deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-53283
Published: 2025-11-06
Description: Unrestricted Upload of File with Dangerous Type vulnerability in borisolhor Drop Uploader for CF7 - Drag&Drop File Uploader Addon drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon allows Upload a Web Shell to a Web Server.This issue affects Drop Uploader for CF7 - Drag&Drop File Uploader Addon: from n/a through <= 2.4.1.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon/vulnerability/wordpress-drop-uploader-for-cf7-drag-drop-file-uploader-addon-plugin-2-4-1-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-53286
Published: 2025-11-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jhainey Milevis Dropify wc-dropi-integration allows Reflected XSS.This issue affects Dropify: from n/a through <= 4.7.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wc-dropi-integration/vulnerability/wordpress-dropify-plugin-4-6-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53316
Published: 2025-11-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel WP GDPR Cookie Consent wp-gdpr-cookie-consent allows Stored XSS.This issue affects WP GDPR Cookie Consent: from n/a through <= 1.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-gdpr-cookie-consent/vulnerability/wordpress-wp-gdpr-cookie-consent-plugin-1-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53324
Published: 2025-11-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeYatri Gutenify gutenify allows Stored XSS.This issue affects Gutenify: from n/a through <= 1.5.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/gutenify/vulnerability/wordpress-gutenify-plugin-1-5-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53349
Published: 2025-11-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Laborator Kalium kalium allows Reflected XSS.This issue affects Kalium: from n/a through <= 3.18.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/kalium/vulnerability/wordpress-kalium-theme-3-18-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53573
Published: 2025-11-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jegtheme Epic Review epic-review allows Reflected XSS.This issue affects Epic Review: from n/a through <= 1.0.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/epic-review/vulnerability/wordpress-epic-review-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53574
Published: 2025-11-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ptibogxiv Doliconnect doliconnect allows Reflected XSS.This issue affects Doliconnect: from n/a through <= 9.3.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/doliconnect/vulnerability/wordpress-doliconnect-plugin-9-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53585
Published: 2025-11-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme WeMusic noo-wemusic allows Reflected XSS.This issue affects WeMusic: from n/a through <= 1.9.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/noo-wemusic/vulnerability/wordpress-wemusic-theme-1-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53586
Published: 2025-11-06
Description: Deserialization of Untrusted Data vulnerability in NooTheme WeMusic noo-wemusic allows Object Injection.This issue affects WeMusic: from n/a through <= 1.9.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Theme/noo-wemusic/vulnerability/wordpress-wemusic-theme-1-9-1-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-54711
Published: 2025-11-06
Description: Missing Authorization vulnerability in bPlugins Info Cards info-cards allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Info Cards: from n/a through <= 1.0.11.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/info-cards/vulnerability/wordpress-info-cards-plugin-1-0-11-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-54718
Published: 2025-11-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Yogi - Health Beauty & Yoga noo-yogi allows Reflected XSS.This issue affects Yogi - Health Beauty & Yoga: from n/a through <= 2.9.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/noo-yogi/vulnerability/wordpress-yogi-health-beauty-yoga-theme-2-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54719
Published: 2025-11-06
Description: Deserialization of Untrusted Data vulnerability in NooTheme Yogi - Health Beauty & Yoga noo-yogi allows Object Injection.This issue affects Yogi - Health Beauty & Yoga: from n/a through <= 2.9.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Theme/noo-yogi/vulnerability/wordpress-yogi-health-beauty-yoga-theme-2-9-2-deserialization-of-untrusted-data-vulnerability?_s_id=cve
CVE: CVE-2025-54721
Published: 2025-11-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Resca resca allows Reflected XSS.This issue affects Resca: from n/a through <= 3.0.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/resca/vulnerability/wordpress-resca-theme-3-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54722
Published: 2025-11-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ex-Themes WooTour woo-tour allows Reflected XSS.This issue affects WooTour: from n/a through <= 3.6.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woo-tour/vulnerability/wordpress-wootour-plugin-3-6-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54737
Published: 2025-11-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.This issue affects Jobmonster: from n/a through <= 4.7.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/noo-jobmonster/vulnerability/wordpress-jobmonster-theme-4-7-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58207
Published: 2025-11-06
Description: Missing Authorization vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ai Image Alt Text Generator for WP: from n/a through <= 1.1.5.
CVSS Score: 8.2 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/ai-image-alt-text-generator-for-wp/vulnerability/wordpress-ai-image-alt-text-generator-for-wp-plugin-1-1-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58243
Published: 2025-11-06
Description: Missing Authorization vulnerability in Jthemes imEvent imevent allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects imEvent: from n/a through <= 3.4.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/imevent/vulnerability/wordpress-imevent-theme-3-4-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58592
Published: 2025-11-06
Description: Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through <= 2.10.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/translatepress-multilingual/vulnerability/wordpress-translatepress-plugin-2-10-2-deserialization-of-untrusted-data-vulnerability?_s_id=cve
CVE: CVE-2025-58595
Published: 2025-11-06
Description: Authentication Bypass by Spoofing vulnerability in Saad Iqbal All In One Login change-wp-admin-login allows Identity Spoofing.This issue affects All In One Login: from n/a through <= 2.0.8.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290
References: https://patchstack.com/database/Wordpress/Plugin/change-wp-admin-login/vulnerability/wordpress-all-in-one-login-plugin-2-0-8-bypass-vulnerability-vulnerability?_s_id=cve
CVE: CVE-2025-58619
Published: 2025-11-06
Description: Deserialization of Untrusted Data vulnerability in sbouey Falang multilanguage falang allows Object Injection.This issue affects Falang multilanguage: from n/a through <= 1.3.65.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/falang/vulnerability/wordpress-falang-multilanguage-plugin-1-3-65-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-58627
Published: 2025-11-06
Description: Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous Core Plugin: from n/a through < 2.0.9.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://patchstack.com/database/Wordpress/Plugin/miraculouscore/vulnerability/wordpress-miraculous-core-plugin-plugin-2-0-9-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2025-58629
Published: 2025-11-06
Description: Missing Authorization vulnerability in kamleshyadav Miraculous miraculous allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous: from n/a through < 2.0.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/miraculous/vulnerability/wordpress-miraculous-theme-2-0-9-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-58636
Published: 2025-11-06
Description: Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Object Injection.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/gf-infusionsoft/vulnerability/wordpress-wp-gravity-forms-keap-infusionsoft-plugin-1-2-3-deserialization-of-untrusted-data-vulnerability?_s_id=cve
CVE: CVE-2025-58638
Published: 2025-11-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Institutions Directory institutions-directory allows Reflected XSS.This issue affects Institutions Directory: from n/a through <= 1.3.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/institutions-directory/vulnerability/wordpress-institutions-directory-plugin-1-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58964
Published: 2025-11-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Enzy enzy allows Reflected XSS.This issue affects Enzy: from n/a through < 1.6.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/enzy/vulnerability/wordpress-enzy-theme-1-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58972
Published: 2025-11-06
Description: Path Traversal: '.../...//' vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Path Traversal.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.10.4.
CVSS Score: 7.2 (HIGH)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Plugin/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/vulnerability/wordpress-barcode-scanner-with-inventory-order-manager-plugin-1-10-4-path-traversal-vulnerability?_s_id=cve
CVE: CVE-2025-58986
Published: 2025-11-06
Description: Missing Authorization vulnerability in ganddser Jock On Air Now (JOAN) joan allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Jock On Air Now (JOAN): from n/a through <= 6.0.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/joan/vulnerability/wordpress-jock-on-air-now-joan-plugin-6-0-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58994
Published: 2025-11-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designervily Greenify greenify allows PHP Local File Inclusion.This issue affects Greenify: from n/a through <= 2.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/greenify/vulnerability/wordpress-greenify-theme-2-2-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-58995
Published: 2025-11-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creatives_Planet Leblix leblix allows PHP Local File Inclusion.This issue affects Leblix: from n/a through <= 2.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/leblix/vulnerability/wordpress-leblix-theme-2-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-58996
Published: 2025-11-06
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Upload a Web Shell to a Web Server.This issue affects Advanced Settings: from n/a through <= 3.1.1.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/advanced-settings/vulnerability/wordpress-advanced-settings-plugin-3-1-1-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-58998
Published: 2025-11-06
Description: Deserialization of Untrusted Data vulnerability in Cristián Lávaque s2Member s2member allows Object Injection.This issue affects s2Member: from n/a through <= 250701.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/s2member/vulnerability/wordpress-s2member-plugin-250701-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-59392
Published: 2025-11-06
Description: On Elspec G5 devices through 1.2.2.19, a person with physical access to the device can reset the Admin password by inserting a USB drive (containing a publicly documented reset string) into a USB port.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-288
References: https://www.elspec-ltd.com/metering-protection/g5-multi-functional-digital-fault-recorder/; https://www.elspec-ltd.com/support/security-advisories/
CVE: CVE-2025-59556
Published: 2025-11-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup GoStore gostore allows Reflected XSS.This issue affects GoStore: from n/a through < 1.6.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/gostore/vulnerability/wordpress-gostore-theme-1-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-5803
Published: 2025-11-06
Description: Missing Authorization vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.8.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/vikbooking/vulnerability/wordpress-vikbooking-hotel-booking-engine-pms-plugin-1-8-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-60073
Published: 2025-11-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Processby Responsive Sidebar responsive-sidebar allows PHP Local File Inclusion.This issue affects Responsive Sidebar: from n/a through <= 1.2.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/responsive-sidebar/vulnerability/wordpress-responsive-sidebar-plugin-1-2-2-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-60074
Published: 2025-11-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Processby Lazy Load Optimizer lazy-load-optimizer allows PHP Local File Inclusion.This issue affects Lazy Load Optimizer: from n/a through <= 1.4.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/lazy-load-optimizer/vulnerability/wordpress-lazy-load-optimizer-plugin-1-4-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-60187
Published: 2025-11-06
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Using Malicious Files.This issue affects Atarim: from n/a through <= 4.2.1.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/atarim-visual-collaboration/vulnerability/wordpress-atarim-plugin-4-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-60188
Published: 2025-11-06
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Retrieve Embedded Sensitive Data.This issue affects Atarim: from n/a through <= 4.2.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/atarim-visual-collaboration/vulnerability/wordpress-atarim-plugin-4-2-sensitive-data-exposure-vulnerability-2?_s_id=cve
CVE: CVE-2025-60189
Published: 2025-11-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PoloPag PoloPag – Pix Automático para Woocommerce wc-polo-payments allows PHP Local File Inclusion.This issue affects PoloPag – Pix Automático para Woocommerce: from n/a through <= 2.0.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/wc-polo-payments/vulnerability/wordpress-polopag-pix-automatico-para-woocommerce-plugin-2-0-9-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-60190
Published: 2025-11-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hinnerk Altenburg Immocaster WordPress Plugin immocaster allows PHP Local File Inclusion.This issue affects Immocaster WordPress Plugin: from n/a through <= 1.3.6.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/immocaster/vulnerability/wordpress-immocaster-wordpress-plugin-plugin-1-3-6-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-60191
Published: 2025-11-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Wishlist for WooCommerce premmerce-woocommerce-wishlist allows PHP Local File Inclusion.This issue affects Premmerce Wishlist for WooCommerce: from n/a through <= 1.1.10.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/premmerce-woocommerce-wishlist/vulnerability/wordpress-premmerce-wishlist-for-woocommerce-plugin-1-1-10-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-60192
Published: 2025-11-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Wholesale Pricing for WooCommerce premmerce-woocommerce-wholesale-pricing allows PHP Local File Inclusion.This issue affects Premmerce Wholesale Pricing for WooCommerce: from n/a through <= 1.1.10.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/premmerce-woocommerce-wholesale-pricing/vulnerability/wordpress-premmerce-wholesale-pricing-for-woocommerce-plugin-1-1-10-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-60193
Published: 2025-11-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows PHP Local File Inclusion.This issue affects Premmerce User Roles: from n/a through <= 1.0.13.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/premmerce-user-roles/vulnerability/wordpress-premmerce-user-roles-plugin-1-0-13-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-60194
Published: 2025-11-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Product Search for WooCommerce premmerce-search allows PHP Local File Inclusion.This issue affects Premmerce Product Search for WooCommerce: from n/a through <= 2.2.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/premmerce-search/vulnerability/wordpress-premmerce-product-search-for-woocommerce-plugin-2-2-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-60195
Published: 2025-11-06
Description: Incorrect Privilege Assignment vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Privilege Escalation.This issue affects Atarim: from n/a through <= 4.2.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/atarim-visual-collaboration/vulnerability/wordpress-atarim-plugin-4-2-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-60196
Published: 2025-11-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Clearblue Clearblue® Ovulation Calculator clearblue-ovulation-calculator allows PHP Local File Inclusion.This issue affects Clearblue® Ovulation Calculator: from n/a through <= 1.2.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/clearblue-ovulation-calculator/vulnerability/wordpress-clearblue-ovulation-calculator-plugin-1-2-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-60197
Published: 2025-11-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in owenr88 Simple Contact Forms simple-contact-forms allows PHP Local File Inclusion.This issue affects Simple Contact Forms: from n/a through <= 1.6.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/simple-contact-forms/vulnerability/wordpress-simple-contact-forms-plugin-1-6-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-60198
Published: 2025-11-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in dedalx Saxon - Viral Content Blog & Magazine Marketing WordPress Theme saxon allows PHP Local File Inclusion.This issue affects Saxon - Viral Content Blog & Magazine Marketing WordPress Theme: from n/a through <= 1.9.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/saxon/vulnerability/wordpress-saxon-viral-content-blog-magazine-marketing-wordpress-theme-theme-1-9-3-local-file-inclusion-vulnerability?_s_id=cve