deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-12815
Published: 2025-03-05
Description: The Point Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'point_maker' shortcode in all versions up to, and including, 0.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/point-maker/trunk/shortcode.php; https://wordpress.org/plugins/point-maker/; https://www.wordfence.com/threat-intel/vulnerabilities/id/c4a46d4c-3f03-4d41-8382-b43a02b59cb2?source=cve
CVE: CVE-2024-13232
Published: 2025-03-05
Description: The WordPress Awesome Import & Export Plugin - Import & Export WordPress Data plugin for WordPress is vulnerable arbitrary SQL Execution and privilege escalation due to a missing capability check on the renderImport() function in all versions up to, and including, 4.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary SQL statements that can leveraged to create a new administrative user account.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://codecanyon.net/item/wordpress-awesome-import-export-plugin-v-24/12896266; https://www.wordfence.com/threat-intel/vulnerabilities/id/f24f0673-b5c8-4086-8795-692228a413af?source=cve
CVE: CVE-2024-13747
Published: 2025-03-05
Description: The WooMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'template_delete_saved' function in all versions up to, and including, 3.0.34. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject SQL into an existing post deletion query.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://codecanyon.net/item/email-customizer-for-woocommerce-with-drag-drop-builder-woo-email-editor/22400984; https://www.wordfence.com/threat-intel/vulnerabilities/id/e74e1a7c-4fe6-4041-8c4c-13389dacb9db?source=cve
CVE: CVE-2024-13757
Published: 2025-03-05
Description: The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_layer shortcode in all versions up to, and including, 3.10.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/master-slider/trunk/includes/msp-shortcodes.php#L815; https://wordpress.org/plugins/master-slider/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/26a7fb51-f40d-46b8-9f52-495716032a1b?source=cve
CVE: CVE-2024-13777
Published: 2025-03-05
Description: The ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.91 via deserialization of untrusted input from the 'margs' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502, CWE-502
References: https://codecanyon.net/item/zoomsounds-wordpress-wave-audio-player-with-playlist/6181433; https://www.wordfence.com/threat-intel/vulnerabilities/id/1ec4633a-0742-4646-accd-cc0b9e01302a?source=cve
CVE: CVE-2024-13778
Published: 2025-03-05
Description: The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to SQL Injection via several functions in all versions up to, and including, 1.16.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://codecanyon.net/item/hero-menu-responsive-wordpress-mega-menu-plugin/10324895; https://www.wordfence.com/threat-intel/vulnerabilities/id/5bdf04e6-6d9d-41a3-ac54-1a95f4617ea4?source=cve
CVE: CVE-2024-13779
Published: 2025-03-05
Description: The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'index' parameter in all versions up to, and including, 1.16.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://codecanyon.net/item/hero-menu-responsive-wordpress-mega-menu-plugin/10324895; https://www.wordfence.com/threat-intel/vulnerabilities/id/18d37650-057d-4cd1-bfeb-e40885d22566?source=cve
CVE: CVE-2024-13780
Published: 2025-03-05
Description: The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the hmenu_delete_menu() function in all versions up to, and including, 1.16.5. This makes it possible for unauthenticated attackers to delete arbitrary directories on the server.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://codecanyon.net/item/hero-menu-responsive-wordpress-mega-menu-plugin/10324895; https://www.wordfence.com/threat-intel/vulnerabilities/id/17872fe4-b566-44ca-8218-3677fb75cb1c?source=cve
CVE: CVE-2024-13787
Published: 2025-03-05
Description: The VEDA - MultiPurpose WordPress Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2 via deserialization of untrusted input in the 'veda_backup_and_restore_action' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://themeforest.net/item/veda-multipurpose-theme/15860489; https://www.wordfence.com/threat-intel/vulnerabilities/id/d0966138-b28b-4c03-a2cf-b51c5f478276?source=cve
CVE: CVE-2024-13809
Published: 2025-03-05
Description: The Hero Slider - WordPress Slider Plugin plugin for WordPress is vulnerable to SQL Injection via several parameters in all versions up to, and including, 1.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://codecanyon.net/item/hero-slider-wordpress-slider-plugin/13067813; https://www.wordfence.com/threat-intel/vulnerabilities/id/a692d9c4-66e0-4461-ad13-65e1446106c5?source=cve
CVE: CVE-2024-13810
Published: 2025-03-05
Description: The Zass - WooCommerce Theme for Handmade Artists and Artisans theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'zass_import_zass' AJAX actions in all versions up to, and including, 3.9.9.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import demo content and overwrite the site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://themeforest.net/item/zass-wordpress-woocommerce-theme/19614113; https://www.wordfence.com/threat-intel/vulnerabilities/id/d85e54c2-dff6-42e6-8123-767438f9c5f1?source=cve
CVE: CVE-2024-13811
Published: 2025-03-05
Description: The Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafka_import_lafka' AJAX actions in all versions up to, and including, 4.5.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import demo data that overrides the site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://themeforest.net/item/lafka-fast-food-restaurant-woocommerce-theme/23969682; https://www.wordfence.com/threat-intel/vulnerabilities/id/50d60e4f-7680-4ec0-9183-bdc8439679db?source=cve
CVE: CVE-2024-13815
Published: 2025-03-05
Description: The The Listingo theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.2.7. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: https://themeforest.net/item/listingo-business-listing-wordpress-directory-theme/20617051; https://www.wordfence.com/threat-intel/vulnerabilities/id/e4595a79-c7d0-4e37-b19b-9ae985c9d713?source=cve
CVE: CVE-2024-13839
Published: 2025-03-05
Description: The Staff Directory Plugin: Company Directory plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/staff-directory-pro/trunk/include/tgmpa/init.php#L99; https://wordpress.org/plugins/staff-directory-pro/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/80[PII_REDACTED]-441a-b51d-2d09968492b5?source=cve
CVE: CVE-2024-5667
Published: 2025-03-05
Description: Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Featherlight.js JavaScript library (versions 1.7.13 to 1.7.14) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-featherlight/trunk/js/wpFeatherlight.pkgd.js; https://plugins.trac.wordpress.org/changeset/3137531/responsive-lightbox; https://www.wordfence.com/threat-intel/vulnerabilities/id/44b173da-a6b9-424c-95a1-a87a9b8ee4af?source=cve
CVE: CVE-2025-0954
Published: 2025-03-05
Description: The WP Online Contract plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the json_import() and json_export() functions in all versions up to, and including, 5.1.4. This makes it possible for unauthenticated attackers to import and export the plugin's settings.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://codecanyon.net/item/wp-online-contract/7698011; https://www.wordfence.com/threat-intel/vulnerabilities/id/70f464ca-ff6c-4c2e-8b56-bf5e4bc6bd1f?source=cve
CVE: CVE-2025-0956
Published: 2025-03-05
Description: The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.4.0 via deserialization of untrusted input from the 'raccookie_guest_email' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://codecanyon.net/item/woocommerce-recover-abandoned-cart/7715167; https://www.wordfence.com/threat-intel/vulnerabilities/id/067c974c-b3bb-4f06-8f7c-3963112c40d2?source=cve
CVE: CVE-2025-1515
Published: 2025-03-05
Description: The WP Real Estate Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.8. This is due to insufficient identity verification on the LinkedIn login request process. This makes it possible for unauthenticated attackers to bypass official authentication and log in as any user on the site, including administrators.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://themeforest.net/item/home-villa-real-estate-wordpress-theme/19446059; https://www.wordfence.com/threat-intel/vulnerabilities/id/84f08111-d116-46f9-9765-28966e338753?source=cve
CVE: CVE-2025-25015
Published: 2025-03-05
Description: Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests.
In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectors
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-1321
References: https://discuss.elastic.co/t/kibana-8-17-3-8-16-6-security-update-esa-2025-06/375441
CVE: CVE-2024-11153
Published: 2025-03-05
Description: The Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.0 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as logged-in users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3253935%40content-control%2Ftrunk&old=3214723%40content-control%2Ftrunk&sfp_email=&sfph_mail=#file8; https://wordpress.org/plugins/content-control/; https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe51f96-82b2-4091-acd8-a8131a47eb07?source=cve
CVE: CVE-2024-11951
Published: 2025-03-05
Description: The Homey Login Register plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.0. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://themeforest.net/item/homey-booking-wordpress-theme/23338013; https://www.wordfence.com/threat-intel/vulnerabilities/id/67c4066f-b8bc-4cd0-ae47-844af23e003f?source=cve
CVE: CVE-2024-12281
Published: 2025-03-05
Description: The Homey theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.2. This is due to the plugin allowing users who are registering new accounts to set their own role. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the Administrator, Editor, or Shop Manager role.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://themeforest.net/item/homey-booking-wordpress-theme/23338013; https://www.wordfence.com/threat-intel/vulnerabilities/id/3b93c33c-4ab1-48a2-b84d-3cb38ccea829?source=cve
CVE: CVE-2024-12650
Published: 2025-03-05
Description: An attacker with low privileges can manipulate the requested memory size, causing the application to use an invalid memory area. This could lead to a crash of the application but it does not affected other applications.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-252
References: https://cert.vde.com/en/advisories/VDE-2025-004
CVE: CVE-2024-13423
Published: 2025-03-05
Description: The Sparkling theme for WordPress is vulnerable to unauthorized plugin activation/deactivation due to a missing capability check on the 'sparkling_activate_plugin' and 'sparkling_deactivate_plugin' functions in versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to activate/deactivate arbitrary plugins.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://themes.trac.wordpress.org/browser/sparkling/2.4.9/inc/welcome-screen/class-sparkling-welcome.php#L69; https://themes.trac.wordpress.org/browser/sparkling/2.4.9/inc/welcome-screen/class-sparkling-welcome.php#L82; https://themes.trac.wordpress.org/changeset/266657/#file3
CVE: CVE-2024-13471
Published: 2025-03-05
Description: The DesignThemes Core Features plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dt_process_imported_file function in all versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to read arbitrary files on the underlying operating system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://themeforest.net/item/lms-learning-management-system-education-lms-wordpress-theme/7867581; https://www.wordfence.com/threat-intel/vulnerabilities/id/1729d0de-1f5f-4349-b592-5841d01ed33a?source=cve
CVE: CVE-2025-1463
Published: 2025-03-05
Description: The Spreadsheet Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to improper nonce validation within the class-wpgsi-show.php script. This makes it possible for unauthenticated attackers to publish arbitrary posts, including private, granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/wpgsi/trunk/admin/class-wpgsi-show.php; https://plugins.trac.wordpress.org/changeset/3250077/; https://plugins.trac.wordpress.org/changeset/3250077/#file352
CVE: CVE-2025-1702
Published: 2025-03-05
Description: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 2.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/ultimatemember/ultimatemember/pull/1654/commits/74647d42cc8d63f5d4f687efcd0792c246c23039; https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/includes/core/class-member-directory.php#L1775; https://plugins.trac.wordpress.org/browser/ultimate-member/trunk/includes/core/class-member-directory.php#L1863
CVE: CVE-2024-11216
Published: 2025-03-05
Description: Authorization Bypass Through User-Controlled Key, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in PozitifIK Pik Online allows Account Footprinting, Session Hijacking.This issue affects Pik Online: before 3.1.5.
CVSS Score: 7.6 (HIGH)
CWE: CWE-359, CWE-639
References: https://www.usom.gov.tr/bildirim/tr-25-0052
CVE: CVE-2024-12097
Published: 2025-03-05
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Boceksoft Informatics E-Travel allows SQL Injection.This issue affects E-Travel: before 15.12.2024.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0053
CVE: CVE-2024-13147
Published: 2025-03-05
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Merkur Software B2B Login Panel allows SQL Injection.This issue affects B2B Login Panel: before 15.01.2025.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0054
CVE: CVE-2024-12799
Published: 2025-03-05
Description: Insufficiently Protected Credentials
vulnerability in OpenText Identity Manager Advanced Edition on Windows, Linux,
64 bit allows Privilege Abuse. This vulnerability could allow an
authenticated user to obtain higher privileged user’s sensitive information via
crafted payload.

This issue affects Identity Manager Advanced
Edition: from 4.8.0.0 through 4.8.7.0102, 4.9.0.0.
CWE: CWE-522
References: https://portal.microfocus.com/s/article/KM000037455
CVE: CVE-2025-1714
Published: 2025-03-05
Description: Lack of Rate Limiting in Sign-up workflow in Perforce Gliffy prior to version 4.14.0-7 on Gliffy online allows attacker to enumerate valid user emails and potentially DOS the server
CWE: CWE-200, CWE-307
References: https://portal.perforce.com/s/detail/a91PA000001ScY1YAK
CVE: CVE-2023-38693
Published: 2025-03-05
Description: Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via an XML XXE attack. This vulnerability is fixed in Lucee 5.4.3.2, 5.3.12.1, 5.3.7.59, 5.3.8.236, and 5.3.9.173.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://github.com/lucee/Lucee/security/advisories/GHSA-vwjx-mmwm-pwrf
CVE: CVE-2025-21095
Published: 2025-03-05
Description: Path traversal may lead to arbitrary file download. The score without 
least privilege principle violation is as calculated below. In 
combination with other issues it may facilitate further compromise of 
the device. Remediation in Version 6.8.0, release date: 01-Mar-25.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://support.ixiacom.com/; https://support.ixiacom.com/support-overview/product-support/downloads-updates; https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02
CVE: CVE-2025-22212
Published: 2025-03-05
Description: A SQL injection vulnerability in the Convert Forms component versions 1.0.0-1.0.0 - 4.4.9 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the submission management area in backend.
CVSS Score: 2.7 (LOW)
CWE: CWE-89, CWE-89
References: https://github.com/AdamWallwork/CVEs/tree/main/2025/CVE-2025-22212; https://www.tassos.gr/
CVE: CVE-2025-23416
Published: 2025-03-05
Description: Path traversal may lead to arbitrary file deletion. The score without 
least privilege principle violation is as calculated below. In 
combination with other issues it may facilitate further compromise of 
the device. Remediation in Version 6.8.0, release date: 01-Mar-25.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://support.ixiacom.com/; https://support.ixiacom.com/support-overview/product-support/downloads-updates; https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02