deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-27612
Published: 2025-03-21
Description: libcontainer is a library for container control. Prior to libcontainer 0.5.3, while creating a tenant container, the tenant builder accepts a list of capabilities to be added in the spec of tenant container. The logic here adds the given capabilities to all capabilities of main container if present in spec, otherwise simply set provided capabilities as capabilities of the tenant container. However, setting inherited caps in any case for tenant container can lead to elevation of capabilities, similar to CVE-2022-29162. This does not affect youki binary itself. This is only applicable if you are using libcontainer directly and using the tenant builder.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-276
References: https://github.com/opencontainers/runc/security/advisories/GHSA-f3fp-gc8g-vw66; https://github.com/youki-dev/youki/blob/9e63fa4da1672a78ca45100f3059a732784a5174/crates/libcontainer/src/container/tenant_builder.rs#L408; https://github.com/youki-dev/youki/commit/747e342d2026fbf3a395db3e2a491ebef00082f1
CVE: CVE-2025-29640
Published: 2025-03-21
Description: Phpgurukul Human Metapneumovirus (HMPV) – Testing Management System v1.0 is vulnerable to SQL Injection in /patient-report.php via the parameter searchdata..
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: https://github.com/Pei4AN/CVE/issues/4
CVE: CVE-2025-29641
Published: 2025-03-21
Description: Phpgurukul Vehicle Record Management System v1.0 is vulnerable to SQL Injection in /index.php via the 'searchinputdata' parameter.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/Pei4AN/CVE/issues/5
CVE: CVE-2025-29927
Published: 2025-03-21
Description: Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 12.3.5, 13.5.9, 14.2.25, and 15.2.3.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-285, CWE-863
References: https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2; https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48; https://github.com/vercel/next.js/releases/tag/v12.3.5
CVE: CVE-2025-2593
Published: 2025-03-21
Description: A vulnerability has been found in FastCMS up to 0.1.5 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/client/article/list. The manipulation of the argument orderBy leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/IceFoxH/VULN/issues/8; https://github.com/IceFoxH/VULN/issues/9; https://vuldb.com/?ctiid.300577
CVE: CVE-2025-2598
Published: 2025-03-21
Description: When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178.2 or later and ensure any forked or derivative code is patched to incorporate the new fixes.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-497
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-005/; https://github.com/aws/aws-cdk/releases/tag/v2.178.2; https://github.com/aws/aws-cdk/security/advisories/GHSA-v63m-x9r9-8gqp
CVE: CVE-2025-30157
Published: 2025-03-21
Description: Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the failure of a websocket handshake will trigger a local reply leading to the crash of Envoy. This vulnerability is fixed in 1.33.1, 1.32.4, 1.31.6, and 1.30.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-460
References: https://github.com/envoyproxy/envoy/commit/8eda1b8ef5ba8663d16a737ab99458c039a9b53c; https://github.com/envoyproxy/envoy/security/advisories/GHSA-cf3q-gqg7-3fm9; https://github.com/envoyproxy/envoy/security/advisories/GHSA-cf3q-gqg7-3fm9
CVE: CVE-2025-30168
Published: 2025-03-21
Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 7.5.2 and 8.0.2, the 3rd party authentication handling of Parse Server allows the authentication credentials of some specific authentication providers to be used across multiple Parse Server apps. For example, if a user signed up using the same authentication provider in two unrelated Parse Server apps, the credentials stored by one app can be used to authenticate the same user in the other app. Note that this only affects Parse Server apps that specifically use an affected 3rd party authentication provider for user authentication, for example by setting the Parse Server option auth to configure a Parse Server authentication adapter. The fix of this vulnerability requires to upgrade Parse Server to a version that includes the bug fix, as well as upgrade the client app to send a secure payload, which is different from the previous insecure payload. This vulnerability is fixed in 7.5.2 and 8.0.2.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-287
References: https://docs.parseplatform.org/parse-server/guide/#oauth-and-3rd-party-authentication; https://github.com/parse-community/parse-server/commit/2ff9c71030bce3aada0a00fbceedeb7ae2c8a41e; https://github.com/parse-community/parse-server/commit/5ef0440c8e763854e62341acaeb6dc4ade3ba82f
CVE: CVE-2019-16151
Published: 2025-03-21
Description: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote unauthenticated attacker to either redirect users to malicious websites via a crafted "Host" header or to execute JavaScript code in the victim's browser context.
This happens when the FortiGate has web filtering and category override enabled/configured.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/advisory/FG-IR-19-301
CVE: CVE-2023-43029
Published: 2025-03-21
Description: IBM Storage Virtualize vSphere Remote Plug-in 1.0 and 1.1 could allow a remote user to obtain sensitive credential information after deployment.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-526
References: https://www.ibm.com/support/pages/node/7228722
CVE: CVE-2024-53348
Published: 2025-03-21
Description: LoxiLB v.0.9.7 and before is vulnerable to Incorrect Access Control which allows attackers to obtain sensitive information and escalate privileges.
CVSS Score: 7.4 (HIGH)
CWE: CWE-284
References: https://gist.github.com/HouqiyuA/8c734c849c1a9b69ac96c46eba4acbcb; https://github.com/loxilb-io/loxilb
CVE: CVE-2024-53349
Published: 2025-03-21
Description: Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to escalation of privileges via the secretes component in the k8s cluster
CVSS Score: 7.4 (HIGH)
CWE: CWE-269
References: https://gist.github.com/HouqiyuA/2a34c8f95dac7d9d8d7df7732403f383; https://github.com/Kuadrant/kuadrant-operator; https://www.cncf.io/projects/kuadrant/
CVE: CVE-2024-53350
Published: 2025-03-21
Description: Insecure permissions in kubeslice v1.3.1 allow attackers to gain access to the service account's token, leading to escalation of privileges.
CVSS Score: 7.4 (HIGH)
CWE: CWE-269
References: https://gist.github.com/HouqiyuA/1cb964206e0d6bebd1c57a124c55fa03; https://github.com/kubeslice/kubeslice; https://kubeslice.io/documentation/open-source/1.3.0
CVE: CVE-2024-53351
Published: 2025-03-21
Description: Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://gist.github.com/HouqiyuA/948a808b8bd48b17b37a4d5e0b6fb005; https://github.com/pipe-cd/pipecd; https://pipecd.dev/
CVE: CVE-2025-29223
Published: 2025-03-21
Description: Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the pt parameter in the traceRoute function.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/JZP018/Vuln/blob/main/linsys/E5600/CI_traceRoute/CI_traceRoute.md
CVE: CVE-2025-29226
Published: 2025-03-21
Description: In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function via the pt["count"] parameter.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/JZP018/Vuln/blob/main/linsys/E5600/CI_pingTest_count/CI_pingTest_count.md
CVE: CVE-2025-29227
Published: 2025-03-21
Description: In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function via the pt["pkgsize"] parameter.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-77
References: https://github.com/JZP018/Vuln/blob/main/linsys/E5600/CI_pingTest_pkgsize/CI_pingTest_pkgsize.md
CVE: CVE-2025-29230
Published: 2025-03-21
Description: Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.emailReg function. The vulnerability can be triggered via the `pt["email"]` parameter.
CVSS Score: 8.6 (HIGH)
CWE: CWE-77
References: https://github.com/JZP018/Vuln/blob/main/linsys/E5600/CI_emailReg_email/CI_emailReg_email.md
CVE: CVE-2025-30349
Published: 2025-03-21
Description: Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://github.com/horde/base/releases/tag/v5.2.23; https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L23-L25; https://github.com/horde/imp/blob/fd9212ca3b72ff834504af4886f7d95138619bd4/doc/INSTALL.rst?plain=1#L61-L62
CVE: CVE-2025-25035
Published: 2025-03-21
Description: Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in Jalios JPlatform 10 allows for Reflected XSS and Stored XSS.This issue affects JPlatform 10: before 10.0.8 (SP8), before 10.0.7 (SP7), before 10.0.6 (SP6) and Jalios Workplace 6.2, Jalios Workplace 6.1, Jalios Workplace 6.0, and Jalios Workplace 5.3 to 5.5
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://community.jalios.com/jcms/jc1_893720/en/security-alert-2025-02-19; https://issues.jalios.com/browse/JCMS-11246; https://issues.jalios.com/browse/JCMS-11248
CVE: CVE-2025-25036
Published: 2025-03-21
Description: Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 before 10.0.8 (SP8).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-611
References: https://community.jalios.com/jcms/jc1_893720/en/security-alert-2025-02-19; https://issues.jalios.com/browse/JCMS-11250; https://vulncheck.com/advisories/jalios-jplatform-xxe
CVE: CVE-2025-2601
Published: 2025-03-21
Description: A vulnerability, which was classified as critical, was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This affects an unknown part of the file activate_reg.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Hefei-Coffee/cve/issues/10; https://vuldb.com/?ctiid.300585; https://vuldb.com/?id.300585
CVE: CVE-2025-2602
Published: 2025-03-21
Description: A vulnerability has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file deactivate_reg.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Hefei-Coffee/cve/issues/11; https://vuldb.com/?ctiid.300586; https://vuldb.com/?id.300586
CVE: CVE-2025-2603
Published: 2025-03-21
Description: A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. This issue affects some unknown processing of the file deactivate.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Hefei-Coffee/cve/issues/12; https://vuldb.com/?ctiid.300587; https://vuldb.com/?id.300587
CVE: CVE-2025-2604
Published: 2025-03-21
Description: A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. It has been classified as critical. Affected is an unknown function of the file edit_act.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Hefei-Coffee/cve/issues/14; https://vuldb.com/?ctiid.300588; https://vuldb.com/?id.300588
CVE: CVE-2025-2606
Published: 2025-03-21
Description: A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/app/soulwinning_crud.php. The manipulation of the argument photo/photo1 leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/Hefei-Coffee/cve/issues/15; https://vuldb.com/?ctiid.300589; https://vuldb.com/?id.300589
CVE: CVE-2025-2607
Published: 2025-03-21
Description: A vulnerability was found in phplaozhang LzCMS-LaoZhangBoKeXiTong up to 1.1.4. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/upload/upimage.html of the component HTTP POST Request Handler. The manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/Jingyi-u/lzcms/tree/main; https://vuldb.com/?ctiid.300590; https://vuldb.com/?id.300590
CVE: CVE-2025-2608
Published: 2025-03-21
Description: A vulnerability classified as critical has been found in PHPGurukul Banquet Booking System 1.2. This affects an unknown part of the file /admin/view-user-queries.php. The manipulation of the argument viewid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/emano888/cve/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.300591
CVE: CVE-2025-30204
Published: 2025-03-21
Description: golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer  followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-405
References: https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3; https://github.com/golang-jwt/jwt/commit/bf316c48137a1212f8d0af9288cc9ce8e59f1afb; https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp
CVE: CVE-2025-26500
Published: 2025-03-21
Description: : Uncontrolled Resource Consumption vulnerability in Wind River Systems VxWorks 7 on VxWorks allows Excessive Allocation.  

Specifically crafted USB packets may lead to the system becoming unavailable

This issue affects VxWorks 7: from 22.06 through 24.03.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-400
References: https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2025-26500
CVE: CVE-2025-2609
Published: 2025-03-21
Description: Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php.

This issue affects MagnusBilling: through 7.3.0.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79, CWE-79
References: https://chocapikk.com/posts/2025/magnusbilling/; https://github.com/magnussolution/magnusbilling7/commit/f0f083c76157e31149ae58342342fb1bf1629e22; https://vulncheck.com/advisories/magnusbilling-logs-xss
CVE: CVE-2025-2610
Published: 2025-03-21
Description: Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling (Alarm Module modules) allows authenticated stored cross-site scripting. This vulnerability is associated with program files protected/components/MagnusLog.Php.

This issue affects MagnusBilling: through 7.3.0.
CVSS Score: 7.6 (HIGH)
CWE: CWE-79, CWE-79
References: https://chocapikk.com/posts/2025/magnusbilling/; https://github.com/magnussolution/magnusbilling7/commit/f0f083c76157e31149ae58342342fb1bf1629e22; https://vulncheck.com/advisories/magnusbilling-alarm-xss
CVE: CVE-2025-30472
Published: 2025-03-22
Description: Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://corosync.org; https://github.com/corosync/corosync/blob/73ba225cc48ebb1903897c792065cb5e876613b0/exec/totemsrp.c#L4677; https://github.com/corosync/corosync/issues/778
CVE: CVE-2024-13737
Published: 2025-03-22
Description: The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on the motors_create_template and motors_delete_template functions in all versions up to, and including, 1.4.57. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts or create listing templates. This issue requires Elementor plugin to be installed, which is a required plugin for Motors Starter Theme.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.52/includes/class/Features/Elementor/Nuxy/TemplateManager.php#L149; https://plugins.trac.wordpress.org/browser/motors-car-dealership-classified-listings/tags/1.4.52/includes/class/Features/Elementor/Nuxy/TemplateManager.php#L191; https://plugins.trac.wordpress.org/changeset/3250931/motors-car-dealership-classified-listings/trunk/includes/class/Features/Elementor/Nuxy/TemplateManager.php
CVE: CVE-2024-13739
Published: 2025-03-22
Description: The Newsletters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the "to" parameter in all versions up to, and including, 4.9.9.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an admin user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.9.9.7/views/admin/history/view.php#L48; https://www.wordfence.com/threat-intel/vulnerabilities/id/2578a863-4129-4f56-8b18-65b2d2b972e3?source=cve
CVE: CVE-2025-0723
Published: 2025-03-22
Description: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind and time-based SQL Injections via the rid and search parameters in all versions up to, and including, 5.9.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.4.2/includes/class-profile-magic-chat-system.php#L39; https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.4.2/includes/class-profile-magic-request.php#L2379; https://www.wordfence.com/threat-intel/vulnerabilities/id/140fa6e8-4381-4df2-af62-44d40b116daf?source=cve
CVE: CVE-2025-0724
Published: 2025-03-22
Description: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.4.5 via deserialization of untrusted input in the get_user_meta_fields_html function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.4.2/includes/class-profile-magic-html-generator.php#L259; https://www.wordfence.com/threat-intel/vulnerabilities/id/6bb1de69-7bc2-4785-9789-0a2d1cf35b9b?source=cve
CVE: CVE-2025-1408
Published: 2025-03-22
Description: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_decline_join_group_request and pm_approve_join_group_request functions in all versions up to, and including, 5.9.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to approve or decline join group requests which is normally should be available to administrators only.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.4.3/public/class-profile-magic-public.php#L3262; https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.4.3/public/class-profile-magic-public.php#L3306; https://www.wordfence.com/threat-intel/vulnerabilities/id/641f7727-83ba-45c2-b3e1-1ce19f86eac7?source=cve