deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-67541
Published: 2025-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lester Chan WP-ShowHide wp-showhide allows Stored XSS.This issue affects WP-ShowHide: from n/a through <= 1.05.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-showhide/vulnerability/wordpress-wp-showhide-plugin-1-05-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-67542
Published: 2025-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SilkyPress Multi-Step Checkout for WooCommerce wp-multi-step-checkout allows DOM-Based XSS.This issue affects Multi-Step Checkout for WooCommerce: from n/a through <= 2.33.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-multi-step-checkout/vulnerability/wordpress-multi-step-checkout-for-woocommerce-plugin-2-33-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-67543
Published: 2025-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Catch Themes Essential Widgets essential-widgets allows Stored XSS.This issue affects Essential Widgets: from n/a through <= 2.2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/essential-widgets/vulnerability/wordpress-essential-widgets-plugin-2-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-67544
Published: 2025-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Get Bowtied Shopkeeper Extender shopkeeper-extender allows Stored XSS.This issue affects Shopkeeper Extender: from n/a through < 7.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/shopkeeper-extender/vulnerability/wordpress-shopkeeper-extender-plugin-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-67545
Published: 2025-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FirePlugins FireBox firebox allows Stored XSS.This issue affects FireBox: from n/a through <= 3.1.0-free.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/firebox/vulnerability/wordpress-firebox-plugin-3-1-0-free-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-67548
Published: 2025-12-09
Description: Missing Authorization vulnerability in WP Delicious WP Delicious delicious-recipes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Delicious: from n/a through <= 1.9.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/delicious-recipes/vulnerability/wordpress-wp-delicious-plugin-1-9-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67549
Published: 2025-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bobbingwide oik oik allows DOM-Based XSS.This issue affects oik: from n/a through <= 4.15.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/oik/vulnerability/wordpress-oik-plugin-4-15-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-67550
Published: 2025-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rhewlif Donation Thermometer donation-thermometer allows Stored XSS.This issue affects Donation Thermometer: from n/a through <= 2.2.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/donation-thermometer/vulnerability/wordpress-donation-thermometer-plugin-2-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-67551
Published: 2025-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wappointment team Wappointment wappointment allows Stored XSS.This issue affects Wappointment: from n/a through <= 2.6.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wappointment/vulnerability/wordpress-wappointment-plugin-2-6-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-67552
Published: 2025-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WalkerWP Walker Core walker-core allows DOM-Based XSS.This issue affects Walker Core: from n/a through <= 1.3.17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/walker-core/vulnerability/wordpress-walker-core-plugin-1-3-17-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-67553
Published: 2025-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHigh Advanced FAQ Manager advanced-faq-manager allows DOM-Based XSS.This issue affects Advanced FAQ Manager: from n/a through <= 1.5.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/advanced-faq-manager/vulnerability/wordpress-advanced-faq-manager-plugin-1-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-67554
Published: 2025-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Humanityco Cookie Notice & Compliance for GDPR / CCPA cookie-notice allows Stored XSS.This issue affects Cookie Notice & Compliance for GDPR / CCPA: from n/a through <= 2.5.8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cookie-notice/vulnerability/wordpress-cookie-notice-compliance-for-gdpr-ccpa-plugin-2-5-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-67555
Published: 2025-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in useStrict UseStrict's Calendly Embedder cal-embedder-lite allows Stored XSS.This issue affects UseStrict's Calendly Embedder: from n/a through <= 1.1.7.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cal-embedder-lite/vulnerability/wordpress-usestrict-s-calendly-embedder-plugin-1-1-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-67556
Published: 2025-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHigh Advanced FAQ Manager advanced-faq-manager allows Stored XSS.This issue affects Advanced FAQ Manager: from n/a through <= 1.5.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/advanced-faq-manager/vulnerability/wordpress-advanced-faq-manager-plugin-1-5-2-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2025-67557
Published: 2025-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rhys Wynne WP eBay Product Feeds ebay-feeds-for-wordpress allows Stored XSS.This issue affects WP eBay Product Feeds: from n/a through <= 3.4.9.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ebay-feeds-for-wordpress/vulnerability/wordpress-wp-ebay-product-feeds-plugin-3-4-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-67558
Published: 2025-12-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacques Malgrange Rencontre rencontre allows Stored XSS.This issue affects Rencontre: from n/a through <= 3.13.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/rencontre/vulnerability/wordpress-rencontre-plugin-3-13-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-67559
Published: 2025-12-09
Description: Missing Authorization vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/meeting-scheduler-by-vcita/vulnerability/wordpress-online-booking-scheduling-calendar-for-wordpress-by-vcita-plugin-4-5-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67560
Published: 2025-12-09
Description: Missing Authorization vulnerability in Webilia Inc. Listdom listdom allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Listdom: from n/a through <= 5.0.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/listdom/vulnerability/wordpress-listdom-plugin-5-0-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67561
Published: 2025-12-09
Description: Missing Authorization vulnerability in Oleksandr Lysyi Debug Log Viewer debug-log-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Debug Log Viewer: from n/a through <= 2.0.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/debug-log-viewer/vulnerability/wordpress-debug-log-viewer-plugin-2-0-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67562
Published: 2025-12-09
Description: Missing Authorization vulnerability in WebCodingPlace Image Caption Hover Pro image-caption-hover-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Caption Hover Pro: from n/a through < 20.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/image-caption-hover-pro/vulnerability/wordpress-image-caption-hover-pro-plugin-20-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67563
Published: 2025-12-09
Description: Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post SMTP: from n/a through <= 3.6.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/post-smtp/vulnerability/wordpress-post-smtp-plugin-3-6-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67564
Published: 2025-12-09
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in alekv Pixel Manager for WooCommerce woocommerce-google-adwords-conversion-tracking-tag allows Retrieve Embedded Sensitive Data.This issue affects Pixel Manager for WooCommerce: from n/a through <= 1.51.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-google-adwords-conversion-tracking-tag/vulnerability/wordpress-pixel-manager-for-woocommerce-plugin-1-51-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-67565
Published: 2025-12-09
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam Rehub rehub-theme allows Retrieve Embedded Sensitive Data.This issue affects Rehub: from n/a through <= 19.9.9.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Theme/rehub-theme/vulnerability/wordpress-rehub-theme-19-9-9-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-67566
Published: 2025-12-09
Description: Missing Authorization vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woffice Core: from n/a through <= 5.4.30.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/woffice-core/vulnerability/wordpress-woffice-core-plugin-5-4-30-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67567
Published: 2025-12-09
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in uixthemes Sober sober allows Retrieve Embedded Sensitive Data.This issue affects Sober: from n/a through <= 3.5.11.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Theme/sober/vulnerability/wordpress-sober-theme-3-5-11-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-67568
Published: 2025-12-09
Description: Missing Authorization vulnerability in xtemos Basel basel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Basel: from n/a through <= 5.9.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/basel/vulnerability/wordpress-basel-theme-5-9-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67569
Published: 2025-12-09
Description: Missing Authorization vulnerability in scriptsbundle AdForest adforest allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AdForest: from n/a through <= 6.0.11.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/adforest/vulnerability/wordpress-adforest-theme-6-0-11-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67570
Published: 2025-12-09
Description: Missing Authorization vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPForms Google Sheet Connector: from n/a through <= 4.0.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/gsheetconnector-wpforms/vulnerability/wordpress-wpforms-google-sheet-connector-plugin-4-0-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67571
Published: 2025-12-09
Description: Missing Authorization vulnerability in WPFunnels WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through <= 3.6.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wpfunnels/vulnerability/wordpress-wpfunnels-plugin-3-6-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67572
Published: 2025-12-09
Description: Missing Authorization vulnerability in PenciDesign PenNews pennews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PenNews: from n/a through < 6.7.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/pennews/vulnerability/wordpress-pennews-theme-6-7-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67573
Published: 2025-12-09
Description: Missing Authorization vulnerability in ThimPress Sailing sailing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sailing: from n/a through < 4.4.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/sailing/vulnerability/wordpress-sailing-theme-4-4-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67574
Published: 2025-12-09
Description: Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.30.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/booking-calendar/vulnerability/wordpress-booking-calendar-appointment-booking-system-plugin-3-2-30-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67575
Published: 2025-12-09
Description: Missing Authorization vulnerability in Andrew Lima Sitewide Notice WP sitewide-notice-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sitewide Notice WP: from n/a through <= 2.4.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/sitewide-notice-wp/vulnerability/wordpress-sitewide-notice-wp-plugin-2-4-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67576
Published: 2025-12-09
Description: Missing Authorization vulnerability in QuantumCloud Simple Link Directory simple-link-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Link Directory: from n/a through <= 8.8.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/simple-link-directory/vulnerability/wordpress-simple-link-directory-plugin-8-8-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67577
Published: 2025-12-09
Description: Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form Builder: from n/a through <= 3.8.20.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/easy-form-builder/vulnerability/wordpress-easy-form-builder-plugin-3-8-20-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67578
Published: 2025-12-09
Description: Missing Authorization vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Email Capture: from n/a through <= 3.12.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-email-capture/vulnerability/wordpress-wp-email-capture-plugin-3-12-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67579
Published: 2025-12-09
Description: Missing Authorization vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Extra Fields: from n/a through <= 16.8.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-user-extra-fields/vulnerability/wordpress-user-extra-fields-plugin-16-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67580
Published: 2025-12-09
Description: Missing Authorization vulnerability in Constant Contact Constant Contact + WooCommerce constant-contact-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Constant Contact + WooCommerce: from n/a through <= 2.4.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/constant-contact-woocommerce/vulnerability/wordpress-constant-contact-woocommerce-plugin-2-4-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67581
Published: 2025-12-09
Description: Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TrueBooker: from n/a through <= 1.1.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/truebooker-appointment-booking/vulnerability/wordpress-truebooker-plugin-1-1-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67582
Published: 2025-12-09
Description: Missing Authorization vulnerability in wbcomdesigns Wbcom Designs lock-my-bp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wbcom Designs: from n/a through <= 2.1.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/lock-my-bp/vulnerability/wordpress-wbcom-designs-plugin-2-1-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67583
Published: 2025-12-09
Description: Missing Authorization vulnerability in Foysal Imran IDonate idonate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IDonate: from n/a through <= 2.1.15.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/idonate/vulnerability/wordpress-idonate-plugin-2-1-15-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67584
Published: 2025-12-09
Description: Missing Authorization vulnerability in rtCamp GoDAM godam allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GoDAM: from n/a through <= 1.4.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/godam/vulnerability/wordpress-godam-plugin-1-4-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67585
Published: 2025-12-09
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in flexmls Flexmls® IDX flexmls-idx allows Phishing.This issue affects Flexmls® IDX: from n/a through <= 3.15.7.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/flexmls-idx/vulnerability/wordpress-flexmls-idx-plugin-3-15-7-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2025-67586
Published: 2025-12-09
Description: Missing Authorization vulnerability in Ronald Huereca Highlight and Share highlight-and-share allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Highlight and Share: from n/a through <= 5.2.0.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/highlight-and-share/vulnerability/wordpress-highlight-and-share-plugin-5-2-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67587
Published: 2025-12-09
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms FreshDesk Plugin gf-freshdesk allows Phishing.This issue affects WP Gravity Forms FreshDesk Plugin: from n/a through <= 1.3.5.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/gf-freshdesk/vulnerability/wordpress-wp-gravity-forms-freshdesk-plugin-plugin-1-3-5-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2025-67588
Published: 2025-12-09
Description: Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Website Builder: from n/a through <= 3.33.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-3-33-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67589
Published: 2025-12-09
Description: Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoices & Packing Slips: from n/a through <= 4.9.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-pdf-invoices-packing-slips/vulnerability/wordpress-woocommerce-pdf-invoices-packing-slips-plugin-4-9-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-67590
Published: 2025-12-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Ultimate FAQ ultimate-faqs allows Cross Site Request Forgery.This issue affects Ultimate FAQ: from n/a through <= 2.4.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-faqs/vulnerability/wordpress-ultimate-faq-plugin-2-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-67591
Published: 2025-12-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in jegtheme JNews Paywall jnews-paywall allows Cross Site Request Forgery.This issue affects JNews Paywall: from n/a through < 12.0.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/jnews-paywall/vulnerability/wordpress-jnews-paywall-plugin-12-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve