deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-6658
Published: 2025-06-25
Description: PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26733.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-444/
CVE: CVE-2025-6659
Published: 2025-06-25
Description: PDF-XChange Editor PRC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26734.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-445/
CVE: CVE-2025-6660
Published: 2025-06-25
Description: PDF-XChange Editor GIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of GIF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26763.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-443/
CVE: CVE-2025-6661
Published: 2025-06-25
Description: PDF-XChange Editor App Object Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of App objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26823.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-446/
CVE: CVE-2025-6662
Published: 2025-06-25
Description: PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26985.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://www.pdf-xchange.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-25-447/
CVE: CVE-2025-6667
Published: 2025-06-25
Description: A vulnerability was found in code-projects Car Rental System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/add_cars.php. The manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/12; https://vuldb.com/?ctiid.313880
CVE: CVE-2025-6668
Published: 2025-06-25
Description: A vulnerability was found in code-projects Inventory Management System 1.0. It has been classified as critical. This affects an unknown part of the file /php_action/fetchSelectedBrand.php. The manipulation of the argument brandId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/lijingze-eng/cve/issues/1; https://vuldb.com/?ctiid.313881
CVE: CVE-2025-6669
Published: 2025-06-25
Description: A vulnerability was found in gooaclok819 sublinkX up to 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file middlewares/jwt.go. The manipulation with the input sublink leads to use of hard-coded cryptographic key . The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9 is able to address this issue. The patch is identified as 778d26aef723daa58df98c8060c43f5bf5d1b10b. It is recommended to upgrade the affected component.
CVSS Score: 3.7 (LOW)
CWE: CWE-320, CWE-321
References: https://github.com/gooaclok819/sublinkX/commit/778d26aef723daa58df98c8060c43f5bf5d1b10b; https://github.com/gooaclok819/sublinkX/issues/68; https://github.com/gooaclok819/sublinkX/issues/68#issuecomment[PII_REDACTED]
CVE: CVE-2025-3863
Published: 2025-06-26
Description: The Post Carousel Slider for Elementor plugin for WordPress is vulnerable to improper authorization due to a missing capability check on the process_wbelps_promo_form() function in all versions up to, and including, 1.6.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger the plugin’s support‐form handler to send arbitrary emails to the site’s support address.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/post-carousel-slider-for-elementor/tags/1.5.0/support-page/class-support-page.php#L28; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3316424%40post-carousel-slider-for-elementor&new=3316424%40post-carousel-slider-for-elementor&sfp_email=&sfph_mail=; https://wordpress.org/plugins/post-carousel-slider-for-elementor/#developers
CVE: CVE-2025-4334
Published: 2025-06-26
Description: The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is due to insufficient restrictions on user meta values that can be supplied during registration. This makes it possible for unauthenticated attackers to register as an administrator.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://plugins.trac.wordpress.org/browser/wp-registration/trunk/inc/classes/class.register.php#L135; https://plugins.trac.wordpress.org/changeset/3327946/; https://www.wordfence.com/threat-intel/vulnerabilities/id/c211e0c0-3086-43d2-853c-489f9c42b0ab?source=cve
CVE: CVE-2025-5488
Published: 2025-06-26
Description: The WP Masonry & Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wmis' shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-masonry-infinite-scroll/trunk/includes/functions.php#L227; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3314905%40wp-masonry-infinite-scroll&new=3314905%40wp-masonry-infinite-scroll&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/656c6236-55e6-4989-8f3d-2d2f81ab0093?source=cve
CVE: CVE-2025-5535
Published: 2025-06-26
Description: The e.nigma buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/enigma-buttons/trunk/enigma-buttons.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/4c570533-1a67-46ad-9d29-35f70ae3bb6a?source=cve
CVE: CVE-2025-5540
Published: 2025-06-26
Description: The Event RSVP and Simple Event Management Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3324339%40wp-easy-events&new=3324339%40wp-easy-events&sfp_email=&sfph_mail=; https://wordpress.org/plugins/wp-easy-events/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f09ffc02-bfed-4aa3-a3d3-58e188b3e147?source=cve
CVE: CVE-2025-5559
Published: 2025-06-26
Description: The TimeZoneCalculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'timezonecalculator_output' shortcode in all versions up to, and including, 3.37 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/timezonecalculator/; https://www.wordfence.com/threat-intel/vulnerabilities/id/f1e1a9ab-9ba9-45ff-aecd-b8953abc653a?source=cve
CVE: CVE-2025-5564
Published: 2025-06-26
Description: The GC Social Wall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gc_social_wall' shortcode in all versions up to, and including, 1.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.svn.wordpress.org/gc-social-wall/trunk/GCSocialWall.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/cfe548ce-5dc9-4073-b755-d28e37720808?source=cve
CVE: CVE-2025-5588
Published: 2025-06-26
Description: The Image Editor by Pixo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘download’ parameter in all versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/image-editor-by-pixo/trunk/frontend.php#L42; https://plugins.trac.wordpress.org/changeset/3315303/; https://wordpress.org/plugins/image-editor-by-pixo/#developers
CVE: CVE-2025-5590
Published: 2025-06-26
Description: The Owl carousel responsive plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/responsive-owl-carousel/trunk/query/db_gallery.php#L57; https://wordpress.org/plugins/responsive-owl-carousel/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/e1f230f5-d40c-43b2-82f2-c920dca9707f?source=cve
CVE: CVE-2025-5812
Published: 2025-06-26
Description: The VG WORT METIS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gutenberg_save_post() function in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update limited post settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/vgw-metis/trunk/classes/admin.php#L422; https://plugins.trac.wordpress.org/changeset/3334017/vgw-metis/trunk/classes/admin.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/b9edcbdc-5b01-4880-95ec-57d87ccbb472?source=cve
CVE: CVE-2025-6258
Published: 2025-06-26
Description: The WP SoundSystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsstm-track shortcode in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-soundsystem/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/f027626a-471c-48aa-add6-7597254dcfa9?source=cve
CVE: CVE-2025-6290
Published: 2025-06-26
Description: The Tournament Bracket Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bracket' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/tournament-bracket-generator/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/bdde01aa-2d38-4085-b11a-ef8633ee928a?source=cve
CVE: CVE-2025-6378
Published: 2025-06-26
Description: The Responsive Food and Drink Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_pdf_menus shortcode in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/responsive-food-and-drink-menu/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/342ccae4-2e77-4a4f-963f-689b882eb7f0?source=cve
CVE: CVE-2025-6383
Published: 2025-06-26
Description: The WP-PhotoNav plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's photonav shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-photonav/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/c07054e1-b6c9-4e70-aece-09f81bb418ef?source=cve
CVE: CVE-2025-6538
Published: 2025-06-26
Description: The Post Rating and Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/post-rating-and-review/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/12a89b8f-554c-4d92-adb2-ec84138d568d?source=cve
CVE: CVE-2025-5275
Published: 2025-06-26
Description: The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the privacy settings fields in all versions up to, and including, 1.8.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
This issue was partially fixed in version 1.8.6.1 and fully fixed in version 1.8.6.2.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.5.3/templates/form-fields/checkbox.php#L40; https://www.wordfence.com/threat-intel/vulnerabilities/id/453d8918-32dc-43d6-8969-71f719536891?source=cve
CVE: CVE-2025-5813
Published: 2025-06-26
Description: The Amazon Products to WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcta2w_get_amazon_product_callback() function in all versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to create new produces.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/import-products-to-wc/trunk/inc/functions.php#L266; https://www.wordfence.com/threat-intel/vulnerabilities/id/a0906540-46fc-4f76-9265-cb87c6340fad?source=cve
CVE: CVE-2025-5929
Published: 2025-06-26
Description: The The Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘clientId’ parameter in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/the-countdown/tags/2.0.1/the-countdown.php#L95; https://wordpress.org/plugins/the-countdown/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/34578df8-661c-4c54-b06c-e1d787ca3c55?source=cve
CVE: CVE-2025-5932
Published: 2025-06-26
Description: The Homerunner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.30. This is due to missing or incorrect nonce validation on the main_settings() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/homerunner-smartcheckout/tags/1.0.29/classes/class-settings.php#L319; https://plugins.trac.wordpress.org/browser/homerunner-smartcheckout/tags/1.0.31/classes/class-settings.php#L483; https://www.wordfence.com/threat-intel/vulnerabilities/id/36eaff34-50cd-4399-8314-19ae4f50d017?source=cve
CVE: CVE-2025-6537
Published: 2025-06-26
Description: The Namasha By Mdesign plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘playicon_title’ parameter in all versions up to, and including, 1.2.00 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/namasha-by-mdesign/tags/1.2.00/front/class-core.php?rev=3332973#L56; https://plugins.trac.wordpress.org/browser/namasha-by-mdesign/tags/1.2.05/front/class-core.php?rev=3332973#L56; https://wordpress.org/plugins/namasha-by-mdesign/#developers
CVE: CVE-2025-6540
Published: 2025-06-26
Description: The web-cam plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slug’ parameter in all versions up to, and including, 3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3411831%40web-cam&new=3411831%40web-cam; https://wordpress.org/plugins/web-cam/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/d2d2954c-762c-4bdc-8469-7fe19f4e980d?source=cve
CVE: CVE-2025-6546
Published: 2025-06-26
Description: The Drive Folder Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tablecssclass’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/drive-folder-embeder/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/86b21472-6a76-4d7b-84ff-f8b79c052aba?source=cve