deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-2558
Published: 2025-04-24
Description: The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticated users to perform LFI attacks and download arbitrary file from the server
CVSS Score: 8.6 (HIGH)
References: https://wpscan.com/vulnerability/6a8e1c89-a01d-4347-91fc-ba454784b153/; https://wpscan.com/vulnerability/6a8e1c89-a01d-4347-91fc-ba454784b153/
CVE: CVE-2025-32730
Published: 2025-04-24
Description: Use of hard-coded cryptographic key vulnerability in i-PRO Configuration Tool affects the network system for i-PRO Co., Ltd. surveillance cameras and recorders. This vulnerability allows a local authenticated attacker to use the authentication information from the last connected surveillance cameras and recorders.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-321
References: https://i-pro.com/products_and_solutions/en/surveillance/solutions/technologies/cyber-security/psirt/security-advisories; https://jvn.jp/en/jp/JVN84627857/
CVE: CVE-2025-35965
Published: 2025-04-24
Description: Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific posts, overloading the server and leading to a denial-of-service (DoS) condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://mattermost.com/security-updates
CVE: CVE-2025-3761
Published: 2025-04-24
Description: The My Tickets – Accessible Event Ticketing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.16. This is due to the mt_save_profile() function not appropriately restricting access to unauthorized users to update roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to that of an administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://plugins.trac.wordpress.org/changeset/3280248/my-tickets/trunk/my-tickets.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/6d875c23-3d8a-4f82-bea3-1c46b5045d94?source=cve
CVE: CVE-2025-41395
Published: 2025-04-24
Description: Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of service (DoS) of the web app for all users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1287
References: https://mattermost.com/security-updates
CVE: CVE-2025-41423
Published: 2025-04-24
Description: Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, allowing any user or attacker to delete posts containing actions created by the Playbooks bot, even without channel access or appropriate permissions.
CVSS Score: 3.1 (LOW)
CWE: CWE-863
References: https://mattermost.com/security-updates
CVE: CVE-2024-12244
Published: 2025-04-24
Description: An issue has been discovered in access controls could allow users to view certain restricted project information even when related features are disabled in GitLab EE, affecting all versions from 17.7 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://gitlab.com/gitlab-org/gitlab/-/issues/508046; https://hackerone.com/reports/2862754
CVE: CVE-2025-0639
Published: 2025-04-24
Description: An issue has been discovered affecting service availability via issue preview in GitLab CE/EE affecting all versions from 16.7 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/gitlab/-/issues/514507; https://hackerone.com/reports/2946553
CVE: CVE-2025-1908
Published: 2025-04-24
Description: An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.
CVSS Score: 7.7 (HIGH)
CWE: CWE-840
References: https://gitlab.com/gitlab-org/gitlab/-/issues/523065; https://hackerone.com/reports/3016623
CVE: CVE-2024-13307
Published: 2025-04-24
Description: The Reales WP - Real Estate WordPress Theme theme for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'reales_delete_file', 'reales_delete_file_plans', 'reales_add_to_favourites', and 'reales_remove_from_favourites' functions in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to delete arbitrary attachments, and add or remove favorite property listings for any user.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://themeforest.net/item/reales-wp-real-estate-wordpress-theme/10330568; https://www.wordfence.com/threat-intel/vulnerabilities/id/cb94caa4-35a4-4aa3-8d25-263bbd58072a?source=cve
CVE: CVE-2025-1284
Published: 2025-04-24
Description: The Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1 via the xc_woo_printer_preview AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user's invoices and orders which can contain sensitive information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://codecanyon.net/item/woocommerce-google-cloud-print/21129093; https://www.wordfence.com/threat-intel/vulnerabilities/id/6f593dce-4b56-46c0-becd-75fd16f165a8?source=cve
CVE: CVE-2025-2543
Published: 2025-04-24
Description: The Advanced Accordion Gutenberg Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/advanced-accordion-block/tags/4.8.2/advanced-accordion-block.php#L363; https://plugins.trac.wordpress.org/browser/advanced-accordion-block/tags/4.8.2/advanced-accordion-block.php#L364; https://plugins.trac.wordpress.org/browser/advanced-accordion-block/tags/4.8.2/advanced-accordion-block.php#L369
CVE: CVE-2025-2579
Published: 2025-04-24
Description: The Lottie Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the uploaded file.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/embed-lottie-player/tags/1.1.8/plugin.php#L130; https://plugins.trac.wordpress.org/browser/embed-lottie-player/tags/1.1.8/plugin.php#L82; https://plugins.trac.wordpress.org/browser/embed-lottie-player/tags/1.2.0/plugin.php
CVE: CVE-2025-3058
Published: 2025-04-24
Description: The Xelion Webchat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the xwc_save_settings() function in all versions up to, and including, 9.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/xelion-webchat/trunk//includes/class-xelion-webchat-ajax-admin.php#L119; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3282039%40xelion-webchat&new=3282039%40xelion-webchat&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/250202d5-3a0d-494c-8386-1f4cd015ad7e?source=cve
CVE: CVE-2025-3065
Published: 2025-04-24
Description: The Database Toolset plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/database-toolset/trunk/admin/class-database-toolset-admin.php#L109; https://wordpress.org/plugins/database-toolset/; https://www.wordfence.com/threat-intel/vulnerabilities/id/0e656123-cae4-4e0c-a80a-98526be293a8?source=cve
CVE: CVE-2025-3101
Published: 2025-04-24
Description: The Configurator Theme Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.4.7. This is due to the plugin not properly validating user meta fields prior to updating them in the database. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change escalate their privileges to Administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://themeforest.net/item/configurator-woocommerce-wordpress-theme/20474230; https://www.wordfence.com/threat-intel/vulnerabilities/id/535aa061-479f-415e-bee6-3151c42b917e?source=cve
CVE: CVE-2025-3280
Published: 2025-04-24
Description: The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value_filter' parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3288303%40elex-bulk-edit-products-prices-attributes-for-woocommerce-basic&new=3288303%40elex-bulk-edit-products-prices-attributes-for-woocommerce-basic&sfp_email=&sfph_mail=; https://wordpress.org/plugins/elex-bulk-edit-products-prices-attributes-for-woocommerce-basic/; https://www.wordfence.com/threat-intel/vulnerabilities/id/e2e4b83a-34d5-4a8a-b694-a887a46fe6bf?source=cve
CVE: CVE-2025-3300
Published: 2025-04-24
Description: The WPMasterToolKit (WPMTK) – All in one plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to read and modify the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3281127%40wpmastertoolkit&new=3281127%40wpmastertoolkit&sfp_email=&sfph_mail=; https://wordpress.org/plugins/wpmastertoolkit/; https://www.wordfence.com/threat-intel/vulnerabilities/id/c389ba1a-45c5-4fba-9b99-0713fe39da42?source=cve
CVE: CVE-2025-3603
Published: 2025-04-24
Description: The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-620
References: https://plugins.trac.wordpress.org/browser/flynax-bridge/trunk/request.php; https://plugins.trac.wordpress.org/changeset/3306501/; https://www.wordfence.com/threat-intel/vulnerabilities/id/fa8124db-ee6a-481d-88c6-4cc84fefcf1c?source=cve
CVE: CVE-2025-3604
Published: 2025-04-24
Description: The Flynax Bridge plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/flynax-bridge/trunk/request.php; https://plugins.trac.wordpress.org/changeset/3306501/; https://www.wordfence.com/threat-intel/vulnerabilities/id/935caa43-4c75-47ad-a631-63988e21f834?source=cve
CVE: CVE-2025-3607
Published: 2025-04-24
Description: The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.8. This is due to the plugin not properly validating a user's identity prior to updating a password. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-620
References: https://plugins.trac.wordpress.org/browser/frontend-login-and-registration-blocks/trunk/inc/class-flr-blocks-lost-password.php#L115; https://plugins.trac.wordpress.org/changeset/3325911/#file10; https://plugins.trac.wordpress.org/changeset/3325911/#file35
CVE: CVE-2025-3776
Published: 2025-04-24
Description: The Verification SMS with TargetSMS plugin for WordPress is vulnerable to limited Remote Code Execution in all versions up to, and including, 1.5 via the 'targetvr_ajax_handler' function. This is due to a lack of validation on the type of function that can be called. This makes it possible for unauthenticated attackers to execute any callable function on the site, such as phpinfo().
CVSS Score: 8.3 (HIGH)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/verification-sms-targetsms/trunk/inc/ajax.php#L7; https://plugins.trac.wordpress.org/browser/verification-sms-targetsms/trunk/inc/ajax.php#L9; https://www.wordfence.com/threat-intel/vulnerabilities/id/ed08d248-7467-4a3b-91a2-4286d91b9c50?source=cve
CVE: CVE-2025-3793
Published: 2025-04-24
Description: The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plugin not properly validating a user's identity prior to updating their password through the 'bp_force_password_ajax' function in all versions up to, and including, 0.1. This makes it possible for authenticated attackers, with subscriber-level access and above and under certain prerequisites, to change arbitrary user's passwords, including administrators, and leverage that to gain access to their accounts.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-620
References: https://plugins.trac.wordpress.org/browser/buddy-press-force-password-change/trunk/bp-force-password-change.php#L93; https://www.wordfence.com/threat-intel/vulnerabilities/id/e3048c4c-77b1-4778-a5d0-b532df777d06?source=cve
CVE: CVE-2025-3832
Published: 2025-04-24
Description: The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘successredirect’ parameter in all versions up to, and including, 6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/fusedesk/trunk/fusedesk.php#L516; https://plugins.trac.wordpress.org/changeset/3282801/; https://wordpress.org/plugins/fusedesk/#developers
CVE: CVE-2021-47662
Published: 2025-04-24
Description: Due to missing authorization an unauthenticated remote attacker can cause a DoS attack by connecting via HTTPS and triggering the shutdown button.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://www.sciencedirect.com/science/article/pii/S[PII_REDACTED]001657
CVE: CVE-2021-47663
Published: 2025-04-24
Description: Due to improper JSON Web Tokens implementation an unauthenticated remote attacker can guess a valid session ID and therefore impersonate a user to gain full access.
CVSS Score: 8.1 (HIGH)
CWE: CWE-613
References: https://www.sciencedirect.com/science/article/pii/S[PII_REDACTED]001657
CVE: CVE-2021-47664
Published: 2025-04-24
Description: Due to improper authentication mechanism an unauthenticated remote attacker can enumerate valid usernames.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://www.sciencedirect.com/science/article/pii/S[PII_REDACTED]001657
CVE: CVE-2025-3872
Published: 2025-04-24
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon centreon-web (User configuration form modules) allows SQL Injection.


A user with high privileges is able to become administrator by intercepting the contact form request and altering its payload.



This issue affects Centreon: from 22.10.0 before 22.10.28, from 23.04.0 before 23.04.25, from 23.10.0 before 23.10.20, from 24.04.0 before 24.04.10, from 24.10.0 before 24.10.4.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/centreon/centreon/releases; https://thewatch.centreon.com/latest-security-bulletins-64/cve-2024-55571-centreon-web-high-severity-4496
CVE: CVE-2025-27820
Published: 2025-04-24
Description: A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://github.com/apache/httpcomponents-client/pull/574; https://github.com/apache/httpcomponents-client/pull/621; https://hc.apache.org/httpcomponents-client-5.4.x/index.html
CVE: CVE-2025-46420
Published: 2025-04-24
Description: A flaw was found in libsoup. It is vulnerable to memory leaks in the soup_header_parse_quality_list() function when parsing a quality list that contains elements with all zeroes.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://access.redhat.com/errata/RHSA-2025:4439; https://access.redhat.com/errata/RHSA-2025:4440; https://access.redhat.com/errata/RHSA-2025:4508
CVE: CVE-2025-46421
Published: 2025-04-24
Description: A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-497
References: https://access.redhat.com/errata/RHSA-2025:4439; https://access.redhat.com/errata/RHSA-2025:4440; https://access.redhat.com/errata/RHSA-2025:4508
CVE: CVE-2025-30408
Published: 2025-04-24
Description: Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39904, Acronis Cyber Protect 16 (Windows) before build 39938.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-732
References: https://security-advisory.acronis.com/advisories/SEC-8035
CVE: CVE-2025-30409
Published: 2025-04-24
Description: Denial of service due to allocation of resources without limits. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39904, Acronis Cyber Protect 17 (Windows) before build 41186.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://security-advisory.acronis.com/advisories/SEC-8148
CVE: CVE-2025-43855
Published: 2025-04-24
Description: tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to crash a tRPC 11 WebSocket server. Any tRPC 11 server with WebSocket enabled with a createContext method set is vulnerable. This issue has been patched in version 11.1.1.
CWE: CWE-248
References: https://github.com/trpc/trpc/commit/9beb26c636d44852e0f407f3d7a82ad54df65b4d; https://github.com/trpc/trpc/security/advisories/GHSA-pj3v-9cm8-gvj8
CVE: CVE-2025-29568
Published: 2025-04-24
Description: A vulnerability has been discovered in the code-projects Online Class and Exam Scheduling System 1.0. The issue affects some unknown features in the file /Scheduling/pages/class_sched.php. Manipulating the class parameter can lead to cross-site scripting (XSS).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/secloverwang/-Vulnerability-recurrence/issues/1; https://github.com/secloverwang/Vulnerability-recurrence/issues/1
CVE: CVE-2025-44134
Published: 2025-04-24
Description: A vulnerability was found in Code-Projects Online Class and Exam Scheduling System 1.0 in the file /Scheduling/pages/class_save.php. Manipulation of parameter class will lead to SQL injection attacks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/secloverwang/-Vulnerability-recurrence/issues/3
CVE: CVE-2025-44135
Published: 2025-04-24
Description: A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0 in /Scheduling/pages/profile_update.php. Manipulating the parameter username will cause SQL injection attacks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/secloverwang/-Vulnerability-recurrence/issues/4
CVE: CVE-2024-30148
Published: 2025-04-24
Description: Improper access control of endpoint in HCL Leap
allows certain admin users to import applications from the
server's filesystem.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-284
References: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0119900
CVE: CVE-2025-32921
Published: 2025-04-24
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpoperations Arrival arrival allows PHP Local File Inclusion.This issue affects Arrival: from n/a through <= 1.4.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/arrival/vulnerability/wordpress-arrival-theme-1-4-5-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39359
Published: 2025-04-24
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codeworkweb CWW Portfolio cww-portfolio allows PHP Local File Inclusion.This issue affects CWW Portfolio: from n/a through <= 1.3.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/cww-portfolio/vulnerability/wordpress-cww-portfolio-theme-1-3-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39360
Published: 2025-04-24
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in everestthemes Grace Mag grace-mag allows PHP Local File Inclusion.This issue affects Grace Mag: from n/a through <= 1.1.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/grace-mag/vulnerability/wordpress-grace-mag-theme-1-1-5-local-file-inclusion-vulnerability?_s_id=cve