deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-39368
Published: 2025-05-19
Description: Missing Authorization vulnerability in ed4becky Rootspersona rootspersona allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rootspersona: from n/a through <= 3.7.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/rootspersona/vulnerability/wordpress-rootspersona-plugin-3-7-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-39369
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sihibbs Posts for Page posts-for-page allows DOM-Based XSS.This issue affects Posts for Page: from n/a through <= 2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/posts-for-page/vulnerability/wordpress-posts-for-page-plugin-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39370
Published: 2025-05-19
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cnilsson iCafe Library icafe-library allows SQL Injection.This issue affects iCafe Library: from n/a through <= 1.8.3.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/icafe-library/vulnerability/wordpress-icafe-library-plugin-1-8-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-39371
Published: 2025-05-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in Sanjeev Mohindra Author Box Plugin With Different Description author-box-with-different-description allows Cross Site Request Forgery.This issue affects Author Box Plugin With Different Description: from n/a through <= 1.3.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/author-box-with-different-description/vulnerability/wordpress-author-box-plugin-with-different-description-plugin-1-3-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-39373
Published: 2025-05-19
Description: Missing Authorization vulnerability in jegtheme JNews jnews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JNews: from n/a through <= 11.6.16.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/jnews/vulnerability/wordpress-jnews-theme-11-6-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-39374
Published: 2025-05-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in aseem1234 Best Posts Summary best-posts-summary allows Stored XSS.This issue affects Best Posts Summary: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/best-posts-summary/vulnerability/wordpress-best-posts-summary-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39375
Published: 2025-05-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in Ashok G Easy Child Theme Creator easy-child-theme-creator allows Cross Site Request Forgery.This issue affects Easy Child Theme Creator: from n/a through <= 1.3.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/easy-child-theme-creator/vulnerability/wordpress-easy-child-theme-creator-plugin-1-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-39376
Published: 2025-05-19
Description: Missing Authorization vulnerability in QuanticaLabs Car Park Booking System for WordPress car-park-booking-system-for-wordpress.This issue affects Car Park Booking System for WordPress: from n/a through <= 2.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/car-park-booking-system-for-wordpress/vulnerability/wordpress-car-park-booking-system-for-wordpress-plugin-2-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-39388
Published: 2025-05-19
Description: Missing Authorization vulnerability in Solid Plugins AnalyticsWP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AnalyticsWP: from n/a through 2.0.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/analyticswp/vulnerability/wordpress-analyticswp-plugin-2-0-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-39394
Published: 2025-05-19
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Solid Plugins AnalyticsWP allows Retrieve Embedded Sensitive Data.This issue affects AnalyticsWP: from n/a through 2.1.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/wordpress/plugin/analyticswp/vulnerability/wordpress-analyticswp-plugin-2-1-2-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-46262
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zack Katz Mad Mimi for WordPress mad-mimi allows Stored XSS.This issue affects Mad Mimi for WordPress: from n/a through <= 1.5.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mad-mimi/vulnerability/wordpress-mad-mimi-for-wordpress-plugin-1-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46263
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lloyd Saunders Author Box After Posts author-box-after-posts allows Stored XSS.This issue affects Author Box After Posts: from n/a through <= 1.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/author-box-after-posts/vulnerability/wordpress-author-box-after-posts-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46543
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CharlyLeetham Enhanced Paypal Shortcodes enhanced-paypal-shortcodes allows Stored XSS.This issue affects Enhanced Paypal Shortcodes: from n/a through <= 0.5a.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/enhanced-paypal-shortcodes/vulnerability/wordpress-enhanced-paypal-shortcodes-plugin-0-5a-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47576
Published: 2025-05-19
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Bringthepixel Bimber - Viral Magazine WordPress Theme.This issue affects Bimber - Viral Magazine WordPress Theme: from n/a through 9.2.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/wordpress/theme/bimber/vulnerability/wordpress-bimber-viral-magazine-wordpress-theme-theme-9-2-5-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-47583
Published: 2025-05-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Cross Site Request Forgery.This issue affects Salon booking system: from n/a through <= 10.16.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/salon-booking-system/vulnerability/wordpress-salon-booking-system-plugin-10-16-csrf-to-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-4940
Published: 2025-05-19
Description: A vulnerability, which was classified as critical, has been found in 1000 Projects Daily College Class Work Report Book 1.0. This issue affects some unknown processing of the file /admin_info.php. The manipulation of the argument batch leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://1000projects.org/; https://github.com/ubfbuz3/cve/issues/15; https://vuldb.com/?ctiid.309503
CVE: CVE-2025-4941
Published: 2025-05-19
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Credit Card Application Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/GIRISH05/Credit-card-application-management-system/blob/main/SQL-Injection.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.309504
CVE: CVE-2025-4945
Published: 2025-05-19
Description: A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker to bypass cookie expiration logic, causing persistent or unintended cookie behavior. The issue stems from improper validation of large integer inputs during date arithmetic operations within the cookie parsing routines.
CVSS Score: 3.7 (LOW)
CWE: CWE-190
References: https://access.redhat.com/errata/RHSA-2025:19713; https://access.redhat.com/errata/RHSA-2025:19714; https://access.redhat.com/errata/RHSA-2025:19720
CVE: CVE-2025-22287
Published: 2025-05-19
Description: Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – FreightQuote Edition ltl-freight-quotes-freightquote-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LTL Freight Quotes – FreightQuote Edition: from n/a through <= 2.3.11.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/ltl-freight-quotes-freightquote-edition/vulnerability/wordpress-ltl-freight-quotes-freightquote-edition-plugin-2-3-11-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-26735
Published: 2025-05-19
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Candid themes Grip.This issue affects Grip: from n/a through 1.0.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/wordpress/theme/grip/vulnerability/wordpress-grip-theme-1-0-9-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-26872
Published: 2025-05-19
Description: Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Eximius allows Using Malicious Files.This issue affects Eximius: from n/a through 2.2.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/wordpress/theme/eximius/vulnerability/wordpress-eximius-theme-2-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-26892
Published: 2025-05-19
Description: Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Celestial Aura allows Using Malicious Files.This issue affects Celestial Aura: from n/a through 2.2.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/wordpress/theme/celestial-aura/vulnerability/wordpress-celestial-aura-plugin-2-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-26997
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in validas Wireless Butler wireless-butler allows Reflected XSS.This issue affects Wireless Butler: from n/a through <= 1.0.11.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/wireless-butler/vulnerability/wordpress-wireless-butler-plugin-1-0-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27010
Published: 2025-05-19
Description: Path Traversal: '.../...//' vulnerability in bslthemes Tastyc tastyc allows PHP Local File Inclusion.This issue affects Tastyc: from n/a through < 2.5.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Theme/tastyc/vulnerability/wordpress-tastyc-2-5-2-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39396
Published: 2025-05-19
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetReviews jet-reviews allows PHP Local File Inclusion.This issue affects JetReviews: from n/a through <= 2.3.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/jet-reviews/vulnerability/wordpress-jetreviews-plugin-2-3-6-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39398
Published: 2025-05-19
Description: Missing Authorization vulnerability in Themovation Bellevue bellevuex.This issue affects Bellevue: from n/a through <= 4.2.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/bellevuex/vulnerability/wordpress-hotel-bed-and-breakfast-booking-calendar-theme-bellevue-theme-4-2-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-39412
Published: 2025-05-19
Description: Missing Authorization vulnerability in averta Master Slider master-slider.This issue affects Master Slider: from n/a through <= 3.11.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/master-slider/vulnerability/wordpress-master-slider-plugin-3-10-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-39448
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.4.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/jet-elements/vulnerability/wordpress-jetelements-for-elementor-plugin-2-7-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39450
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through <= 2.2.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/jet-tabs/vulnerability/wordpress-jettabs-plugin-2-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39454
Published: 2025-05-19
Description: Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory.This issue affects Name Directory: from n/a through <= 1.30.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/name-directory/vulnerability/wordpress-name-directory-plugin-1-30-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-39460
Published: 2025-05-19
Description: Missing Authorization vulnerability in ThimPress Eduma eduma allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eduma: from n/a through <= 5.6.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/eduma/vulnerability/wordpress-eduma-theme-5-6-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-43833
Published: 2025-05-19
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Amir Helzer Absolute Links absolute-links allows Blind SQL Injection.This issue affects Absolute Links: from n/a through <= 1.1.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/absolute-links/vulnerability/wordpress-absolute-links-plugin-1-1-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-43834
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tox82 cookieBAR cookiebar allows Stored XSS.This issue affects cookieBAR: from n/a through <= 1.7.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cookiebar/vulnerability/wordpress-cookiebar-plugin-1-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-43835
Published: 2025-05-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in ktsvetkov wp-cyr-cho wp-cyr-cho allows Cross Site Request Forgery.This issue affects wp-cyr-cho: from n/a through <= 0.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-cyr-cho/vulnerability/wordpress-wp-cyr-cho-plugin-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-43840
Published: 2025-05-19
Description: Cross-Site Request Forgery (CSRF) vulnerability in ref CheckBot checkbot allows Stored XSS.This issue affects CheckBot: from n/a through <= 1.05.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/checkbot/vulnerability/wordpress-checkbot-plugin-1-05-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-43841
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jamesdbruner WP Vegas vegas-fullscreen-background-slider allows Stored XSS.This issue affects WP Vegas: from n/a through <= 2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/vegas-fullscreen-background-slider/vulnerability/wordpress-wp-vegas-plugin-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47282
Published: 2025-05-19
Description: Gardener External DNS Management is an environment to manage external DNS entries for a kubernetes cluster. A security vulnerability was discovered in Gardener's External DNS Management prior to version 0.23.6 that could allow a user with administrative privileges for a Gardener project or a user with administrative privileges for a shoot cluster, including administrative privileges for a single namespace of the shoot cluster, to obtain control over the seed cluster where the shoot cluster is managed. This CVE affects all Gardener installations no matter of the public cloud provider(s) used for the seed clusters/shoot clusters. The affected component is `gardener/external-dns-management`. The `external-dns-management` component may also be deployed on the seeds by the `gardener/gardener-extension-shoot-dns-service` extension when the extension is enabled. In this case, all versions of the `shoot-dns-service` extension `<= v1.60.0` are affected by this vulnerability. Version 0.23.6 of Gardener External DNS Management fixes the issue.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-20
References: https://github.com/gardener/external-dns-management/security/advisories/GHSA-xwgg-m7fx-83wx
CVE: CVE-2025-47582
Published: 2025-05-19
Description: Deserialization of Untrusted Data vulnerability in QuantumCloud WPBot Pro Wordpress Chatbot allows Object Injection.This issue affects WPBot Pro Wordpress Chatbot: from n/a through 12.7.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/wordpress/plugin/wpbot-pro/vulnerability/wordpress-wpbot-pro-wordpress-chatbot-12-7-0-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-39403
Published: 2025-05-19
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPAMS apartment-management allows SQL Injection.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/apartment-management/vulnerability/wordpress-wpams-plugin-44-0-17-08-2023-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-39405
Published: 2025-05-19
Description: Incorrect Privilege Assignment vulnerability in mojoomla WPAMS apartment-management allows Privilege Escalation.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).
CVSS Score: 8.8 (HIGH)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/apartment-management/vulnerability/wordpress-wpams-plugin-44-0-17-08-2023-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-39406
Published: 2025-05-19
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla WPAMS apartment-management allows PHP Local File Inclusion.This issue affects WPAMS: from n/a through <= 44.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/apartment-management/vulnerability/wordpress-wpams-plugin-44-0-local-file-inclusion-to-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-39407
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Caseproof, LLC Memberpress allows Reflected XSS.This issue affects Memberpress: from n/a before 1.12.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/memberpress/vulnerability/wordpress-memberpress-plugin-1-11-37-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39409
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pressaholic WordPress Video Robot - The Ultimate Video Importer.This issue affects WordPress Video Robot - The Ultimate Video Importer: from n/a through 1.20.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/wp-video-robot/vulnerability/wordpress-wordpress-video-robot-the-ultimate-video-importer-plugin-1-20-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39410
Published: 2025-05-19
Description: Deserialization of Untrusted Data vulnerability in themegusta Smart Sections Theme Builder - WPBakery Page Builder Addon.This issue affects Smart Sections Theme Builder - WPBakery Page Builder Addon: from n/a through 1.7.8.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/wordpress/plugin/visucom-smart-sections/vulnerability/wordpress-smart-sections-theme-builder-wpbakery-page-builder-addon-plugin-1-7-8-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-39411
Published: 2025-05-19
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Indie_Plugins WhatsApp Click to Chat Plugin for WordPress wpt-whatsapp.This issue affects WhatsApp Click to Chat Plugin for WordPress: from n/a through <= 2.2.12.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/wpt-whatsapp/vulnerability/wordpress-whatsapp-click-to-chat-plugin-for-wordpress-plugin-2-2-12-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39445
Published: 2025-05-19
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp allows SQL Injection.This issue affects Super Store Finder: from n/a through <= 7.2.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/superstorefinder-wp/vulnerability/wordpress-super-store-finder-7-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-39446
Published: 2025-05-19
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl LLC Booster Plus for WooCommerce allows Reflected XSS.This issue affects Booster Plus for WooCommerce: from n/a through 7.2.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/booster-plus-for-woocommerce/vulnerability/wordpress-booster-plus-for-woocommerce-plugin-7-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve