deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-31065
Published: 2025-05-16
Description: Missing Authorization vulnerability in themeton Rozario allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rozario: from n/a through 1.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/theme/rozario/vulnerability/wordpress-rozario-1-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31066
Published: 2025-05-16
Description: Missing Authorization vulnerability in themeton Acerola acerola allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acerola: from n/a through <= 1.6.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/acerola/vulnerability/wordpress-acerola-1-6-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31068
Published: 2025-05-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in themeton Seven Stars allows Cross Site Request Forgery. This issue affects Seven Stars: from n/a through 1.4.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/wordpress/theme/sevenstars/vulnerability/wordpress-seven-stars-1-4-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-31071
Published: 2025-05-16
Description: Missing Authorization vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HotStar – Multi-Purpose Business Theme: from n/a through 1.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/theme/hotstar/vulnerability/wordpress-hotstar-multi-purpose-business-theme-1-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31630
Published: 2025-05-16
Description: Missing Authorization vulnerability in themeton The Business allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Business: from n/a through 1.6.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/theme/nrgbusiness/vulnerability/wordpress-the-business-1-6-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31637
Published: 2025-05-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup SHOUT lbg-audio8-html5-radio_ads allows SQL Injection.This issue affects SHOUT: from n/a through <= 3.5.3.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/lbg-audio8-html5-radio_ads/vulnerability/wordpress-shout-3-5-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31639
Published: 2025-05-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in themeton Spare allows Cross Site Request Forgery. This issue affects Spare: from n/a through 1.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/wordpress/theme/spare/vulnerability/wordpress-spare-1-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-31640
Published: 2025-05-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Magic Responsive Slider and Carousel WordPress magic-carousel allows SQL Injection.This issue affects Magic Responsive Slider and Carousel WordPress: from n/a through < 1.6.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/magic-carousel/vulnerability/wordpress-magic-responsive-slider-and-carousel-wordpress-1-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31641
Published: 2025-05-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup UberSlider uber-classic allows SQL Injection.This issue affects UberSlider: from n/a through < 2.6.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/uber-classic/vulnerability/wordpress-uberslider-2-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31915
Published: 2025-05-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder pixel-formbuilder allows Cross Site Request Forgery.This issue affects Pixel WordPress Form BuilderPlugin & Autoresponder: from n/a through <= 1.0.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/pixel-formbuilder/vulnerability/wordpress-pixel-wordpress-form-builderplugin-autoresponder-1-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-31921
Published: 2025-05-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Ultimate Tours Builder WP_UltimateToursBuilder allows Cross Site Request Forgery.This issue affects WP Ultimate Tours Builder: from n/a through <= 1.055.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/WP_UltimateToursBuilder/vulnerability/wordpress-wp-ultimate-tours-builder-1-055-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-31922
Published: 2025-05-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in QuanticaLabs CSS3 Accordions for WordPress css3_accordions allows Stored XSS.This issue affects CSS3 Accordions for WordPress: from n/a through <= 3.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/css3_accordions/vulnerability/wordpress-css3-accordions-for-wordpress-plugin-3-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31923
Published: 2025-05-16
Description: Missing Authorization vulnerability in QuanticaLabs CSS3 Accordions for WordPress css3_accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CSS3 Accordions for WordPress: from n/a through <= 3.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/css3_accordions/vulnerability/wordpress-css3-accordions-for-wordpress-3-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31926
Published: 2025-05-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Sticky Radio Player lbg-audio5-html5-shoutcast_sticky allows SQL Injection.This issue affects Sticky Radio Player: from n/a through <= 3.4.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/lbg-audio5-html5-shoutcast_sticky/vulnerability/wordpress-sticky-radio-player-3-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31928
Published: 2025-05-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Multimedia Responsive Carousel with Image Video Audio Support multimedia-carousel allows SQL Injection.This issue affects Multimedia Responsive Carousel with Image Video Audio Support: from n/a through <= 2.6.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/multimedia-carousel/vulnerability/wordpress-multimedia-responsive-carousel-with-image-video-audio-support-2-6-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32180
Published: 2025-05-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojofywp Product Carousel For WooCommerce – WoorouSell woorousell allows Stored XSS.This issue affects Product Carousel For WooCommerce – WoorouSell: from n/a through <= 1.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woorousell/vulnerability/wordpress-product-carousel-for-woocommerce-woorousell-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32245
Published: 2025-05-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in Chaser324 Featured Posts Scroll featured-posts-scroll allows Stored XSS.This issue affects Featured Posts Scroll: from n/a through <= 1.25.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/featured-posts-scroll/vulnerability/wordpress-featured-posts-scroll-plugin-1-25-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32287
Published: 2025-05-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Responsive HTML5 Audio Player PRO With Playlist lbg-audio2-html5 allows SQL Injection.This issue affects Responsive HTML5 Audio Player PRO With Playlist: from n/a through <= 3.5.7.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/lbg-audio2-html5/vulnerability/wordpress-responsive-html5-audio-player-pro-with-playlist-3-5-7-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32290
Published: 2025-05-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Sticky HTML5 Music Player lbg-audio3-html5 allows SQL Injection.This issue affects Sticky HTML5 Music Player: from n/a through <= 3.1.6.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/lbg-audio3-html5/vulnerability/wordpress-sticky-html5-music-player-3-1-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32295
Published: 2025-05-16
Description: Missing Authorization vulnerability in wordpresschef Salon Booking Pro salon-booking-plugin-pro-cc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon Booking Pro: from n/a through <= 10.10.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/salon-booking-plugin-pro-cc/vulnerability/wordpress-salon-booking-wordpress-plugin-10-10-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32296
Published: 2025-05-16
Description: Missing Authorization vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Link Directory: from n/a through < 14.8.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/qc-simple-link-directory/vulnerability/wordpress-simple-link-directory-pro-plugin-14-7-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32299
Published: 2025-05-16
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themovation QuickCal - Appointment Booking Calendar for WordPress quickcal allows Retrieve Embedded Sensitive Data.This issue affects QuickCal - Appointment Booking Calendar for WordPress: from n/a through <= 1.0.15.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/quickcal/vulnerability/wordpress-quickcal-1-0-15-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-32301
Published: 2025-05-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup CountDown Pro WP Plugin circular_countdown allows SQL Injection.This issue affects CountDown Pro WP Plugin: from n/a through <= 2.7.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/circular_countdown/vulnerability/wordpress-countdown-pro-wp-plugin-2-7-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32306
Published: 2025-05-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Radio Player Shoutcast & Icecast WordPress Plugin audio4-html5 allows Blind SQL Injection.This issue affects Radio Player Shoutcast & Icecast WordPress Plugin: from n/a through <= 4.4.6.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/audio4-html5/vulnerability/wordpress-radio-player-shoutcast-icecast-wordpress-plugin-4-4-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32307
Published: 2025-05-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Chameleon HTML5 Audio Player With/Without Playlist lbg-audio1-html5 allows SQL Injection.This issue affects Chameleon HTML5 Audio Player With/Without Playlist: from n/a through <= 3.5.6.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/lbg-audio1-html5/vulnerability/wordpress-chameleon-html5-audio-player-with-without-playlist-3-5-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32310
Published: 2025-05-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in ThemeMove QuickCal - Appointment Booking Calendar for WordPress quickcal allows Privilege Escalation.This issue affects QuickCal - Appointment Booking Calendar for WordPress: from n/a through <= 1.0.15.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/quickcal/vulnerability/wordpress-quickcal-plugin-1-0-13-csrf-to-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-32643
Published: 2025-05-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPGYM allows Blind SQL Injection. This issue affects WPGYM: from n/a through 65.0.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/wordpress/plugin/gym-management/vulnerability/wordpress-wpgym-plugin-65-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-39481
Published: 2025-05-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in imithemes Eventer eventer allows Blind SQL Injection.This issue affects Eventer: from n/a through < 3.11.4.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/eventer/vulnerability/wordpress-eventer-wordpress-event-booking-manager-plugin-plugin-3-9-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-39482
Published: 2025-05-16
Description: Missing Authorization vulnerability in imithemes Eventer eventer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eventer: from n/a through < 3.11.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/eventer/vulnerability/wordpress-eventer-wordpress-event-booking-manager-plugin-plugin-3-9-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-39491
Published: 2025-05-16
Description: Path Traversal vulnerability in WHMPress WHMpress allows Path Traversal. This issue affects WHMpress: from 6.2 through revision.
CVSS Score: 8.1 (HIGH)
CWE: CWE-35
References: https://patchstack.com/database/wordpress/plugin/whmpress/vulnerability/wordpress-whmpress-plugin-6-2-revision-9-local-file-inclusion-vulnerability-2?_s_id=cve
CVE: CVE-2025-39492
Published: 2025-05-16
Description: Path Traversal vulnerability in WHMPress WHMpress allows Relative Path Traversal. This issue affects WHMpress: from 6.2 through revision.
CVSS Score: 7.5 (HIGH)
CWE: CWE-35
References: https://patchstack.com/database/wordpress/plugin/whmpress/vulnerability/wordpress-whmpress-plugin-6-2-revision-9-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39493
Published: 2025-05-16
Description: Missing Authorization vulnerability in ValvePress Rankie valvepress-rankie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rankie: from n/a through < 1.8.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/valvepress-rankie/vulnerability/wordpress-rankie-1-8-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-39507
Published: 2025-05-16
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Nasa Core nasa-core allows PHP Local File Inclusion.This issue affects Nasa Core: from n/a through < 6.4.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98, CWE-829
References: https://patchstack.com/database/Wordpress/Plugin/nasa-core/vulnerability/wordpress-nasa-core-plugin-6-3-2-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39509
Published: 2025-05-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode TNC FlipBook pdf-viewer-for-wordpress allows Stored XSS.This issue affects TNC FlipBook: from n/a through <= 12.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/pdf-viewer-for-wordpress/vulnerability/wordpress-tnc-flipbook-plugin-12-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39511
Published: 2025-05-16
Description: Missing Authorization vulnerability in ValvePress Pinterest Automatic Pin wp-pinterest-automatic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinterest Automatic Pin: from n/a through <= 4.19.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-pinterest-automatic/vulnerability/wordpress-pinterest-automatic-pin-4-18-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-39537
Published: 2025-05-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blaze Concepts Better Customer List for WooCommerce woo-better-customer-list allows Reflected XSS.This issue affects Better Customer List for WooCommerce: from n/a through <= 1.2.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woo-better-customer-list/vulnerability/wordpress-better-customer-list-for-woocommerce-plugin-1-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-40906
Published: 2025-05-16
Description: BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities.

Those include CVE-2017-14227, CVE-2018-16790, CVE-2023-0437, CVE-2024-6381, CVE-2024-6383, and CVE-2025-0755. 

BSON-XS was the official Perl XS implementation of MongoDB's BSON serialization, but this distribution has reached its end of life as of August 13, 2020 and is no longer supported.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-190, CWE-1104
References: https://lists.debian.org/debian-lts-announce/2025/05/msg00012.html; https://www.mongodb.com/community/forums/t/mongodb-perl-driver-end-of-life/7890
CVE: CVE-2025-46464
Published: 2025-05-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scripteo Ads Pro ap-plugin-scripteo allows Stored XSS.This issue affects Ads Pro: from n/a through <= 5.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ap-plugin-scripteo/vulnerability/wordpress-ads-pro-plugin-4-88-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47534
Published: 2025-05-16
Description: Missing Authorization vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wordpress Auto Spinner: from n/a through <= 3.25.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-auto-spinner/vulnerability/wordpress-wordpress-auto-spinner-3-25-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-47556
Published: 2025-05-16
Description: Missing Authorization vulnerability in QuanticaLabs CSS3 Compare Pricing Tables for WordPress css3_web_pricing_tables_grids allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CSS3 Compare Pricing Tables for WordPress: from n/a through <= 11.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/css3_web_pricing_tables_grids/vulnerability/wordpress-css3-compare-pricing-tables-for-wordpress-11-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-47557
Published: 2025-05-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG mapsvg allows Stored XSS.This issue affects MapSVG: from n/a through <= 8.5.31.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mapsvg/vulnerability/wordpress-mapsvg-plugin-8-5-31-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47560
Published: 2025-05-16
Description: Missing Authorization vulnerability in RomanCode MapSVG mapsvg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSVG: from n/a through < 8.6.13.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/mapsvg/vulnerability/wordpress-mapsvg-plugin-8-5-32-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-47562
Published: 2025-05-16
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in RomanCode MapSVG mapsvg allows Code Injection.This issue affects MapSVG: from n/a through <= 8.5.34.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/mapsvg/vulnerability/wordpress-mapsvg-8-5-34-content-injection-vulnerability?_s_id=cve
CVE: CVE-2025-47563
Published: 2025-05-16
Description: Missing Authorization vulnerability in villatheme CURCY woocommerce-multi-currency allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects CURCY: from n/a through <= 2.3.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-multi-currency/vulnerability/wordpress-curcy-plugin-2-3-7-arbitrary-shortcode-execution-vulnerability?_s_id=cve
CVE: CVE-2025-47564
Published: 2025-05-16
Description: Missing Authorization vulnerability in ashanjay EventON eventon allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects EventON: from n/a through <= 4.9.8.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/eventon/vulnerability/wordpress-eventon-plugin-4-9-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-47567
Published: 2025-05-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Video Player & FullScreen Video Background universal-video-player-and-bg allows Blind SQL Injection.This issue affects Video Player & FullScreen Video Background: from n/a through <= 2.4.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/universal-video-player-and-bg/vulnerability/wordpress-video-player-fullscreen-video-background-plugin-2-4-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-47693
Published: 2025-05-16
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in roninwp FAT Services Booking fat-services-booking allows PHP Local File Inclusion.This issue affects FAT Services Booking: from n/a through <= 5.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/fat-services-booking/vulnerability/wordpress-fat-services-booking-plugin-5-5-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-48079
Published: 2025-05-16
Description: Missing Authorization vulnerability in Metagauss ProfileGrid  profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid : from n/a through <= 5.9.5.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/profilegrid-user-profiles-groups-and-communities/vulnerability/wordpress-profilegrid-5-9-5-1-broken-access-control-vulnerability?_s_id=cve