deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-48163
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support lbg-audio8-html5-radio-ads allows Reflected XSS.This issue affects SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support: from n/a through <= 3.5.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/lbg-audio8-html5-radio-ads/vulnerability/wordpress-shout-html5-radio-player-with-ads-shoutcast-and-icecast-support-3-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48164
Published: 2025-08-20
Description: Incorrect Privilege Assignment vulnerability in Brainstorm Force SureDash suredash allows Privilege Escalation.This issue affects SureDash: from n/a through <= 1.0.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/suredash/vulnerability/wordpress-suredash-1-0-3-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-48165
Published: 2025-08-20
Description: Incorrect Privilege Assignment vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Privilege Escalation.This issue affects DELUCKS SEO: from n/a through <= 2.6.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/delucks-seo/vulnerability/wordpress-delucks-seo-plugin-2-6-0-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-48168
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Apollo - Sticky Full Width HTML5 Audio Player lbg-audio5-html5-shoutcast-sticky allows Reflected XSS.This issue affects Apollo - Sticky Full Width HTML5 Audio Player: from n/a through <= 3.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/lbg-audio5-html5-shoutcast-sticky/vulnerability/wordpress-apollo-sticky-full-width-html5-audio-player-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48169
Published: 2025-08-20
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Jordy Meow Code Engine code-engine allows Remote Code Inclusion.This issue affects Code Engine: from n/a through <= 0.3.3.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/code-engine/vulnerability/wordpress-code-engine-plugin-0-3-3-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2025-48170
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player - Addon for WPBakery Page Builder lbg-universal-video-player-addon-visual-composer allows Reflected XSS.This issue affects Universal Video Player - Addon for WPBakery Page Builder: from n/a through <= 3.2.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/lbg-universal-video-player-addon-visual-composer/vulnerability/wordpress-universal-video-player-addon-for-wpbakery-page-builder-3-2-1-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2025-48171
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Cena Store cena allows PHP Local File Inclusion.This issue affects Cena Store: from n/a through <= 2.11.26.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/cena/vulnerability/wordpress-cena-store-2-11-26-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-48296
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup UpStore upstore allows Reflected XSS.This issue affects UpStore: from n/a through <= 1.7.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/upstore/vulnerability/wordpress-upstore-1-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48297
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Reflected XSS.This issue affects Simple Link Directory: from n/a through < 14.8.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/qc-simple-link-directory/vulnerability/wordpress-simple-link-directory-14-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48298
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Benjamin Denis SEOPress for MainWP seopress-for-mainwp allows PHP Local File Inclusion.This issue affects SEOPress for MainWP: from n/a through <= 1.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/seopress-for-mainwp/vulnerability/wordpress-seopress-for-mainwp-1-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-48302
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Roxnor FundEngine wp-fundraising-donation allows PHP Local File Inclusion.This issue affects FundEngine: from n/a through <= 1.7.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/wp-fundraising-donation/vulnerability/wordpress-fundengine-plugin-1-7-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49381
Published: 2025-08-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in ads.txt Guru ads.txt Guru Connect adstxt-guru-connect allows Cross Site Request Forgery.This issue affects ads.txt Guru Connect: from n/a through <= 1.1.1.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/adstxt-guru-connect/vulnerability/wordpress-ads-txt-guru-connect-plugin-1-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49382
Published: 2025-08-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in DexignZone JobZilla - Job Board WordPress Theme jobzilla allows Privilege Escalation.This issue affects JobZilla - Job Board WordPress Theme: from n/a through <= 2.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Theme/jobzilla/vulnerability/wordpress-jobzilla-job-board-wordpress-theme-theme-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49389
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Solutions Notice Bar notice-bar allows Stored XSS.This issue affects Notice Bar: from n/a through <= 3.1.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/notice-bar/vulnerability/wordpress-notice-bar-plugin-3-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49391
Published: 2025-08-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Cross Site Request Forgery.This issue affects Sign-up Sheets: from n/a through <= 2.3.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/sign-up-sheets/vulnerability/wordpress-sign-up-sheets-plugin-2-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49392
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Audio Dock themify-audio-dock allows Stored XSS.This issue affects Themify Audio Dock: from n/a through <= 2.0.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/themify-audio-dock/vulnerability/wordpress-themify-audio-dock-plugin-2-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49395
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Icons themify-icons allows Stored XSS.This issue affects Themify Icons: from n/a through <= 2.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/themify-icons/vulnerability/wordpress-themify-icons-plugin-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49396
Published: 2025-08-20
Description: Missing Authorization vulnerability in themifyme Themify Builder themify-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Themify Builder: from n/a through <= 7.6.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/themify-builder/vulnerability/wordpress-themify-builder-plugin-7-6-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49397
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Colorbox Lightbox wp-colorbox allows Stored XSS.This issue affects Colorbox Lightbox: from n/a through <= 1.1.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-colorbox/vulnerability/wordpress-colorbox-lightbox-plugin-1-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49399
Published: 2025-08-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Cross Site Request Forgery.This issue affects NEX-Forms: from n/a through <= 9.1.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/nex-forms-express-wp-form-builder/vulnerability/wordpress-nex-forms-plugin-9-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49400
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) allows Stored XSS. This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 8.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/wp-stats-manager/vulnerability/wordpress-wp-visitor-statistics-real-time-traffic-plugin-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49406
Published: 2025-08-20
Description: Missing Authorization vulnerability in favethemes Houzez allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Houzez: from n/a through 4.1.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/theme/houzez/vulnerability/wordpress-houzez-theme-4-1-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49408
Published: 2025-08-20
Description: Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded Sensitive Data. This issue affects Templately: from n/a through 3.2.7.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-201
References: https://patchstack.com/database/wordpress/plugin/templately/vulnerability/wordpress-templately-plugin-3-2-7-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-49409
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brewlabs SensorPress allows Stored XSS. This issue affects SensorPress: from n/a through 1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/sensorpress-uptime-monitoring/vulnerability/wordpress-sensorpress-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49410
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC Testimonials allows Stored XSS. This issue affects TC Testimonials: from n/a through 1.1.1.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/tc-testimonial/vulnerability/wordpress-tc-testimonials-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49411
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Sharma iFrame Block allows Stored XSS. This issue affects iFrame Block: from n/a through 0.1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/iframe-block/vulnerability/wordpress-iframe-block-plugin-0-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49412
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in numixtech Page Transition page-transition allows Stored XSS.This issue affects Page Transition: from n/a through <= 1.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/page-transition/vulnerability/wordpress-page-transition-plugin-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49413
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in highwarden Super Store Finder superstorefinder-wp allows Reflected XSS.This issue affects Super Store Finder: from n/a through <= 7.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/superstorefinder-wp/vulnerability/wordpress-super-store-finder-plugin-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49420
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themepassion Ultra Portfolio ultra-portfolio allows Reflected XSS.This issue affects Ultra Portfolio: from n/a through <= 6.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ultra-portfolio/vulnerability/wordpress-ultra-portfolio-wordpress-plugin-6-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49422
Published: 2025-08-20
Description: Incorrect Privilege Assignment vulnerability in themepassion Support Ticket support-ticket allows Privilege Escalation.This issue affects Support Ticket: from n/a through <= 1.9.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/support-ticket/vulnerability/wordpress-support-ticket-plugin-1-9-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-49424
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themepassion Support Ticket support-ticket allows Reflected XSS.This issue affects Support Ticket: from n/a through <= 1.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/support-ticket/vulnerability/wordpress-support-ticket-plugin-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49426
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dahz Kitring kitring allows PHP Local File Inclusion.This issue affects Kitring: from n/a through <= 2.8.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/kitring/vulnerability/wordpress-kitring-theme-2-8-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49428
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dourou Cookie Warning allows Stored XSS. This issue affects Cookie Warning: from n/a through 1.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/cookie-warning/vulnerability/wordpress-cookie-warning-plugin-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49434
Published: 2025-08-20
Description: Deserialization of Untrusted Data vulnerability in axiomthemes Cars4Rent cars4rent allows Object Injection.This issue affects Cars4Rent: from n/a through <= 1.4.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Theme/cars4rent/vulnerability/wordpress-cars4rent-theme-1-4-2-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49436
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CocoBasic Anotte anotte-wp allows PHP Local File Inclusion.This issue affects Anotte: from n/a through <= 1.8.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/anotte-wp/vulnerability/wordpress-anotte-theme-1-8-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49438
Published: 2025-08-20
Description: Deserialization of Untrusted Data vulnerability in Max Chirkov Simple Login Log allows Object Injection. This issue affects Simple Login Log: from n/a through 1.1.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/wordpress/plugin/simple-login-log/vulnerability/wordpress-simple-login-log-plugin-1-1-3-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49889
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Edge CPT edge-cpt allows PHP Local File Inclusion.This issue affects Edge CPT: from n/a through <= 1.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/edge-cpt/vulnerability/wordpress-edge-cpt-plugin-1-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49890
Published: 2025-08-20
Description: Deserialization of Untrusted Data vulnerability in ThemeREX Organic Beauty organic-beauty allows Object Injection.This issue affects Organic Beauty: from n/a through <= 1.4.6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Theme/organic-beauty/vulnerability/wordpress-organic-beauty-theme-1-4-6-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49891
Published: 2025-08-20
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in uxper Uxper Booking uxper-booking allows Blind SQL Injection.This issue affects Uxper Booking: from n/a through <= 1.3.3.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/uxper-booking/vulnerability/wordpress-uxper-booking-plugin-1-3-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49892
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Uxper Booking uxper-booking allows PHP Local File Inclusion.This issue affects Uxper Booking: from n/a through <= 1.3.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/uxper-booking/vulnerability/wordpress-uxper-booking-plugin-1-3-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49893
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Nuss nuss allows Reflected XSS.This issue affects Nuss: from n/a through <= 1.3.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/nuss/vulnerability/wordpress-nuss-theme-1-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49894
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Nuss nuss allows PHP Local File Inclusion.This issue affects Nuss: from n/a through <= 1.3.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/nuss/vulnerability/wordpress-nuss-theme-1-3-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49896
Published: 2025-08-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in wptasker WP Discord Post Plus –  Supports Unlimited Channels allows Cross Site Request Forgery. This issue affects WP Discord Post Plus –  Supports Unlimited Channels: from n/a through 1.0.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/wordpress/plugin/wp-discord-post-plus/vulnerability/wordpress-wp-discord-post-plus-supports-unlimited-channels-plugin-1-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53194
Published: 2025-08-20
Description: Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Code Injection.This issue affects JetEngine: from n/a through <= 3.7.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-82
References: https://patchstack.com/database/Wordpress/Plugin/jet-engine/vulnerability/wordpress-jetengine-3-7-0-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2025-53195
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53196
Published: 2025-08-20
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetEngine jet-engine allows Retrieve Embedded Sensitive Data.This issue affects JetEngine: from n/a through <= 3.7.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/jet-engine/vulnerability/wordpress-jetengine-3-7-0-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-53198
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a through <= 4.0.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/houzez/vulnerability/wordpress-houzez-4-0-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-53201
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.This issue affects Jobmonster: from n/a through <= 4.7.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/noo-jobmonster/vulnerability/wordpress-jobmonster-4-7-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53204
Published: 2025-08-20
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme eventlist eventlist allows PHP Local File Inclusion.This issue affects eventlist: from n/a through <= 1.9.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/eventlist/vulnerability/wordpress-eventlist-1-9-2-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-53205
Published: 2025-08-20
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Radio Player Shoutcast & Icecast lbg-audio4-html5-shoutcast allows Reflected XSS.This issue affects Radio Player Shoutcast & Icecast: from n/a through <= 4.4.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/lbg-audio4-html5-shoutcast/vulnerability/wordpress-radio-player-shoutcast-icecast-4-4-7-cross-site-scripting-xss-vulnerability?_s_id=cve