deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-47421
Published: 2025-09-03
Description: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in CRESTRON TOUCHSCREENS x70 allows Argument Injection.This issue affects TOUCHSCREENS x70: from 3.001.0031.001 through 3.001.0034.001.

A specially crafted SCP command sent via SSH login string can lead a valid administrator user to gain Privileged Operating System access on the device.


Following Products Models are affected:

TSW-x70 
TSW-x60 
TST-1080
AM-3000/3100/3200
Soundbar VB70
HD-PS622/621/402
HD-TXU-RXU-4kZ-211
HD-MDNXM-4KZ-E

*Note: additional firmware updates will be published once made available
CWE: CWE-88
References: https://https://www.crestron.com/Software-Firmware/Firmware/Touchpanels/TS-770-TS-1070-TSS-770-TSS-1070-TSW-570/3-002-0040-001; https://https://www.crestron.com/release_notes/tsw-xx70_3.002.0040.001_release_notes.pdf; https://security.crestron.com
CVE: CVE-2025-9822
Published: 2025-09-03
Description: SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available.

ImpactAn administrator who usually does not have access to certain parameters, such as database credentials, can disclose them.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-283
References: https://github.com/mautic/mautic/security/advisories/GHSA-438m-6mhw-hq5w
CVE: CVE-2025-56608
Published: 2025-09-03
Description: The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`. The `handleDigest()` function employs `MessageDigest.getInstance("MD5")` to hash credentials. MD5 is a broken cryptographic algorithm known to allow hash collisions. This makes the authentication mechanism vulnerable to replay, spoofing, or brute-force attacks, potentially leading to unauthorized access. The vulnerability corresponds to CWE-327 and aligns with OWASP M5: Insufficient Cryptography and MASVS MSTG-CRYPTO-4.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-290
References: https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4; https://github.com/anonaninda/Aninda-security-advisories/blob/main/CVE-2025-56608.md; https://www.sourcecodester.com/android/14292/android-corona-virus-tracker-app-india-using-b4a.html
CVE: CVE-2025-57052
Published: 2025-09-03
Description: cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-129
References: https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability; https://lists.debian.org/debian-lts-announce/2025/09/msg00019.html
CVE: CVE-2025-57146
Published: 2025-09-03
Description: phpgurukul Complaint Management System in PHP 2.0 is vulnerable to SQL Injection in user/reset-password.php via the mobileno parameter.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://doc.clickup.com/3897127/p/h/3pxt7-12536/a7b1b87ee99576c; https://github.com/hptcybersecurity/CVE/blob/main/CVE-2025-57146.md
CVE: CVE-2025-57147
Published: 2025-09-03
Description: A SQL Injection vulnerability was found in phpgurukul Complaint Management System 2.0. The vulnerability is due to lack of input validation of multiple parameters including fullname, email, and contactno in user/registration.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://doc.clickup.com/3897127/p/h/3pxt7-12556/5435bb675762866; https://github.com/hptcybersecurity/CVE/blob/main/CVE-2025-57147.md
CVE: CVE-2025-57148
Published: 2025-09-03
Description: phpgurukul Online Shopping Portal 2.0 is vulnerable to Arbitrary File Upload in /admin/insert-product.php, due to the lack of extension validation.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://doc.clickup.com/3897127/p/h/3pxt7-12496/7fdf159633a77d1; https://github.com/hptcybersecurity/CVE/blob/main/CVE-2025-57148.md
CVE: CVE-2025-57149
Published: 2025-09-03
Description: phpgurukul Complaint Management System 2.0 is vulnerable to SQL Injection in /complaint-details.php via the cid parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://doc.clickup.com/3897127/p/h/3pxt7-12476/312c6ba68f555ca; https://github.com/hptcybersecurity/CVE/blob/main/CVE-2025-57149.md
CVE: CVE-2025-57150
Published: 2025-09-03
Description: phpgurukul Complaint Management System in PHP 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/subcategory.php via the categoryName parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://doc.clickup.com/3897127/p/h/3pxt7-12756/8bc08c993926810; https://github.com/hptcybersecurity/CVE/blob/main/CVE-2025-57150.md
CVE: CVE-2025-57151
Published: 2025-09-03
Description: phpgurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/userprofile.php via the fullname parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: https://doc.clickup.com/3897127/p/h/3pxt7-12776/9223d87ec68de28; https://github.com/hptcybersecurity/CVE/blob/main/CVE-2025-57151.md
CVE: CVE-2025-58458
Published: 2025-09-03
Description: In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying `amazon-s3` protocol for use with JGit, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-538
References: https://www.jenkins.io/security/advisory/2025-09-03/#SECURITY-3590; http://www.openwall.com/lists/oss-security/2025/09/03/4
CVE: CVE-2025-58459
Published: 2025-09-03
Description: Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://www.jenkins.io/security/advisory/2025-09-03/#SECURITY-3535; http://www.openwall.com/lists/oss-security/2025/09/03/4
CVE: CVE-2025-58460
Published: 2025-09-03
Description: A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-862
References: https://www.jenkins.io/security/advisory/2025-09-03/#SECURITY-3602; http://www.openwall.com/lists/oss-security/2025/09/03/4
CVE: CVE-2025-58593
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fox by ThemeIsle themeisle-companion allows Stored XSS.This issue affects Orbit Fox by ThemeIsle: from n/a through <= 3.0.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/themeisle-companion/vulnerability/wordpress-orbit-fox-by-themeisle-plugin-3-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58594
Published: 2025-09-03
Description: Missing Authorization vulnerability in themefusecom Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through <= 2.7.12.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/brizy/vulnerability/wordpress-brizy-plugin-2-7-12-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58596
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in properfraction MailOptin mailoptin allows Stored XSS.This issue affects MailOptin: from n/a through <= 1.2.75.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mailoptin/vulnerability/wordpress-mailoptin-plugin-1-2-75-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58597
Published: 2025-09-03
Description: Authorization Bypass Through User-Controlled Key vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpForo Forum: from n/a through <= 2.4.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/Wordpress/Plugin/wpforo/vulnerability/wordpress-wpforo-forum-plugin-2-4-6-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2025-58598
Published: 2025-09-03
Description: Insertion of Sensitive Information Into Debugging Code vulnerability in Klarna Klarna Order Management for WooCommerce klarna-order-management-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Klarna Order Management for WooCommerce: from n/a through <= 1.9.8.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-215
References: https://patchstack.com/database/Wordpress/Plugin/klarna-order-management-for-woocommerce/vulnerability/wordpress-klarna-order-management-for-woocommerce-plugin-1-9-8-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-58599
Published: 2025-09-03
Description: Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through <= 4.1.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/order-delivery-date-for-woocommerce/vulnerability/wordpress-order-delivery-date-for-woocommerce-plugin-4-1-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58600
Published: 2025-09-03
Description: Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through <= 2.15.9.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/paid-member-subscriptions/vulnerability/wordpress-paid-member-subscriptions-plugin-2-15-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58601
Published: 2025-09-03
Description: Missing Authorization vulnerability in RadiusTheme Classified Listing classified-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Classified Listing: from n/a through <= 5.0.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/classified-listing/vulnerability/wordpress-classified-listing-plugin-5-0-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58602
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Stored XSS.This issue affects If-So Dynamic Content Personalization: from n/a through <= 1.9.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/if-so/vulnerability/wordpress-if-so-dynamic-content-personalization-plugin-1-9-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58603
Published: 2025-09-03
Description: Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through <= 1.6.4.574.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/surferseo/vulnerability/wordpress-surfer-plugin-1-6-4-574-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58604
Published: 2025-09-03
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFunnels Mail Mint mail-mint allows SQL Injection.This issue affects Mail Mint: from n/a through <= 1.18.5.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/mail-mint/vulnerability/wordpress-mail-mint-plugin-1-18-5-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-58605
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Delicious WP Delicious delicious-recipes allows Stored XSS.This issue affects WP Delicious: from n/a through <= 1.8.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/delicious-recipes/vulnerability/wordpress-wp-delicious-plugin-1-8-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58606
Published: 2025-09-03
Description: Missing Authorization vulnerability in cozythemes SaasLauncher saaslauncher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SaasLauncher: from n/a through <= 1.3.0.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/saaslauncher/vulnerability/wordpress-saaslauncher-theme-1-3-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58607
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GDPR Info Cookie Notice & Consent Banner for GDPR & CCPA Compliance cookie-notice-and-consent-banner allows Stored XSS.This issue affects Cookie Notice & Consent Banner for GDPR & CCPA Compliance: from n/a through <= 1.7.11.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cookie-notice-and-consent-banner/vulnerability/wordpress-cookie-notice-consent-banner-for-gdpr-ccpa-compliance-plugin-1-7-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58608
Published: 2025-09-03
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BuddyDev MediaPress mediapress allows PHP Local File Inclusion.This issue affects MediaPress: from n/a through <= 1.5.9.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/mediapress/vulnerability/wordpress-mediapress-plugin-1-5-9-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-58609
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Stored XSS.This issue affects Latest Post Shortcode: from n/a through <= 14.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/latest-post-shortcode/vulnerability/wordpress-latest-post-shortcode-plugin-14-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58610
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through <= 1.3.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/photoblocks-grid-gallery/vulnerability/wordpress-gallery-photoblocks-plugin-1-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58611
Published: 2025-09-03
Description: Cross-Site Request Forgery (CSRF) vulnerability in Tickera Tickera tickera-event-ticketing-system allows Cross Site Request Forgery.This issue affects Tickera: from n/a through <= 3.5.5.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/tickera-event-ticketing-system/vulnerability/wordpress-tickera-plugin-3-5-5-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58612
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Stored XSS.This issue affects PropertyHive: from n/a through <= 2.1.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/propertyhive/vulnerability/wordpress-propertyhive-plugin-2-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58613
Published: 2025-09-03
Description: Missing Authorization vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Posts Table with Search & Sort: from n/a through <= 1.4.10.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/posts-data-table/vulnerability/wordpress-posts-table-with-search-sort-plugin-1-4-10-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58614
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jamel.Z Tooltipy bluet-keywords-tooltip-generator allows Stored XSS.This issue affects Tooltipy: from n/a through <= 5.5.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bluet-keywords-tooltip-generator/vulnerability/wordpress-tooltipy-plugin-5-5-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58615
Published: 2025-09-03
Description: Server-Side Request Forgery (SSRF) vulnerability in gfazioli WP Bannerize Pro wp-bannerize-pro allows Server Side Request Forgery.This issue affects WP Bannerize Pro: from n/a through <= 1.10.0.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/wp-bannerize-pro/vulnerability/wordpress-wp-bannerize-pro-plugin-1-10-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-58616
Published: 2025-09-03
Description: Missing Authorization vulnerability in Frisbii Frisbii Pay reepay-checkout-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frisbii Pay: from n/a through <= 1.8.2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/reepay-checkout-gateway/vulnerability/wordpress-frisbii-pay-plugin-1-8-2-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58617
Published: 2025-09-03
Description: Missing Authorization vulnerability in FAKTOR VIER F4 Media Taxonomies f4-media-taxonomies allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects F4 Media Taxonomies: from n/a through <= 1.1.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/f4-media-taxonomies/vulnerability/wordpress-f4-media-taxonomies-plugin-1-1-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58618
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Jernigan Pie Calendar pie-calendar allows DOM-Based XSS.This issue affects Pie Calendar: from n/a through <= 1.2.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/pie-calendar/vulnerability/wordpress-pie-calendar-plugin-1-2-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58620
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Stored XSS.This issue affects PDF for WPForms: from n/a through <= 6.2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/pdf-for-wpforms/vulnerability/wordpress-pdf-for-wpforms-plugin-6-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58621
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amuse Labs PuzzleMe for WordPress puzzleme allows Stored XSS.This issue affects PuzzleMe for WordPress: from n/a through <= 1.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/puzzleme/vulnerability/wordpress-puzzleme-for-wordpress-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58622
Published: 2025-09-03
Description: Missing Authorization vulnerability in yydevelopment Mobile Contact Line mobile-contact-line allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile Contact Line: from n/a through <= 2.4.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/mobile-contact-line/vulnerability/wordpress-mobile-contact-line-plugin-2-4-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58623
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bohemia Plugins Event Feed for Eventbrite event-feed-for-eventbrite allows DOM-Based XSS.This issue affects Event Feed for Eventbrite: from n/a through <= 1.3.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/event-feed-for-eventbrite/vulnerability/wordpress-event-feed-for-eventbrite-plugin-1-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58624
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in falselight Exchange Rates exchange-rates allows Stored XSS.This issue affects Exchange Rates: from n/a through <= 1.2.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/exchange-rates/vulnerability/wordpress-exchange-rates-plugin-1-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58625
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through <= 5.2.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-imageflow2/vulnerability/wordpress-wp-flow-plus-plugin-5-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58626
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RumbleTalk RumbleTalk Live Group Chat rumbletalk-chat-a-chat-with-themes allows Stored XSS.This issue affects RumbleTalk Live Group Chat: from n/a through <= 6.3.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/rumbletalk-chat-a-chat-with-themes/vulnerability/wordpress-rumbletalk-live-group-chat-plugin-6-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58630
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rbaer Simple Matomo Tracking Code simple-matomo-tracking-code allows Stored XSS.This issue affects Simple Matomo Tracking Code: from n/a through <= 1.1.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-matomo-tracking-code/vulnerability/wordpress-simple-matomo-tracking-code-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58631
Published: 2025-09-03
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZEEN101 IssueM issuem allows DOM-Based XSS.This issue affects IssueM: from n/a through <= 2.9.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/issuem/vulnerability/wordpress-issuem-plugin-2-9-0-cross-site-scripting-xss-vulnerability?_s_id=cve