deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-49267
Published: 2025-08-14
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Blind SQL Injection.This issue affects Frontend Admin by DynamiApps: from n/a through <= 3.28.3.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/acf-frontend-form-element/vulnerability/wordpress-frontend-admin-by-dynamiapps-3-28-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49271
Published: 2025-08-14
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in GravityWP GravityWP - Merge Tags gravitywp-merge-tags allows PHP Local File Inclusion.This issue affects GravityWP - Merge Tags: from n/a through <= 1.4.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/gravitywp-merge-tags/vulnerability/wordpress-gravitywp-merge-tags-1-4-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49433
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThanhD Supermalink supermalink allows DOM-Based XSS.This issue affects Supermalink: from n/a through <= 1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/supermalink/vulnerability/wordpress-supermalink-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49437
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in worstguy WP LOL Rotation league-of-legends-rotation allows Stored XSS.This issue affects WP LOL Rotation: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/league-of-legends-rotation/vulnerability/wordpress-wp-lol-rotation-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49869
Published: 2025-08-14
Description: Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.0.31.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/wp-event-solution/vulnerability/wordpress-eventin-plugin-4-0-31-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49887
Published: 2025-08-14
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in WPFactory Product XML Feed Manager for WooCommerce product-xml-feeds-for-woocommerce allows Remote Code Inclusion.This issue affects Product XML Feed Manager for WooCommerce: from n/a through <= 2.9.3.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/product-xml-feeds-for-woocommerce/vulnerability/wordpress-product-xml-feed-manager-for-woocommerce-plugin-2-9-3-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2025-50029
Published: 2025-08-14
Description: Missing Authorization vulnerability in Ashish AI Tools artificial-intelligence-auto-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Tools: from n/a through <= 4.0.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/artificial-intelligence-auto-content-generator/vulnerability/wordpress-ai-tools-4-0-7-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-50031
Published: 2025-08-14
Description: Missing Authorization vulnerability in syedamirhussain91 DB Backup db-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DB Backup: from n/a through <= 6.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/db-backup/vulnerability/wordpress-db-backup-6-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-50040
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moshensky CF7 Spreadsheets cf7-spreadsheets allows Stored XSS.This issue affects CF7 Spreadsheets: from n/a through <= 2.3.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cf7-spreadsheets/vulnerability/wordpress-cf7-spreadsheets-plugin-2-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-52712
Published: 2025-08-14
Description: Path Traversal: '.../...//' vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Path Traversal.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.8.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-35
References: https://patchstack.com/database/Wordpress/Plugin/post-and-page-builder/vulnerability/wordpress-post-and-page-builder-by-boldgrid-visual-drag-and-drop-editor-1-27-8-path-traversal-vulnerability?_s_id=cve
CVE: CVE-2025-52716
Published: 2025-08-14
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Acato WP REST Cache wp-rest-cache allows PHP Local File Inclusion.This issue affects WP REST Cache: from n/a through <= 2025.1.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/wp-rest-cache/vulnerability/wordpress-wp-rest-cache-2025-1-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-52720
Published: 2025-08-14
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp allows SQL Injection.This issue affects Super Store Finder: from n/a through <= 7.5.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/superstorefinder-wp/vulnerability/wordpress-super-store-finder-plugin-7-5-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-52721
Published: 2025-08-14
Description: Missing Authorization vulnerability in LCweb Global Gallery allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Global Gallery: from n/a through 9.2.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/global-gallery/vulnerability/wordpress-global-gallery-plugin-9-2-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-52728
Published: 2025-08-14
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows PHP Local File Inclusion.This issue affects Responsive Posts Carousel Pro: from n/a through <= 15.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/responsive-posts-carousel-pro/vulnerability/wordpress-responsive-posts-carousel-wordpress-plugin-plugin-15-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-52730
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themefunction WordPress Event Manager, Event Calendar and Booking Plugin eventin-pro allows Stored XSS.This issue affects WordPress Event Manager, Event Calendar and Booking Plugin: from n/a through <= 4.0.24.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/eventin-pro/vulnerability/wordpress-wordpress-event-manager-event-calendar-and-booking-plugin-plugin-4-0-24-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-52731
Published: 2025-08-14
Description: Missing Authorization vulnerability in themefunction WordPress Event Manager, Event Calendar and Booking Plugin eventin-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Event Manager, Event Calendar and Booking Plugin: from n/a through <= 4.0.24.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/eventin-pro/vulnerability/wordpress-wordpress-event-manager-event-calendar-and-booking-plugin-plugin-4-0-24-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-52732
Published: 2025-08-14
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 GMap Targeting gmap-targeting allows PHP Local File Inclusion.This issue affects GMap Targeting: from n/a through <= 1.1.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/gmap-targeting/vulnerability/wordpress-google-map-targeting-plugin-1-1-6-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-52775
Published: 2025-08-14
Description: Missing Authorization vulnerability in Ronik@UnlimitedWP Project Cost Calculator project-cost-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Project Cost Calculator: from n/a through <= 1.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/project-cost-calculator/vulnerability/wordpress-project-cost-calculator-plugin-1-0-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-52785
Published: 2025-08-14
Description: Missing Authorization vulnerability in softnwords SMM API smm-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMM API: from n/a through <= 6.0.31.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/smm-api/vulnerability/wordpress-smm-api-plugin-6-0-30-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-52788
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson CaptionPix captionpix allows Reflected XSS.This issue affects CaptionPix: from n/a through <= 1.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/captionpix/vulnerability/wordpress-captionpix-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-52800
Published: 2025-08-14
Description: Missing Authorization vulnerability in Unity Business Technology Pty Ltd The E-Commerce ERP profitori allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects The E-Commerce ERP: from n/a through <= 2.1.1.3.
CVSS Score: 7.3 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/profitori/vulnerability/wordpress-the-e-commerce-erp-2-1-1-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-52801
Published: 2025-08-14
Description: Missing Authorization vulnerability in VonStroheim TheBooking thebooking allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects TheBooking: from n/a through <= 1.4.4.
CVSS Score: 7.3 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/thebooking/vulnerability/wordpress-thebooking-plugin-1-4-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-52806
Published: 2025-08-14
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in eyecix JobSearch wp-jobsearch allows PHP Local File Inclusion.This issue affects JobSearch: from n/a through < 3.0.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/wp-jobsearch/vulnerability/wordpress-jobsearch-plugin-2-9-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-52820
Published: 2025-08-14
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in infosoftplugin WooCommerce Point Of Sale (POS) woo-point-of-salepos allows SQL Injection.This issue affects WooCommerce Point Of Sale (POS): from n/a through <= 1.4.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/woo-point-of-salepos/vulnerability/wordpress-woocommerce-point-of-sale-pos-1-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-52823
Published: 2025-08-14
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ovatheme Cube Portfolio cubeportfolio allows SQL Injection.This issue affects Cube Portfolio: from n/a through <= 1.16.8.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/cubeportfolio/vulnerability/wordpress-cube-portfolio-plugin-1-16-8-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-54667
Published: 2025-08-14
Description: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Saad Iqbal myCred mycred allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions.This issue affects myCred: from n/a through <= 2.9.4.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-367
References: https://patchstack.com/database/Wordpress/Plugin/mycred/vulnerability/wordpress-mycred-plugin-plugin-2-9-4-3-race-condition-vulnerability?_s_id=cve
CVE: CVE-2025-54668
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred mycred allows Stored XSS.This issue affects myCred: from n/a through <= 2.9.4.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mycred/vulnerability/wordpress-mycred-plugin-plugin-2-9-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54669
Published: 2025-08-14
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RomanCode MapSVG mapsvg allows SQL Injection.This issue affects MapSVG: from n/a through < 8.7.4.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/mapsvg/vulnerability/wordpress-mapsvg-plugin-8-7-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-54671
Published: 2025-08-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in bobbingwide oik oik allows Cross Site Request Forgery.This issue affects oik: from n/a through <= 4.15.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/oik/vulnerability/wordpress-oik-plugin-plugin-4-15-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-54672
Published: 2025-08-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in Jordy Meow Photo Engine wplr-sync allows Cross Site Request Forgery.This issue affects Photo Engine: from n/a through <= 6.4.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wplr-sync/vulnerability/wordpress-photo-engine-plugin-plugin-6-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-54673
Published: 2025-08-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Chartify chart-builder allows Cross Site Request Forgery.This issue affects Chartify: from n/a through <= 3.5.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/chart-builder/vulnerability/wordpress-chartify-plugin-plugin-3-5-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-54674
Published: 2025-08-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Cross Site Request Forgery.This issue affects Product Configurator for WooCommerce: from n/a through <= 1.4.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/product-configurator-for-woocommerce/vulnerability/wordpress-product-configurator-for-woocommerce-plugin-plugin-1-4-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-54675
Published: 2025-08-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in YITHEMES YITH WooCommerce Popup yith-woocommerce-popup allows Cross Site Request Forgery.This issue affects YITH WooCommerce Popup: from n/a through <= 1.48.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/yith-woocommerce-popup/vulnerability/wordpress-yith-woocommerce-popup-plugin-plugin-1-48-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-54676
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Stored XSS.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/meeting-scheduler-by-vcita/vulnerability/wordpress-online-booking-scheduling-calendar-for-by-vcita-plugin-plugin-4-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54678
Published: 2025-08-14
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Blind SQL Injection.This issue affects Easy Form Builder: from n/a through <= 3.8.15.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/easy-form-builder/vulnerability/wordpress-easy-form-builder-plugin-3-8-15-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-54679
Published: 2025-08-14
Description: Missing Authorization vulnerability in vertim Neon Channel Product Customizer Free neon-channel-product-customizer-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Neon Channel Product Customizer Free: from n/a through <= 2.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/neon-channel-product-customizer-free/vulnerability/wordpress-neon-channel-product-customizer-free-plugin-2-0-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-54680
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sparklewpthemes Blogger Buzz blogger-buzz allows Stored XSS.This issue affects Blogger Buzz: from n/a through <= 1.2.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/blogger-buzz/vulnerability/wordpress-blogger-buzz-theme-theme-1-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54681
Published: 2025-08-14
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allows Phishing.This issue affects Connector for Gravity Forms and Google Sheets: from n/a through <= 1.2.4.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/wp-gravity-forms-spreadsheets/vulnerability/wordpress-connector-for-gravity-forms-and-google-sheets-plugin-plugin-1-2-4-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2025-54682
Published: 2025-08-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allows Cross Site Request Forgery.This issue affects Connector for Gravity Forms and Google Sheets: from n/a through <= 1.2.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-gravity-forms-spreadsheets/vulnerability/wordpress-connector-for-gravity-forms-and-google-sheets-plugin-plugin-1-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-54683
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify WP Modal Popup with Cookie Integration wp-modal-popup-with-cookie-integration allows Reflected XSS.This issue affects WP Modal Popup with Cookie Integration: from n/a through <= 2.4.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-modal-popup-with-cookie-integration/vulnerability/wordpress-wp-modal-popup-with-cookie-integration-plugin-plugin-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54684
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks Integration for Contact Form 7 and Constant Contact cf7-constant-contact allows Stored XSS.This issue affects Integration for Contact Form 7 and Constant Contact: from n/a through <= 1.1.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cf7-constant-contact/vulnerability/wordpress-integration-for-contact-form-7-and-constant-contact-plugin-plugin-1-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54685
Published: 2025-08-14
Description: Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force SureDash suredash allows Retrieve Embedded Sensitive Data.This issue affects SureDash: from n/a through <= 1.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/suredash/vulnerability/wordpress-suredash-plugin-1-1-0-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-54686
Published: 2025-08-14
Description: Deserialization of Untrusted Data vulnerability in scriptsbundle Exertio exertio allows Object Injection.This issue affects Exertio: from n/a through <= 1.3.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Theme/exertio/vulnerability/wordpress-exertio-theme-1-3-2-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-54687
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through <= 2.2.9.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/jet-tabs/vulnerability/wordpress-jettabs-plugin-plugin-2-2-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54688
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-plugin-3-7-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54689
Published: 2025-08-14
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Urna urna allows PHP Local File Inclusion.This issue affects Urna: from n/a through <= 2.5.7.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/urna/vulnerability/wordpress-urna-theme-2-5-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-54690
Published: 2025-08-14
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themeStek Xinterio xinterio allows PHP Local File Inclusion.This issue affects Xinterio: from n/a through <= 4.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/xinterio/vulnerability/wordpress-xinterio-theme-4-2-local-file-inclusion-vulnerability?_s_id=cve