deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-3685
Published: 2025-04-16
Description: A vulnerability classified as critical has been found in code-projects Patient Record Management System 1.0. Affected is an unknown function of the file /edit_fpatient.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/bazhahei123/CVE/blob/main/sql_cve_4_8.pdf; https://vuldb.com/?ctiid.304974
CVE: CVE-2025-3686
Published: 2025-04-16
Description: A vulnerability classified as problematic was found in misstt123 oasys 1.0. Affected by this vulnerability is the function image of the file /show. The manipulation leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/misstt123/oasys/issues/10; https://vuldb.com/?ctiid.304975; https://vuldb.com/?id.304975
CVE: CVE-2025-3687
Published: 2025-04-16
Description: A vulnerability, which was classified as problematic, has been found in misstt123 oasys 1.0. Affected by this issue is some unknown functionality of the component Sticky Notes Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://github.com/misstt123/oasys/issues/11; https://vuldb.com/?ctiid.304976; https://vuldb.com/?id.304976
CVE: CVE-2025-3688
Published: 2025-04-16
Description: A vulnerability, which was classified as problematic, was found in mirweiye Seven Bears Library CMS 2023. This affects an unknown part of the component Background Management Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://github.com/KKDT12138/CVE/blob/main/cve.pdf; https://vuldb.com/?ctiid.304977; https://vuldb.com/?id.304977
CVE: CVE-2024-46915
Published: 2025-04-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2025-1980
Published: 2025-04-16
Description: The Ready_ application's Profile section allows users to upload files of any type and extension without restriction. If the server is misconfigured, as it was by default when installed at the turn of 2021 and 2022, it can result in Remote Code Execution. Refer to the Required Configuration for Exposure section for more information.
CWE: CWE-434
References: https://cert.pl/en/posts/2025/04/CVE-2025-1980; https://cert.pl/posts/2025/04/CVE-2025-1980; https://ready-os.com/pl/
CVE: CVE-2025-1981
Published: 2025-04-16
Description: Improper neutralization of input provided by a low-privileged user into a file search functionality in Ready_'s Invoices module allows for SQL Injection attacks.
CWE: CWE-89
References: https://cert.pl/en/posts/2025/04/CVE-2025-1980; https://cert.pl/posts/2025/04/CVE-2025-1980; https://ready-os.com/pl/
CVE: CVE-2025-1982
Published: 2025-04-16
Description: Local File Inclusion vulnerability in Ready's attachment upload panel allows low privileged user to provide link to a local file using the file:// protocol thus allowing the attacker to read content of the file. This vulnerability can be use to read content of system files.
CWE: CWE-552
References: https://cert.pl/en/posts/2025/04/CVE-2025-1980; https://cert.pl/posts/2025/04/CVE-2025-1980; https://ready-os.com/pl/
CVE: CVE-2025-1983
Published: 2025-04-16
Description: A cross-site scripting (XSS) vulnerability in Ready_'s File Explorer upload functionality allows injection of arbitrary JavaScript code in filename. Injected content is stored on server and is executed every time a user interacts with the uploaded file.
CWE: CWE-79
References: https://cert.pl/en/posts/2025/04/CVE-2025-1980; https://cert.pl/posts/2025/04/CVE-2025-1980; https://ready-os.com/pl/
CVE: CVE-2025-39512
Published: 2025-04-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in Yuya Hoshino Bulk Term Editor bulk-term-editor allows Cross Site Request Forgery.This issue affects Bulk Term Editor: from n/a through <= 1.1.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/bulk-term-editor/vulnerability/wordpress-bulk-term-editor-1-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-39513
Published: 2025-04-16
Description: Missing Authorization vulnerability in ActiveDEMAND Online Agency Marketing Automation ActiveDEMAND activedemand allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ActiveDEMAND: from n/a through <= 0.2.46.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/activedemand/vulnerability/wordpress-activedemand-0-2-46-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-39514
Published: 2025-04-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asgaros Asgaros Forum asgaros-forum allows Stored XSS.This issue affects Asgaros Forum: from n/a through <= 3.2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/asgaros-forum/vulnerability/wordpress-asgaros-forum-3-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39515
Published: 2025-04-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tnomi Attendance Manager attendance-manager allows Stored XSS.This issue affects Attendance Manager: from n/a through <= 0.6.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/attendance-manager/vulnerability/wordpress-attendance-manager-0-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39516
Published: 2025-04-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alan Petersen Author WIP Progress Bar author-work-in-progress-bar allows DOM-Based XSS.This issue affects Author WIP Progress Bar: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/author-work-in-progress-bar/vulnerability/wordpress-author-wip-progress-bar-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39517
Published: 2025-04-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Basic Interactive World Map basic-interactive-world-map allows Cross Site Request Forgery.This issue affects Basic Interactive World Map: from n/a through <= 2.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/basic-interactive-world-map/vulnerability/wordpress-basic-interactive-world-map-plugin-2-7-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-39518
Published: 2025-04-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RedefiningTheWeb BMA Lite bma-lite-appointment-booking-and-scheduling allows SQL Injection.This issue affects BMA Lite: from n/a through <= 1.4.2.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/bma-lite-appointment-booking-and-scheduling/vulnerability/wordpress-bma-lite-1-4-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-39520
Published: 2025-04-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-files-upload-woocommerce allows Stored XSS.This issue affects Checkout Files Upload for WooCommerce: from n/a through <= 2.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/checkout-files-upload-woocommerce/vulnerability/wordpress-checkout-files-upload-for-woocommerce-2-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39522
Published: 2025-04-16
Description: Missing Authorization vulnerability in Service2Client LLC Dynamic Post dynamic-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamic Post: from n/a through <= 5.03.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/dynamic-post/vulnerability/wordpress-dynamic-post-4-10-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-39524
Published: 2025-04-16
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.This issue affects Html5 Audio Player: from n/a through <= 2.2.28.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-80
References: https://patchstack.com/database/Wordpress/Plugin/html5-audio-player/vulnerability/wordpress-html5-audio-player-2-2-28-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39525
Published: 2025-04-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Logo Carousel Slider logo-carousel-slider allows Stored XSS.This issue affects Logo Carousel Slider: from n/a through <= 2.1.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/logo-carousel-slider/vulnerability/wordpress-logo-carousel-slider-2-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39528
Published: 2025-04-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rescue Themes Rescue Shortcodes rescue-shortcodes allows Stored XSS.This issue affects Rescue Shortcodes: from n/a through <= 3.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/rescue-shortcodes/vulnerability/wordpress-rescue-shortcodes-plugin-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39529
Published: 2025-04-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robin Cornett Scriptless Social Sharing scriptless-social-sharing allows Stored XSS.This issue affects Scriptless Social Sharing: from n/a through <= 3.3.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/scriptless-social-sharing/vulnerability/wordpress-scriptless-social-sharing-3-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39530
Published: 2025-04-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in dsky Site Search 360 site-search-360 allows Stored XSS.This issue affects Site Search 360: from n/a through <= 2.1.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/site-search-360/vulnerability/wordpress-site-search-360-plugin-2-1-7-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39531
Published: 2025-04-16
Description: Missing Authorization vulnerability in slazzercom Slazzer Background Changer slazzer-background-changer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Slazzer Background Changer: from n/a through <= 3.14.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/slazzer-background-changer/vulnerability/wordpress-slazzer-background-changer-3-14-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-39538
Published: 2025-04-16
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Mathieu Chartier WP-Advanced-Search wp-advanced-search allows Upload a Web Shell to a Web Server.This issue affects WP-Advanced-Search: from n/a through <= 3.3.9.4.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/wp-advanced-search/vulnerability/wordpress-wp-advanced-search-3-3-9-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-39540
Published: 2025-04-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rhys Wynne WP Flipclock wp-flipclock allows DOM-Based XSS.This issue affects WP Flipclock: from n/a through <= 1.9.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-flipclock/vulnerability/wordpress-wp-flipclock-plugin-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39543
Published: 2025-04-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through <= 1.3.977.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/royal-elementor-addons/vulnerability/wordpress-royal-elementor-addons-plugin-1-3-977-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39544
Published: 2025-04-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in sminozzi WP Tools wptools allows Path Traversal.This issue affects WP Tools: from n/a through <= 5.18.
CVSS Score: 7.4 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wptools/vulnerability/wordpress-wp-tools-plugin-5-18-csrf-to-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-39545
Published: 2025-04-16
Description: Missing Authorization vulnerability in miniOrange WordPress REST API Authentication wp-rest-api-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress REST API Authentication: from n/a through <= 3.6.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-rest-api-authentication/vulnerability/wordpress-wordpress-rest-api-authentication-3-6-3-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-39546
Published: 2025-04-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in quomodosoft ElementsReady Addons for Elementor element-ready-lite allows Cross Site Request Forgery.This issue affects ElementsReady Addons for Elementor: from n/a through <= 6.6.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/element-ready-lite/vulnerability/wordpress-elementsready-addons-for-elementor-6-6-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-39547
Published: 2025-04-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in Toast Plugins Internal Link Optimiser internal-link-finder allows Stored XSS.This issue affects Internal Link Optimiser: from n/a through <= 5.1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/internal-link-finder/vulnerability/wordpress-internal-link-optimiser-plugin-5-1-3-csrf-to-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39548
Published: 2025-04-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Right Click Disable OR Ban right-click-disable-or-ban allows Stored XSS.This issue affects Right Click Disable OR Ban: from n/a through <= 1.1.17.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/right-click-disable-or-ban/vulnerability/wordpress-right-click-disable-or-ban-plugin-1-1-17-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39549
Published: 2025-04-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in whiletrue Most And Least Read Posts Widget most-and-least-read-posts-widget allows Stored XSS.This issue affects Most And Least Read Posts Widget: from n/a through <= 2.5.20.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/most-and-least-read-posts-widget/vulnerability/wordpress-most-and-least-read-posts-widget-2-5-20-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39552
Published: 2025-04-16
Description: Missing Authorization vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zephyr Project Manager: from n/a through <= 3.3.200.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/zephyr-project-manager/vulnerability/wordpress-zephyr-project-manager-3-3-200-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-39555
Published: 2025-04-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin allows Stored XSS.This issue affects Church Admin: from n/a through <= 5.0.23.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/church-admin/vulnerability/wordpress-church-admin-plugin-5-0-23-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39556
Published: 2025-04-16
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in mediavine Mediavine Control Panel mediavine-control-panel allows Retrieve Embedded Sensitive Data.This issue affects Mediavine Control Panel: from n/a through <= 2.10.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/mediavine-control-panel/vulnerability/wordpress-mediavine-control-panel-plugin-2-10-6-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-39557
Published: 2025-04-16
Description: Unrestricted Upload of File with Dangerous Type vulnerability in StellarWP Kadence WooCommerce Email Designer kadence-woocommerce-email-designer allows Upload a Web Shell to a Web Server.This issue affects Kadence WooCommerce Email Designer: from n/a through <= 1.5.14.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/kadence-woocommerce-email-designer/vulnerability/wordpress-kadence-woocommerce-email-designer-plugin-1-5-14-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-39560
Published: 2025-04-16
Description: Missing Authorization vulnerability in Shahjada Live Forms liveforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Forms: from n/a through <= 4.8.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/liveforms/vulnerability/wordpress-live-forms-plugin-4-8-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-39563
Published: 2025-04-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Trio Conditional Payments for WooCommerce conditional-payments-for-woocommerce allows Cross Site Request Forgery.This issue affects Conditional Payments for WooCommerce: from n/a through <= 3.3.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/conditional-payments-for-woocommerce/vulnerability/wordpress-conditional-payments-for-woocommerce-3-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-39564
Published: 2025-04-16
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Trio Conditional Shipping for WooCommerce conditional-shipping-for-woocommerce allows Cross Site Request Forgery.This issue affects Conditional Shipping for WooCommerce: from n/a through <= 3.4.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/conditional-shipping-for-woocommerce/vulnerability/wordpress-conditional-shipping-for-woocommerce-3-4-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-39565
Published: 2025-04-16
Description: Deserialization of Untrusted Data vulnerability in Melapress MelaPress Login Security melapress-login-security allows Object Injection.This issue affects MelaPress Login Security: from n/a through <= 2.1.0.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/melapress-login-security/vulnerability/wordpress-melapress-login-security-2-1-0-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-39566
Published: 2025-04-16
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Hostel hostel allows Blind SQL Injection.This issue affects Hostel: from n/a through <= 1.1.5.6.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/hostel/vulnerability/wordpress-hostel-1-1-5-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-39570
Published: 2025-04-16
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Lomu WPCOM Member wpcom-member allows PHP Local File Inclusion.This issue affects WPCOM Member: from n/a through <= 1.7.7.
CVSS Score: 8.8 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/wpcom-member/vulnerability/wordpress-wpcom-member-1-7-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39571
Published: 2025-04-16
Description: Missing Authorization vulnerability in WPXPO WowStore product-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowStore: from n/a through <= 4.2.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/product-blocks/vulnerability/wordpress-wowstore-4-2-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-39572
Published: 2025-04-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Checkout for PayPal checkout-for-paypal allows Stored XSS.This issue affects Checkout for PayPal: from n/a through <= 1.0.38.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/checkout-for-paypal/vulnerability/wordpress-checkout-for-paypal-1-0-38-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39573
Published: 2025-04-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Stored XSS.This issue affects WP Posts Carousel: from n/a through <= 1.3.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-posts-carousel/vulnerability/wordpress-wp-posts-carousel-1-3-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39574
Published: 2025-04-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UIUX Lab Uix Shortcodes uix-shortcodes allows Stored XSS.This issue affects Uix Shortcodes: from n/a through <= 2.0.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/uix-shortcodes/vulnerability/wordpress-uix-shortcodes-2-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39575
Published: 2025-04-16
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPSight WPCasa wpcasa allows Stored XSS.This issue affects WPCasa: from n/a through <= 1.3.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpcasa/vulnerability/wordpress-wpcasa-1-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve