Awesome Icon ss-font-awesome-icon allows Stored XSS.This issue affects SS Font Awesome Icon: from n/a through <= 4.1.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ss-font-awesome-icon/vulnerability/wordpress-ss-font-awesome-icon-plugin-4-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58838
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zakir Smooth Accordion smooth-accordion allows Stored XSS.This issue affects Smooth Accordion: from n/a through <= 2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/smooth-accordion/vulnerability/wordpress-smooth-accordion-plugin-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58839
Published: 2025-09-05
Description: Deserialization of Untrusted Data vulnerability in aThemeArt Translations eDS Responsive Menu eds-responsive-menu allows Object Injection.This issue affects eDS Responsive Menu: from n/a through <= 1.2.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/eds-responsive-menu/vulnerability/wordpress-eds-responsive-menu-plugin-1-2-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-58840
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ibnul H. Custom Team Manager custom-team-manager allows Stored XSS.This issue affects Custom Team Manager: from n/a through <= 2.4.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/custom-team-manager/vulnerability/wordpress-custom-team-manager-plugin-2-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58841
Published: 2025-09-05
Description: Incorrect Privilege Assignment vulnerability in John Luetke Media Author media-author allows Privilege Escalation.This issue affects Media Author: from n/a through <= 1.0.4.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/media-author/vulnerability/wordpress-media-author-plugin-1-0-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58842
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in givecloud Donation Forms WP by Givecloud donation-forms-by-givecloud allows Stored XSS.This issue affects Donation Forms WP by Givecloud: from n/a through <= 1.0.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/donation-forms-by-givecloud/vulnerability/wordpress-donation-forms-wp-by-givecloud-plugin-1-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58843
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in David Merinas Auto Last Youtube Video auto-last-youtube-video allows Stored XSS.This issue affects Auto Last Youtube Video: from n/a through <= 1.0.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/auto-last-youtube-video/vulnerability/wordpress-auto-last-youtube-video-plugin-1-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58844
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in Subhash Kumar Database to Excel database-to-excel allows Stored XSS.This issue affects Database to Excel: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/database-to-excel/vulnerability/wordpress-database-to-excel-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58845
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in ChrisHurst Bulk Watermark bulk-watermark allows Reflected XSS.This issue affects Bulk Watermark: from n/a through <= 1.6.10.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/bulk-watermark/vulnerability/wordpress-bulk-watermark-plugin-1-6-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58846
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in Dejan Markovic WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule buffer-my-post allows Reflected XSS.This issue affects WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule: from n/a through <= 2020.1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/buffer-my-post/vulnerability/wordpress-wordpress-buffer-hypesocial-social-media-auto-post-social-media-auto-publish-and-schedule-plugin-2020-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58847
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in Yaidier WN Flipbox Pro wn-flipbox-pro allows Reflected XSS.This issue affects WN Flipbox Pro: from n/a through <= 2.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wn-flipbox-pro/vulnerability/wordpress-wn-flipbox-pro-plugin-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58848
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in aakash1911 WP likes wp-likes allows Reflected XSS.This issue affects WP likes: from n/a through <= 3.1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-likes/vulnerability/wordpress-wp-likes-plugin-3-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58849
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in Deepak S Hide Real Download Path hide-real-download-path allows Stored XSS.This issue affects Hide Real Download Path: from n/a through <= 1.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/hide-real-download-path/vulnerability/wordpress-hide-real-download-path-plugin-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58850
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in marcshowpass Showpass WordPress Extension showpass allows Stored XSS.This issue affects Showpass WordPress Extension: from n/a through <= 4.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/showpass/vulnerability/wordpress-showpass-wordpress-extension-plugin-4-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58851
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DigitalCourt Boxed Content boxed-content allows Stored XSS.This issue affects Boxed Content: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/boxed-content/vulnerability/wordpress-boxed-content-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58852
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in Mark O'Donnell MSTW League Manager mstw-league-manager allows Stored XSS.This issue affects MSTW League Manager: from n/a through <= 2.10.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/mstw-league-manager/vulnerability/wordpress-mstw-league-manager-plugin-2-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58853
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Popping Sidebars and Widgets Light popping-sidebars-and-widgets-light allows Reflected XSS.This issue affects Popping Sidebars and Widgets Light: from n/a through <= 1.27.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/popping-sidebars-and-widgets-light/vulnerability/wordpress-popping-sidebars-and-widgets-light-plugin-1-27-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58854
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in Samer Bechara Ultimate AJAX Login ultimate-ajax-login allows Reflected XSS.This issue affects Ultimate AJAX Login: from n/a through <= 1.2.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-ajax-login/vulnerability/wordpress-ultimate-ajax-login-plugin-1-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58855
Published: 2025-09-05
Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in Denis V (Artprima) AP HoneyPot WordPress Plugin ap-honeypot allows Reflected XSS.This issue affects AP HoneyPot WordPress Plugin: from n/a through <= 1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-1236
References: https://patchstack.com/database/Wordpress/Plugin/ap-honeypot/vulnerability/wordpress-ap-honeypot-wordpress-plugin-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58856
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in ablancodev Woocommerce Notify Updated Product woocommerce-notify-updated-product allows Stored XSS.This issue affects Woocommerce Notify Updated Product: from n/a through <= 1.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-notify-updated-product/vulnerability/wordpress-woocommerce-notify-updated-product-plugin-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve