deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-2676
Published: 2025-03-24
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file /add-subadmin.php. The manipulation of the argument sadminusername leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ARPANET-cyber/CVE/issues/5; https://phpgurukul.com/; https://vuldb.com/?ctiid.300693
CVE: CVE-2025-2677
Published: 2025-03-24
Description: A vulnerability has been found in PHPGurukul Bank Locker Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /changeidproof.php. The manipulation of the argument editid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ARPANET-cyber/CVE/issues/6; https://phpgurukul.com/; https://vuldb.com/?ctiid.300694
CVE: CVE-2025-2678
Published: 2025-03-24
Description: A vulnerability was found in PHPGurukul Bank Locker Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /changeimage1.php. The manipulation of the argument editid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ARPANET-cyber/CVE/issues/7; https://phpgurukul.com/; https://vuldb.com/?ctiid.300695
CVE: CVE-2025-2679
Published: 2025-03-24
Description: A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /contact-us.php. The manipulation of the argument pagetitle leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ARPANET-cyber/CVE/issues/8; https://phpgurukul.com/; https://vuldb.com/?ctiid.300696
CVE: CVE-2025-2680
Published: 2025-03-24
Description: A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /edit-assign-locker.php?ltid=1. The manipulation of the argument mobilenumber leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ARPANET-cyber/CVE/issues/9; https://phpgurukul.com/; https://vuldb.com/?ctiid.300697
CVE: CVE-2025-2681
Published: 2025-03-24
Description: A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /edit-locker.php?ltid=6. The manipulation of the argument lockersize leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ARPANET-cyber/CVE/issues/10; https://phpgurukul.com/; https://vuldb.com/?ctiid.300698
CVE: CVE-2025-2682
Published: 2025-03-24
Description: A vulnerability classified as critical has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file /edit-subadmin.php?said=3. The manipulation of the argument mobilenumber leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ARPANET-cyber/CVE/issues/11; https://phpgurukul.com/; https://vuldb.com/?ctiid.300699
CVE: CVE-2025-2683
Published: 2025-03-24
Description: A vulnerability classified as critical was found in PHPGurukul Bank Locker Management System 1.0. This vulnerability affects unknown code of the file /profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ARPANET-cyber/CVE/issues/12; https://phpgurukul.com/; https://vuldb.com/?ctiid.300700
CVE: CVE-2025-2684
Published: 2025-03-24
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Bank Locker Management System 1.0. This issue affects some unknown processing of the file /search-report-details.php. The manipulation of the argument searchinput leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/ARPANET-cyber/CVE/issues/13; https://phpgurukul.com/; https://vuldb.com/?ctiid.300701
CVE: CVE-2024-10558
Published: 2025-03-24
Description: The Form Maker by 10Web  WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7028db78-2870-48d5-b06b-480ac8be3655/
CVE: CVE-2024-13124
Published: 2025-03-24
Description: The Photo Gallery by 10Web  WordPress plugin before 1.8.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5b3bf87b-73a1-47e8-bb00-0dfded07b191/
CVE: CVE-2025-1062
Published: 2025-03-24
Description: The Slider, Gallery, and Carousel by MetaSlider  WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/657b355b-e38f-46d6-b574-7ce736d25f31/
CVE: CVE-2025-1203
Published: 2025-03-24
Description: The Slider, Gallery, and Carousel by MetaSlider  WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://wpscan.com/vulnerability/fca0b129-3299-46d6-9231-ca5afd2fdb66/
CVE: CVE-2025-2686
Published: 2025-03-24
Description: A vulnerability has been found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as critical. Affected by this vulnerability is the function doFilter of the file /admin/ of the component Backend. The manipulation of the argument Request leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://gitee.com/mingyuefusu/tushuguanlixitong/issues/IBTS25; https://vuldb.com/?ctiid.300703; https://vuldb.com/?id.300703
CVE: CVE-2025-2687
Published: 2025-03-24
Description: A vulnerability classified as critical has been found in PHPGurukul eLearning System 1.0. Affected is an unknown function of the file /user/index.php of the component Image Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/ARPANET-cyber/CVE/issues/14; https://phpgurukul.com/; https://vuldb.com/?ctiid.300708
CVE: CVE-2025-2688
Published: 2025-03-24
Description: A vulnerability classified as problematic was found in TOTOLINK A3000RU up to 5.9c.5185. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/ExportSyslog.sh of the component Syslog Configuration File Handler. The manipulation leads to improper access controls. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://lavender-bicycle-a5a.notion.site/TOTOLINK-A3000RU-ExportSyslog-1b953a41781f8064970dc7809a52ac6c?pvs=4; https://vuldb.com/?ctiid.300709; https://vuldb.com/?id.300709
CVE: CVE-2025-2689
Published: 2025-03-24
Description: A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIterator of the file symfony\finder\Iterator\SortableIterator.php. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://github.com/gaorenyusi/gaorenyusi/blob/main/Yii2.md; https://vuldb.com/?ctiid.300710; https://vuldb.com/?id.300710
CVE: CVE-2025-2690
Published: 2025-03-24
Description: A vulnerability, which was classified as critical, was found in yiisoft Yii2 up to 2.0.39. This affects the function Generate of the file phpunit\src\Framework\MockObject\MockClass.php. The manipulation leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20, CWE-502, CWE-502
References: https://github.com/gaorenyusi/gaorenyusi/blob/main/Yii2-2.md; https://vuldb.com/?ctiid.300711; https://vuldb.com/?id.300711
CVE: CVE-2025-2699
Published: 2025-03-24
Description: A vulnerability was found in GetmeUK ContentTools up to 1.6.16. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Image Handler. The manipulation of the argument onload leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://gist.github.com/Masamuneee/657f2e2b0eb5bf9b0d4dbb79f00dac37; https://vuldb.com/?ctiid.300716; https://vuldb.com/?id.300716
CVE: CVE-2025-2700
Published: 2025-03-24
Description: A vulnerability classified as problematic has been found in michelson Dante Editor up to 0.4.4. This affects an unknown part of the component Insert Link Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://gist.github.com/Masamuneee/3be24bf5bf2b09dc61ead2af89363f86; https://vuldb.com/?ctiid.300717; https://vuldb.com/?id.300717
CVE: CVE-2025-2701
Published: 2025-03-24
Description: A vulnerability classified as critical was found in AMTT Hotel Broadband Operation System 1.0. This vulnerability affects the function popen of the file /manager/network/port_setup.php. The manipulation of the argument SwitchVersion/SwitchWrite/SwitchIP/SwitchIndex/SwitchState leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/zian10001/cve/blob/main/rce.md; https://vuldb.com/?ctiid.300718; https://vuldb.com/?id.300718
CVE: CVE-2025-2702
Published: 2025-03-24
Description: A vulnerability, which was classified as critical, has been found in Softwin WMX3 3.1. This issue affects the function ImageAdd of the file /ImageAdd.ashx. The manipulation of the argument File leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434
References: https://github.com/Rain1er/report/blob/main/THNlcnBf/RCE_1.md; https://vuldb.com/?ctiid.300719; https://vuldb.com/?id.300719
CVE: CVE-2025-0478
Published: 2025-03-24
Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to issue reads and writes to arbitrary physical memory pages.

Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform, altering their behaviour.
CVSS Score: 7.8 (HIGH)
CWE: CWE-280
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2025-0835
Published: 2025-03-24
Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2024-8773
Published: 2025-03-24
Description: SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification.

This issue affect SIMPLE.ERP from 6.20 to 6.30. Only the 6.30 version received a patch 6.30@a03.9, which make it possible for an administrator to enforce encrypted communication. Versions 6.20 and 6.25 remain unpatched.
CWE: CWE-757
References: https://cert.pl/en/posts/2025/03/CVE-2024-8773/; https://cert.pl/posts/2025/03/CVE-2024-8773/; https://simple.com.pl/produkty/simple-erp/dla-kogo/
CVE: CVE-2024-8774
Published: 2025-03-24
Description: The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges to a database administrator.

This issue affect SIMPLE.ERP from 6.20 through 6.30. Only the 6.30 version received a patch 6.30@a03.9, which removed the vulnerability. Versions 6.20 and 6.25 remain unpatched.
CWE: CWE-257
References: https://cert.pl/en/posts/2025/03/CVE-2024-8773/; https://cert.pl/posts/2025/03/CVE-2024-8773/; https://simple.com.pl/produkty/simple-erp/dla-kogo/
CVE: CVE-2025-30521
Published: 2025-03-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in giangmd93 GP Back To Top gp-back-to-top allows Cross Site Request Forgery.This issue affects GP Back To Top: from n/a through <= 3.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/gp-back-to-top/vulnerability/wordpress-gp-back-to-top-plugin-3-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-30522
Published: 2025-03-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Damian Orzol Contact Form 7 Material Design cf7-material-design allows Stored XSS.This issue affects Contact Form 7 Material Design: from n/a through <= 1.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/cf7-material-design/vulnerability/wordpress-contact-form-7-material-design-plugin-1-0-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30523
Published: 2025-03-24
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Marcel-NL Super Simple Subscriptions super-simple-subscriptions allows SQL Injection.This issue affects Super Simple Subscriptions: from n/a through <= 1.1.0.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/super-simple-subscriptions/vulnerability/wordpress-super-simple-subscriptions-plugin-1-1-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30525
Published: 2025-03-24
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ProfitShare.ro WP Profitshare wp-profitshare allows SQL Injection.This issue affects WP Profitshare: from n/a through <= 1.4.9.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-profitshare/vulnerability/wordpress-wp-profitshare-plugin-1-4-9-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30526
Published: 2025-03-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in lucksy Typekit plugin for WordPress typekit allows Cross Site Request Forgery.This issue affects Typekit plugin for WordPress: from n/a through <= 1.2.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/typekit/vulnerability/wordpress-typekit-plugin-1-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-30527
Published: 2025-03-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetoolbox My Bootstrap Menu my-bootstrap-menu allows Stored XSS.This issue affects My Bootstrap Menu: from n/a through <= 1.2.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/my-bootstrap-menu/vulnerability/wordpress-my-bootstrap-menu-plugin-1-2-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30528
Published: 2025-03-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in wpshopee Awesome Logos awesome-logos allows SQL Injection.This issue affects Awesome Logos: from n/a through <= 1.2.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/awesome-logos/vulnerability/wordpress-awesome-logos-plugin-1-2-csrf-to-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30529
Published: 2025-03-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Sébastien Dumont Auto Load Next Post auto-load-next-post allows Cross Site Request Forgery.This issue affects Auto Load Next Post: from n/a through <= 1.5.14.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/auto-load-next-post/vulnerability/wordpress-auto-load-next-post-plugin-1-5-14-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-30530
Published: 2025-03-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atikul AI Preloader ai-preloader allows Stored XSS.This issue affects AI Preloader: from n/a through <= 1.0.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ai-preloader/vulnerability/wordpress-ai-preloader-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30531
Published: 2025-03-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in GBS Developer WP Ride Booking wp-ride-booking allows Cross Site Request Forgery.This issue affects WP Ride Booking: from n/a through <= 2.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-ride-booking/vulnerability/wordpress-wp-ride-booking-plugin-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-30532
Published: 2025-03-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MorganF Weather Layer weather-layer allows Stored XSS.This issue affects Weather Layer: from n/a through <= 4.2.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/weather-layer/vulnerability/wordpress-weather-layer-plugin-4-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30533
Published: 2025-03-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Message ticker message-ticker allows Stored XSS.This issue affects Message ticker: from n/a through <= 9.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/message-ticker/vulnerability/wordpress-message-ticker-plugin-9-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30534
Published: 2025-03-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in captcha.soft Image Captcha image-captcha allows Cross Site Request Forgery.This issue affects Image Captcha: from n/a through <= 1.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/image-captcha/vulnerability/wordpress-image-captcha-plugin-1-2-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-30535
Published: 2025-03-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in muro External image replace external-image-replace allows Cross Site Request Forgery.This issue affects External image replace: from n/a through <= 1.0.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/external-image-replace/vulnerability/wordpress-external-image-replace-plugin-1-0-8-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-30536
Published: 2025-03-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zeitwesentech Beautiful Link Preview beautiful-link-preview allows Stored XSS.This issue affects Beautiful Link Preview: from n/a through <= 1.5.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/beautiful-link-preview/vulnerability/wordpress-beautiful-link-preview-plugin-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30537
Published: 2025-03-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristian Sarov Upload Quota per User upload-quota-per-user allows Stored XSS.This issue affects Upload Quota per User: from n/a through <= 1.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/upload-quota-per-user/vulnerability/wordpress-upload-quota-per-user-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30538
Published: 2025-03-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in ChrisHurst Simple Optimizer simple-optimizer allows Cross Site Request Forgery.This issue affects Simple Optimizer: from n/a through <= 1.2.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/simple-optimizer/vulnerability/wordpress-simple-optimizer-plugin-1-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-30539
Published: 2025-03-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benedikt Mo BMo Expo bmo-expo allows Stored XSS.This issue affects BMo Expo: from n/a through <= 1.0.15.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bmo-expo/vulnerability/wordpress-bmo-expo-plugin-1-0-15-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30540
Published: 2025-03-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in avaibook AvaiBook avaibook allows Stored XSS.This issue affects AvaiBook: from n/a through <= 1.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/avaibook/vulnerability/wordpress-avaibook-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve