deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-48333
Published: 2025-06-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPQuark eForm - WordPress Form Builder wp-fsqm-pro allows Reflected XSS.This issue affects eForm - WordPress Form Builder: from n/a through < 4.19.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-fsqm-pro/vulnerability/wordpress-eform-wordpress-form-builder-4-19-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49071
Published: 2025-06-17
Description: Unrestricted Upload of File with Dangerous Type vulnerability in NasaTheme Flozen flozen-theme allows Upload a Web Shell to a Web Server.This issue affects Flozen: from n/a through < 1.5.1.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Theme/flozen-theme/vulnerability/wordpress-flozen-1-5-1-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-49175
Published: 2025-06-17
Description: A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-125
References: https://access.redhat.com/errata/RHSA-2025:10258; https://access.redhat.com/errata/RHSA-2025:10342; https://access.redhat.com/errata/RHSA-2025:10343
CVE: CVE-2025-49176
Published: 2025-06-17
Description: A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.
CVSS Score: 7.3 (HIGH)
CWE: CWE-190
References: https://access.redhat.com/errata/RHSA-2025:10258; https://access.redhat.com/errata/RHSA-2025:10342; https://access.redhat.com/errata/RHSA-2025:10343
CVE: CVE-2025-49177
Published: 2025-06-17
Description: A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-200
References: https://access.redhat.com/errata/RHSA-2025:10258; https://access.redhat.com/errata/RHSA-2025:9303; https://access.redhat.com/errata/RHSA-2025:9304
CVE: CVE-2025-49178
Published: 2025-06-17
Description: A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://access.redhat.com/errata/RHSA-2025:10258; https://access.redhat.com/errata/RHSA-2025:10342; https://access.redhat.com/errata/RHSA-2025:10343
CVE: CVE-2025-49179
Published: 2025-06-17
Description: A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computing request length, which allows a client to bypass length checks.
CVSS Score: 7.3 (HIGH)
CWE: CWE-190
References: https://access.redhat.com/errata/RHSA-2025:10258; https://access.redhat.com/errata/RHSA-2025:10342; https://access.redhat.com/errata/RHSA-2025:10343
CVE: CVE-2025-49180
Published: 2025-06-17
Description: A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://access.redhat.com/errata/RHSA-2025:10258; https://access.redhat.com/errata/RHSA-2025:10342; https://access.redhat.com/errata/RHSA-2025:10343
CVE: CVE-2025-49234
Published: 2025-06-17
Description: Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Dummy Content Generator: from n/a through <= 3.4.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-dummy-content-generator/vulnerability/wordpress-wp-dummy-content-generator-plugin-3-4-6-arbitrary-user-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-49251
Published: 2025-06-17
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Fana fana allows PHP Local File Inclusion.This issue affects Fana: from n/a through <= 1.1.28.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/fana/vulnerability/wordpress-fana-1-1-28-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49252
Published: 2025-06-17
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Besa besa allows PHP Local File Inclusion.This issue affects Besa: from n/a through <= 2.3.8.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/besa/vulnerability/wordpress-besa-2-3-8-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49253
Published: 2025-06-17
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Lasa lasa allows PHP Local File Inclusion.This issue affects Lasa: from n/a through <= 1.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/lasa/vulnerability/wordpress-lasa-1-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49254
Published: 2025-06-17
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Nika nika allows PHP Local File Inclusion.This issue affects Nika: from n/a through <= 1.2.8.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/nika/vulnerability/wordpress-nika-1-2-8-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49255
Published: 2025-06-17
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Ruza ruza allows PHP Local File Inclusion.This issue affects Ruza: from n/a through <= 1.0.7.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/ruza/vulnerability/wordpress-ruza-1-0-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49256
Published: 2025-06-17
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Sapa sapa allows PHP Local File Inclusion.This issue affects Sapa: from n/a through <= 1.1.14.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/sapa/vulnerability/wordpress-sapa-1-1-14-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49257
Published: 2025-06-17
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Zota zota allows PHP Local File Inclusion.This issue affects Zota: from n/a through <= 1.3.8.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/zota/vulnerability/wordpress-zota-1-3-8-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49258
Published: 2025-06-17
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Maia maia allows PHP Local File Inclusion.This issue affects Maia: from n/a through <= 1.1.15.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/maia/vulnerability/wordpress-maia-1-1-15-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49259
Published: 2025-06-17
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Hara hara allows PHP Local File Inclusion.This issue affects Hara: from n/a through <= 1.2.10.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/hara/vulnerability/wordpress-hara-1-2-10-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49260
Published: 2025-06-17
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Aora aora allows PHP Local File Inclusion.This issue affects Aora: from n/a through <= 1.3.9.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/aora/vulnerability/wordpress-aora-1-3-9-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49261
Published: 2025-06-17
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza diza allows PHP Local File Inclusion.This issue affects Diza: from n/a through <= 1.3.8.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/diza/vulnerability/wordpress-diza-1-3-8-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49266
Published: 2025-06-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Reflected XSS.This issue affects Ultimate Reviews: from n/a through <= 3.2.14.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-reviews/vulnerability/wordpress-ultimate-reviews-plugin-3-2-14-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49312
Published: 2025-06-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeRevolution Echo RSS Feed Post Generator Plugin for WordPress rss-feed-post-generator-echo allows Reflected XSS.This issue affects Echo RSS Feed Post Generator Plugin for WordPress: from n/a through <= 5.4.8.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/rss-feed-post-generator-echo/vulnerability/wordpress-echo-rss-feed-post-generator-plugin-for-wordpress-plugin-5-4-8-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49316
Published: 2025-06-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflected XSS.This issue affects WP2LEADS: from n/a through <= 3.5.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp2leads/vulnerability/wordpress-wp2leads-plugin-3-5-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49330
Published: 2025-06-17
Description: Deserialization of Untrusted Data vulnerability in CRM Perks Integration for Contact Form 7 and Zoho CRM, Bigin cf7-zoho allows Object Injection.This issue affects Integration for Contact Form 7 and Zoho CRM, Bigin: from n/a through <= 1.3.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/cf7-zoho/vulnerability/wordpress-integration-for-contact-form-7-and-zoho-crm-bigin-1-3-0-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49331
Published: 2025-06-17
Description: Deserialization of Untrusted Data vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Object Injection.This issue affects eCommerce Product Catalog: from n/a through <= 3.4.3.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/ecommerce-product-catalog/vulnerability/wordpress-ecommerce-product-catalog-3-4-3-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49415
Published: 2025-06-17
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fastw3b LLC FW Gallery fw-gallery allows Path Traversal.This issue affects FW Gallery: from n/a through <= 8.0.0.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/fw-gallery/vulnerability/wordpress-fw-gallery-8-0-0-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-49444
Published: 2025-06-17
Description: Unrestricted Upload of File with Dangerous Type vulnerability in merkulove Reformer for Elementor reformer-elementor allows Upload a Web Shell to a Web Server.This issue affects Reformer for Elementor: from n/a through <= 1.0.5.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/reformer-elementor/vulnerability/wordpress-reformer-for-elementor-1-0-5-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-49447
Published: 2025-06-17
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Food Menu  allows Using Malicious Files. This issue affects FW Food Menu : from n/a through 6.0.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/wordpress/plugin/fw-food-menu/vulnerability/wordpress-fw-food-menu-6-0-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-49451
Published: 2025-06-17
Description: Path Traversal: '.../...//' vulnerability in yannisraft Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery aeroscroll-gallery allows Path Traversal.This issue affects Aeroscroll Gallery – Infinite Scroll Image Gallery & Post Grid with Photo Gallery: from n/a through <= 1.0.13.
CVSS Score: 7.5 (HIGH)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Plugin/aeroscroll-gallery/vulnerability/wordpress-aeroscroll-gallery-infinite-scroll-image-gallery-post-grid-with-photo-gallery-1-0-12-directory-traversal-vulnerability?_s_id=cve
CVE: CVE-2025-49452
Published: 2025-06-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Ladó PostaPanduri postapanduri allows SQL Injection.This issue affects PostaPanduri: from n/a through <= 2.1.3.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/postapanduri/vulnerability/wordpress-postapanduri-2-1-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49508
Published: 2025-06-17
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay cozystay allows PHP Local File Inclusion.This issue affects CozyStay: from n/a through < 1.7.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/cozystay/vulnerability/wordpress-cozystay-1-7-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49854
Published: 2025-06-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anh Tran Slim SEO slim-seo allows SQL Injection.This issue affects Slim SEO: from n/a through <= 4.5.4.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/slim-seo/vulnerability/wordpress-slim-seo-plugin-4-5-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49855
Published: 2025-06-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks Flexible Shortcodes meks-flexible-shortcodes allows DOM-Based XSS.This issue affects Meks Flexible Shortcodes: from n/a through <= 1.3.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/meks-flexible-shortcodes/vulnerability/wordpress-meks-flexible-shortcodes-plugin-1-3-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49856
Published: 2025-06-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Cross Site Request Forgery.This issue affects Responsive Plus: from n/a through <= 3.2.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/responsive-add-ons/vulnerability/wordpress-responsive-plus-plugin-3-2-2-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-49857
Published: 2025-06-17
Description: Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through <= 2.9.4.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/mycred/vulnerability/wordpress-mycred-plugin-2-9-4-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49858
Published: 2025-06-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/arconix-shortcodes/vulnerability/wordpress-arconix-shortcodes-plugin-2-1-17-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49859
Published: 2025-06-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in etruel WP Views Counter wpecounter allows Stored XSS.This issue affects WP Views Counter: from n/a through <= 2.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpecounter/vulnerability/wordpress-wp-views-counter-plugin-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49861
Published: 2025-06-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timur Kamaev Kama Click Counter kama-clic-counter allows Stored XSS.This issue affects Kama Click Counter: from n/a through <= 4.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/kama-clic-counter/vulnerability/wordpress-kama-click-counter-plugin-4-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49862
Published: 2025-06-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in motov.net Ebook Store ebook-store allows Stored XSS.This issue affects Ebook Store: from n/a through <= 5.8008.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ebook-store/vulnerability/wordpress-ebook-store-plugin-5-8008-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49863
Published: 2025-06-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs Advanced Sermons advanced-sermons allows Stored XSS.This issue affects Advanced Sermons: from n/a through <= 3.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/advanced-sermons/vulnerability/wordpress-advanced-sermons-plugin-3-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49864
Published: 2025-06-17
Description: Missing Authorization vulnerability in AFS Analytics AFS Analytics addfreestats allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AFS Analytics: from n/a through <= 4.21.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/addfreestats/vulnerability/wordpress-afs-analytics-plugin-4-21-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49865
Published: 2025-06-17
Description: Cross-Site Request Forgery (CSRF) vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Cross Site Request Forgery.This issue affects Advanced Settings: from n/a through <= 3.0.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/advanced-settings/vulnerability/wordpress-advanced-settings-plugin-3-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49868
Published: 2025-06-17
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Phishing.This issue affects FunnelKit Automations: from n/a through <= 3.6.0.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/wp-marketing-automations/vulnerability/wordpress-automation-by-autonami-plugin-3-6-0-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2025-49871
Published: 2025-06-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noptin Newsletter Team Noptin newsletter-optin-box allows Stored XSS.This issue affects Noptin: from n/a through <= 3.8.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/newsletter-optin-box/vulnerability/wordpress-noptin-plugin-3-8-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49872
Published: 2025-06-17
Description: Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects myCred: from n/a through <= 2.9.4.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/mycred/vulnerability/wordpress-mycred-plugin-2-9-4-2-broken-access-control-vulnerability-2?_s_id=cve
CVE: CVE-2025-49874
Published: 2025-06-17
Description: Missing Authorization vulnerability in tychesoftwares Arconix FAQ arconix-faq allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arconix FAQ: from n/a through <= 1.9.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/arconix-faq/vulnerability/wordpress-arconix-faq-plugin-1-9-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49875
Published: 2025-06-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Stored XSS.This issue affects If-So Dynamic Content Personalization: from n/a through <= 1.9.3.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/if-so/vulnerability/wordpress-if-so-dynamic-content-personalization-plugin-1-9-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49877
Published: 2025-06-17
Description: Server-Side Request Forgery (SSRF) vulnerability in Metagauss ProfileGrid  profilegrid-user-profiles-groups-and-communities allows Server Side Request Forgery.This issue affects ProfileGrid : from n/a through <= 5.9.5.2.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/profilegrid-user-profiles-groups-and-communities/vulnerability/wordpress-profilegrid-plugin-5-9-5-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-49878
Published: 2025-06-17
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows DOM-Based XSS.This issue affects WPAdverts: from n/a through <= 2.2.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpadverts/vulnerability/wordpress-wpadverts-plugin-2-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49879
Published: 2025-06-17
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in themezaa Litho litho allows Path Traversal.This issue affects Litho: from n/a through <= 3.0.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Theme/litho/vulnerability/wordpress-litho-3-0-arbitrary-file-deletion-vulnerability?_s_id=cve