deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-58011
Published: 2025-09-22
Description: Server-Side Request Forgery (SSRF) vulnerability in Alex Content Mask content-mask allows Server Side Request Forgery.This issue affects Content Mask: from n/a through <= 1.8.5.2.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/content-mask/vulnerability/wordpress-content-mask-plugin-1-8-5-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-58012
Published: 2025-09-22
Description: Authorization Bypass Through User-Controlled Key vulnerability in Alex Content Mask content-mask allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Content Mask: from n/a through <= 1.8.5.3.
CVSS Score: 3.8 (LOW)
CWE: CWE-639
References: https://patchstack.com/database/Wordpress/Plugin/content-mask/vulnerability/wordpress-content-mask-plugin-1-8-5-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2025-58013
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in pebas CouponXxL couponxxl allows Privilege Escalation.This issue affects CouponXxL: from n/a through <= 4.5.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Theme/couponxxl/vulnerability/wordpress-couponxxl-theme-4-5-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58014
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Quiz Maker quiz-maker allows Cross Site Request Forgery.This issue affects Quiz Maker: from n/a through <= 6.7.0.64.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/quiz-maker/vulnerability/wordpress-quiz-maker-plugin-6-7-0-61-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58015
Published: 2025-09-22
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Ays Pro Quiz Maker quiz-maker allows Retrieve Embedded Sensitive Data.This issue affects Quiz Maker: from n/a through <= 6.7.0.65.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/quiz-maker/vulnerability/wordpress-quiz-maker-plugin-6-7-0-61-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-58016
Published: 2025-09-22
Description: Missing Authorization vulnerability in Codexpert, Inc CF7 Submissions cf7-submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 Submissions: from n/a through <= 0.26.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/cf7-submissions/vulnerability/wordpress-cf7-submissions-plugin-0-26-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58017
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.8.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-store-kit/vulnerability/wordpress-ultimate-store-kit-elementor-addons-plugin-2-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58018
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Leishman Mail Subscribe List mail-subscribe-list allows Stored XSS.This issue affects Mail Subscribe List: from n/a through <= 2.1.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mail-subscribe-list/vulnerability/wordpress-mail-subscribe-list-plugin-2-1-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58019
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Search Atlas Group Search Atlas SEO metasync allows Stored XSS.This issue affects Search Atlas SEO: from n/a through <= 2.5.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/metasync/vulnerability/wordpress-search-atlas-seo-plugin-2-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58020
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress theatre allows Stored XSS.This issue affects Theater for WordPress: from n/a through <= 0.18.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/theatre/vulnerability/wordpress-theater-for-wordpress-plugin-0-18-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58021
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in douglaskarr List Child Pages Shortcode list-child-pages-shortcode allows Stored XSS.This issue affects List Child Pages Shortcode: from n/a through <= 1.3.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/list-child-pages-shortcode/vulnerability/wordpress-list-child-pages-shortcode-plugin-1-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58022
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxpagels ShortCode shortcode allows Stored XSS.This issue affects ShortCode: from n/a through <= 0.8.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/shortcode/vulnerability/wordpress-shortcode-plugin-0-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58023
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in akdevs Genealogical Tree genealogical-tree allows Stored XSS.This issue affects Genealogical Tree: from n/a through <= 2.2.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/genealogical-tree/vulnerability/wordpress-genealogical-tree-plugin-2-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58025
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in averta Master Slider master-slider allows Stored XSS.This issue affects Master Slider: from n/a through <= 3.11.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/master-slider/vulnerability/wordpress-master-slider-plugin-3-11-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58026
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in termageddon Termageddon: Cookie Consent & Privacy Compliance termageddon-usercentrics allows Stored XSS.This issue affects Termageddon: Cookie Consent & Privacy Compliance: from n/a through <= 1.8.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/termageddon-usercentrics/vulnerability/wordpress-termageddon-cookie-consent-privacy-compliance-plugin-1-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58027
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpo-HR NGG Smart Image Search ngg-smart-image-search allows Stored XSS.This issue affects NGG Smart Image Search: from n/a through <= 3.4.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ngg-smart-image-search/vulnerability/wordpress-ngg-smart-image-search-plugin-3-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58028
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aum Watcharapon Designil PDPA Thailand pdpa-thailand allows Stored XSS.This issue affects Designil PDPA Thailand: from n/a through <= 2.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/pdpa-thailand/vulnerability/wordpress-designil-pdpa-thailand-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58029
Published: 2025-09-22
Description: Missing Authorization vulnerability in Sumit Singh Classic Widgets with Block-based Widgets classic-widgets-with-block-based-widgets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classic Widgets with Block-based Widgets: from n/a through <= 1.0.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/classic-widgets-with-block-based-widgets/vulnerability/wordpress-classic-widgets-with-block-based-widgets-plugin-1-0-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58030
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Page-list page-list allows Stored XSS.This issue affects Page-list: from n/a through <= 5.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/page-list/vulnerability/wordpress-page-list-plugin-5-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58031
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nextendweb Nextend Facebook Connect  nextend-facebook-connect allows Stored XSS.This issue affects Nextend Facebook Connect : from n/a through <= 3.1.19.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/nextend-facebook-connect/vulnerability/wordpress-nextend-facebook-connect-plugin-3-1-19-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58032
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Bytes.co WP Compiler wp-compiler allows Cross Site Request Forgery.This issue affects WP Compiler: from n/a through <= 1.0.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-compiler/vulnerability/wordpress-wp-compiler-plugin-1-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58033
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leeshadle Draft website-builder allows Stored XSS.This issue affects Draft: from n/a through <= 3.0.9.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/website-builder/vulnerability/wordpress-draft-plugin-3-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58199
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Fastly Fastly fastly allows Cross Site Request Forgery.This issue affects Fastly: from n/a through <= 1.2.28.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/fastly/vulnerability/wordpress-fastly-plugin-1-2-28-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58200
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Bage Flexible FAQ flexible-faq allows Cross Site Request Forgery.This issue affects Flexible FAQ: from n/a through <= 0.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/flexible-faq/vulnerability/wordpress-flexible-faq-plugin-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58219
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in LIJE Show Pages List show-pages-list allows Cross Site Request Forgery.This issue affects Show Pages List: from n/a through <= 1.2.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/show-pages-list/vulnerability/wordpress-show-pages-list-plugin-1-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58220
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Techeshta Card Elements for WPBakery card-elements-for-wpbakery allows DOM-Based XSS.This issue affects Card Elements for WPBakery: from n/a through <= 1.0.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/card-elements-for-wpbakery/vulnerability/wordpress-card-elements-for-wpbakery-plugin-1-0-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58221
Published: 2025-09-22
Description: Missing Authorization vulnerability in ONTRAPORT PilotPress pilotpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PilotPress: from n/a through <= 2.0.36.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/pilotpress/vulnerability/wordpress-pilotpress-plugin-2-0-35-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58222
Published: 2025-09-22
Description: Missing Authorization vulnerability in Maidul Team Manager wp-team-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team Manager: from n/a through <= 2.5.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-team-manager/vulnerability/wordpress-team-manager-plugin-2-3-14-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58223
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Taylor VoucherPress voucherpress allows Stored XSS.This issue affects VoucherPress: from n/a through <= 1.5.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/voucherpress/vulnerability/wordpress-voucherpress-plugin-1-5-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58224
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Printeers Printeers Print & Ship allows Cross Site Request Forgery. This issue affects Printeers Print & Ship: from n/a through 1.17.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/wordpress/plugin/invition-print-ship/vulnerability/wordpress-printeers-print-ship-plugin-1-17-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58226
Published: 2025-09-22
Description: Insertion of Sensitive Information Into Sent Data vulnerability in iberezansky 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery interactive-3d-flipbook-powered-physics-engine allows Retrieve Embedded Sensitive Data.This issue affects 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery: from n/a through <= 1.16.16.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/interactive-3d-flipbook-powered-physics-engine/vulnerability/wordpress-3d-flipbook-pdf-flipbook-viewer-flipbook-image-gallery-plugin-1-16-16-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-58227
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alexander Lueken Podlove Subscribe button podlove-subscribe-button allows Stored XSS.This issue affects Podlove Subscribe button: from n/a through <= 1.3.11.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/podlove-subscribe-button/vulnerability/wordpress-podlove-subscribe-button-plugin-1-3-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58228
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin LLC Quick View for WooCommerce woo-quickview allows Stored XSS.This issue affects Quick View for WooCommerce: from n/a through <= 2.2.16.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woo-quickview/vulnerability/wordpress-quick-view-for-woocommerce-plugin-2-2-16-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58229
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Sitekit sitekit allows Stored XSS.This issue affects Sitekit: from n/a through <= 2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sitekit/vulnerability/wordpress-sitekit-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58230
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes ZoloBlocks zoloblocks allows DOM-Based XSS.This issue affects ZoloBlocks: from n/a through <= 2.3.12.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/zoloblocks/vulnerability/wordpress-zoloblocks-plugin-2-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58231
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bitlydeveloper Bitly wp-bitly allows Stored XSS.This issue affects Bitly: from n/a through <= 2.8.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-bitly/vulnerability/wordpress-bitly-plugin-2-7-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58232
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ickata Image Editor by Pixo image-editor-by-pixo allows DOM-Based XSS.This issue affects Image Editor by Pixo: from n/a through <= 2.3.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/image-editor-by-pixo/vulnerability/wordpress-image-editor-by-pixo-plugin-2-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58233
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Guaven Labs SQL Chart Builder sql-chart-builder allows DOM-Based XSS.This issue affects SQL Chart Builder: from n/a through <= 2.3.7.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sql-chart-builder/vulnerability/wordpress-sql-chart-builder-plugin-2-3-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58234
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JoomSky JS Job Manager js-jobs allows Stored XSS.This issue affects JS Job Manager: from n/a through <= 2.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/js-jobs/vulnerability/wordpress-js-job-manager-plugin-2-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58235
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Front End Users front-end-only-users allows Stored XSS.This issue affects Front End Users: from n/a through <= 3.2.35.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/front-end-only-users/vulnerability/wordpress-front-end-users-plugin-3-2-33-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58236
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Mayo Moriyama Force Update Translations force-update-translations allows Cross Site Request Forgery.This issue affects Force Update Translations: from n/a through <= 0.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/force-update-translations/vulnerability/wordpress-force-update-translations-plugin-0-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58237
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Niaj Morshed LC Wizard ghl-wizard allows Stored XSS.This issue affects LC Wizard: from n/a through <= 2.2.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ghl-wizard/vulnerability/wordpress-lc-wizard-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58238
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ONTRAPORT PilotPress pilotpress allows Stored XSS.This issue affects PilotPress: from n/a through <= 2.0.36.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/pilotpress/vulnerability/wordpress-pilotpress-plugin-2-0-35-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58239
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chandrika Sista WP Category Dropdown wp-category-dropdown allows Stored XSS.This issue affects WP Category Dropdown: from n/a through <= 1.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-category-dropdown/vulnerability/wordpress-wp-category-dropdown-plugin-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58240
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michel - xiligroup dev xili-tidy-tags xili-tidy-tags allows Stored XSS.This issue affects xili-tidy-tags: from n/a through <= 1.12.06.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/xili-tidy-tags/vulnerability/wordpress-xili-tidy-tags-plugin-1-12-06-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58241
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snapwidget SnapWidget Social Photo Feed Widget snapwidget-wp-instagram-widget allows DOM-Based XSS.This issue affects SnapWidget Social Photo Feed Widget: from n/a through <= 1.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/snapwidget-wp-instagram-widget/vulnerability/wordpress-snapwidget-social-photo-feed-widget-plugin-1-1-0-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2025-58242
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vadim Bogaiskov Bg Church Memos bg-church-memos allows DOM-Based XSS.This issue affects Bg Church Memos: from n/a through <= 1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bg-church-memos/vulnerability/wordpress-bg-church-memos-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58244
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Anps Constructo constructo allows Object Injection.This issue affects Constructo: from n/a through <= 4.3.9.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Theme/constructo/vulnerability/wordpress-constructo-theme-4-3-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve