deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-60174
Published: 2025-12-18
Description: Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Object Injection.This issue affects WP Gravity Forms Constant Contact Plugin: from n/a through <= 1.1.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/gf-constant-contact/vulnerability/wordpress-wp-gravity-forms-constant-contact-plugin-plugin-1-1-2-deserialization-of-untrusted-data-vulnerability?_s_id=cve
CVE: CVE-2025-60178
Published: 2025-12-18
Description: Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Object Injection.This issue affects WP Gravity Forms HubSpot: from n/a through <= 1.2.6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/gf-hubspot/vulnerability/wordpress-wp-gravity-forms-hubspot-plugin-1-2-6-deserialization-of-untrusted-data-vulnerability?_s_id=cve
CVE: CVE-2025-60180
Published: 2025-12-18
Description: Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Salesforce gf-salesforce-crmperks allows Object Injection.This issue affects WP Gravity Forms Salesforce: from n/a through <= 1.5.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/gf-salesforce-crmperks/vulnerability/wordpress-wp-gravity-forms-salesforce-plugin-1-5-1-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-60182
Published: 2025-12-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Schiocco Support Board supportboard allows Reflected XSS.This issue affects Support Board: from n/a through < 3.8.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/supportboard/vulnerability/wordpress-support-board-plugin-3-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-63039
Published: 2025-12-18
Description: Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through <= 2.9.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/listingpro/vulnerability/wordpress-listingpro-theme-2-9-9-broken-access-control-vulnerability-2?_s_id=cve
CVE: CVE-2025-64188
Published: 2025-12-18
Description: Incorrect Privilege Assignment vulnerability in PenciDesign Soledad soledad allows Privilege Escalation.This issue affects Soledad: from n/a through <= 8.6.9.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Theme/soledad/vulnerability/wordpress-soledad-theme-8-6-9-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-64189
Published: 2025-12-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows Reflected XSS.This issue affects XStore Core: from n/a through < 5.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/et-core-plugin/vulnerability/wordpress-xstore-core-plugin-5-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-64191
Published: 2025-12-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows Reflected XSS.This issue affects XStore: from n/a through < 9.6.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/xstore/vulnerability/wordpress-xstore-theme-9-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-64192
Published: 2025-12-18
Description: Missing Authorization vulnerability in 8theme XStore xstore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects XStore: from n/a through < 9.6.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/xstore/vulnerability/wordpress-xstore-theme-9-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-64193
Published: 2025-12-18
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in 8theme XStore xstore allows PHP Local File Inclusion.This issue affects XStore: from n/a through < 9.6.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/xstore/vulnerability/wordpress-xstore-theme-9-6-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-64203
Published: 2025-12-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress Mailster mailster allows Reflected XSS.This issue affects Mailster: from n/a through < 4.1.14.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mailster/vulnerability/wordpress-mailster-plugin-4-1-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-64205
Published: 2025-12-18
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TieLabs Jannah jannah allows PHP Local File Inclusion.This issue affects Jannah: from n/a through <= 7.6.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/jannah/vulnerability/wordpress-jannah-theme-7-6-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-64206
Published: 2025-12-18
Description: Deserialization of Untrusted Data vulnerability in TieLabs Jannah jannah allows Object Injection.This issue affects Jannah: from n/a through <= 7.6.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Theme/jannah/vulnerability/wordpress-jannah-theme-7-6-0-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-64207
Published: 2025-12-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah jannah allows DOM-Based XSS.This issue affects Jannah: from n/a through <= 7.6.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/jannah/vulnerability/wordpress-jannah-theme-7-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-64209
Published: 2025-12-18
Description: Missing Authorization vulnerability in StylemixThemes Masterstudy masterstudy allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Masterstudy: from n/a through < 4.8.122.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/masterstudy/vulnerability/wordpress-masterstudy-theme-4-8-122-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-64213
Published: 2025-12-18
Description: Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Retrieve Embedded Sensitive Data.This issue affects MasterStudy LMS Pro: from n/a through < 4.7.16.
CVSS Score: 7.5 (HIGH)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/masterstudy-lms-learning-management-system-pro/vulnerability/wordpress-masterstudy-lms-pro-plugin-4-7-16-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-64214
Published: 2025-12-18
Description: Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MasterStudy LMS Pro: from n/a through < 4.7.16.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/masterstudy-lms-learning-management-system-pro/vulnerability/wordpress-masterstudy-lms-pro-plugin-4-7-16-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-64217
Published: 2025-12-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Photography photography allows Reflected XSS.This issue affects Photography: from n/a through <= 7.7.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/photography/vulnerability/wordpress-photography-theme-7-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-64218
Published: 2025-12-18
Description: Insertion of Sensitive Information Into Sent Data vulnerability in WP Chill Passster content-protector allows Retrieve Embedded Sensitive Data.This issue affects Passster: from n/a through <= 4.2.19.
CVSS Score: 7.5 (HIGH)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/content-protector/vulnerability/wordpress-passster-plugin-4-2-19-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-64221
Published: 2025-12-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Reflected XSS.This issue affects Reservation Plugin: from n/a through <= 1.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/dt-reservation-plugin/vulnerability/wordpress-reservation-plugin-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-64222
Published: 2025-12-18
Description: Missing Authorization vulnerability in FantasticPlugins WooCommerce Recover Abandoned Cart rac allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Recover Abandoned Cart: from n/a through <= 24.6.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/rac/vulnerability/wordpress-woocommerce-recover-abandoned-cart-plugin-24-6-0-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-64223
Published: 2025-12-18
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PenciDesign PenNews pennews allows PHP Local File Inclusion.This issue affects PenNews: from n/a through < 6.7.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/pennews/vulnerability/wordpress-pennews-theme-6-7-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-64225
Published: 2025-12-18
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in colabrio Stockie Extra stockie-extra allows Code Injection.This issue affects Stockie Extra: from n/a through <= 1.2.11.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-80
References: https://patchstack.com/database/Wordpress/Plugin/stockie-extra/vulnerability/wordpress-stockie-extra-plugin-1-2-11-content-injection-vulnerability?_s_id=cve
CVE: CVE-2025-64227
Published: 2025-12-18
Description: Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/sprout-invoices/vulnerability/wordpress-client-invoicing-by-sprout-invoices-plugin-20-8-7-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-64230
Published: 2025-12-18
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Chill Filr filr-protection allows Path Traversal.This issue affects Filr: from n/a through <= 1.2.10.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/filr-protection/vulnerability/wordpress-filr-plugin-1-2-10-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-64231
Published: 2025-12-18
Description: Unrestricted Upload of File with Dangerous Type vulnerability in RedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet & Database rtwwcfp-wordpress-contact-form-7-pdf allows Using Malicious Files.This issue affects WordPress Contact Form 7 PDF, Google Sheet & Database: from n/a through <= 3.0.0.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/rtwwcfp-wordpress-contact-form-7-pdf/vulnerability/wordpress-wordpress-contact-form-7-pdf-google-sheet-database-plugin-3-0-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-64233
Published: 2025-12-18
Description: Deserialization of Untrusted Data vulnerability in BoldThemes Codiqa codiqa allows Object Injection.This issue affects Codiqa: from n/a through < 1.2.8.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Theme/codiqa/vulnerability/wordpress-codiqa-theme-1-2-8-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-64258
Published: 2025-12-18
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in wpweb Follow My Blog Post follow-my-blog-post allows Retrieve Embedded Sensitive Data.This issue affects Follow My Blog Post: from n/a through <= 2.3.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/follow-my-blog-post/vulnerability/wordpress-follow-my-blog-post-plugin-2-3-9-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-64260
Published: 2025-12-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marco Milesi ANAC XML Bandi di Gara avcp allows Reflected XSS.This issue affects ANAC XML Bandi di Gara: from n/a through <= 7.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/avcp/vulnerability/wordpress-anac-xml-bandi-di-gara-plugin-7-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-64266
Published: 2025-12-18
Description: Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.5.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/booking-and-rental-manager-for-woocommerce/vulnerability/wordpress-booking-and-rental-manager-plugin-2-5-4-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-64268
Published: 2025-12-18
Description: Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through <= 1.0.44.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/timetics/vulnerability/wordpress-timetics-plugin-1-0-44-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-64270
Published: 2025-12-18
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in masteriyo Masteriyo - LMS learning-management-system allows Retrieve Embedded Sensitive Data.This issue affects Masteriyo - LMS: from n/a through <= 2.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-2-0-3-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-64272
Published: 2025-12-18
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in GetResponse Email marketing for WordPress by GetResponse Official getresponse-official allows Retrieve Embedded Sensitive Data.This issue affects Email marketing for WordPress by GetResponse Official: from n/a through <= 1.5.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/getresponse-official/vulnerability/wordpress-email-marketing-for-wordpress-by-getresponse-official-plugin-1-5-3-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-64273
Published: 2025-12-18
Description: Missing Authorization vulnerability in GetResponse Email marketing for WordPress by GetResponse Official getresponse-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Email marketing for WordPress by GetResponse Official: from n/a through <= 1.5.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/getresponse-official/vulnerability/wordpress-email-marketing-for-wordpress-by-getresponse-official-plugin-1-5-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-64295
Published: 2025-12-18
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Retrieve Embedded Sensitive Data.This issue affects All In One SEO Pack: from n/a through <= 4.8.6.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/all-in-one-seo-pack/vulnerability/wordpress-all-in-one-seo-pack-plugin-4-8-6-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-64371
Published: 2025-12-18
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.6.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Theme/traveler/vulnerability/wordpress-traveler-theme-3-2-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-64372
Published: 2025-12-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler traveler allows Reflected XSS.This issue affects Traveler: from n/a through < 3.2.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/traveler/vulnerability/wordpress-traveler-theme-3-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-64373
Published: 2025-12-18
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in shinetheme Traveler traveler allows PHP Local File Inclusion.This issue affects Traveler: from n/a through < 3.2.6.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/traveler/vulnerability/wordpress-traveler-theme-3-2-6-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-64374
Published: 2025-12-18
Description: Unrestricted Upload of File with Dangerous Type vulnerability in StylemixThemes Motors motors allows Using Malicious Files.This issue affects Motors: from n/a through <= 5.6.81.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Theme/motors/vulnerability/wordpress-motors-theme-5-6-80-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-64375
Published: 2025-12-18
Description: Missing Authorization vulnerability in Mahmudul Hasan Arif WP Social Ninja wp-social-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Ninja: from n/a through <= 3.20.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-social-reviews/vulnerability/wordpress-wp-social-ninja-plugin-3-20-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-64376
Published: 2025-12-18
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro listingpro allows Reflected XSS.This issue affects ListingPro: from n/a through < 2.9.10.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/listingpro/vulnerability/wordpress-listingpro-theme-2-9-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-64377
Published: 2025-12-18
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CridioStudio ListingPro listingpro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through < 2.9.10.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/listingpro/vulnerability/wordpress-listingpro-theme-2-9-10-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-64378
Published: 2025-12-18
Description: Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through < 2.9.10.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/listingpro/vulnerability/wordpress-listingpro-theme-2-9-10-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66054
Published: 2025-12-18
Description: Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through <= 4.2.9.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-2-9-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66068
Published: 2025-12-18
Description: Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InstaWP Connect: from n/a through <= 0.1.1.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/instawp-connect/vulnerability/wordpress-instawp-connect-plugin-0-1-1-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66070
Published: 2025-12-18
Description: Missing Authorization vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpForo Forum: from n/a through <= 2.4.10.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wpforo/vulnerability/wordpress-wpforo-forum-plugin-2-4-10-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-66074
Published: 2025-12-18
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Path Traversal.This issue affects WP Webhooks: from n/a through <= 3.3.8.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/wp-webhooks/vulnerability/wordpress-wp-webhooks-plugin-3-3-8-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-66078
Published: 2025-12-18
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters Hotel Booking Lite motopress-hotel-booking-lite allows Remote Code Inclusion.This issue affects Hotel Booking Lite: from n/a through <= 5.2.3.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/motopress-hotel-booking-lite/vulnerability/wordpress-hotel-booking-lite-plugin-5-2-3-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2025-66088
Published: 2025-12-18
Description: Missing Authorization vulnerability in Property Hive PropertyHive propertyhive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PropertyHive: from n/a through <= 2.1.12.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/propertyhive/vulnerability/wordpress-propertyhive-plugin-2-1-12-broken-access-control-vulnerability-2?_s_id=cve
CVE: CVE-2025-66100
Published: 2025-12-18
Description: Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RestroPress: from n/a through <= 3.2.3.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/restropress/vulnerability/wordpress-restropress-plugin-3-2-3-5-broken-access-control-vulnerability?_s_id=cve