deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-32380
Published: 2025-04-09
Description: The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerability in Apollo Router's usage of Apollo Compiler allowed queries with deeply nested and reused named fragments to be prohibitively expensive to validate. This could lead to excessive resource consumption and denial of service.  Apollo Router's usage of Apollo Compiler has been updated so that validation logic processes each named fragment only once, preventing redundant traversal. This has been remediated in apollo-router versions 1.61.2 and 2.1.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/apollographql/router/commit/ab6675a63174715ea6ff50881fc957831d4e9564; https://github.com/apollographql/router/commit/bba032e183b861348a466d3123c7137a1ae18952; https://github.com/apollographql/router/security/advisories/GHSA-3j43-9v8v-cp3f
CVE: CVE-2025-32381
Published: 2025-04-09
Description: XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to 0.1.18, Xgrammar includes a cache for compiled grammars to increase performance with repeated use of the same grammar. This cache is held in memory. Since the cache is unbounded, a system making use of xgrammar can be abused to fill up a host's memory and case a denial of service. For example, sending many small requests to an LLM inference server with unique JSON schemas would eventually cause this denial of service to occur. This vulnerability is fixed in 0.1.18.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/mlc-ai/xgrammar/pull/243; https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-389x-67px-mjg3; https://github.com/vllm-project/vllm/pull/16283
CVE: CVE-2025-31002
Published: 2025-04-09
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze squeeze allows Using Malicious Files.This issue affects Squeeze: from n/a through <= 1.6.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/squeeze/vulnerability/wordpress-squeeze-plugin-1-6-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-31003
Published: 2025-04-09
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bogdan Bendziukov Squeeze squeeze allows Retrieve Embedded Sensitive Data.This issue affects Squeeze: from n/a through <= 1.6.
CVSS Score: 2.7 (LOW)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/squeeze/vulnerability/wordpress-squeeze-plugin-1-6-full-path-disclosure-fpd-vulnerability?_s_id=cve
CVE: CVE-2025-31004
Published: 2025-04-09
Description: Missing Authorization vulnerability in Croover.inc Rich Table of Contents rich-table-of-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rich Table of Contents: from n/a through <= 1.4.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/rich-table-of-content/vulnerability/wordpress-rich-table-of-contents-plugin-1-4-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31005
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Uzair Easyfonts easyfonts allows Cross Site Request Forgery.This issue affects Easyfonts: from n/a through <= 1.1.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/easyfonts/vulnerability/wordpress-easyfonts-plugin-1-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-31008
Published: 2025-04-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Embeds For YouTube Plugin Support YouTube Embed youtube-embed allows Stored XSS.This issue affects YouTube Embed: from n/a through <= 5.3.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/youtube-embed/vulnerability/wordpress-youtube-embed-5-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31009
Published: 2025-04-09
Description: Server-Side Request Forgery (SSRF) vulnerability in Jan Boddez IndieBlocks indieblocks allows Server Side Request Forgery.This issue affects IndieBlocks: from n/a through <= 0.13.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/indieblocks/vulnerability/wordpress-indieblocks-0-13-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-31012
Published: 2025-04-09
Description: Missing Authorization vulnerability in Phil Age Gate age-gate allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Age Gate: from n/a through <= 3.5.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/age-gate/vulnerability/wordpress-age-gate-3-5-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31017
Published: 2025-04-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Noakes Nav Menu Manager noakes-menu-manager allows Stored XSS.This issue affects Nav Menu Manager: from n/a through <= 3.2.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/noakes-menu-manager/vulnerability/wordpress-nav-menu-manager-3-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31020
Published: 2025-04-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webliberty Simple Spoiler simple-spoiler allows Stored XSS.This issue affects Simple Spoiler: from n/a through <= 1.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-spoiler/vulnerability/wordpress-simple-spoiler-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31023
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Purab Seo Meta Tags seo-meta-tags allows Cross Site Request Forgery.This issue affects Seo Meta Tags: from n/a through <= 1.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/seo-meta-tags/vulnerability/wordpress-seo-meta-tags-plugin-1-4-csrf-to-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-31026
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Austin Comment Validation Reloaded comment-validation-reloaded allows Stored XSS.This issue affects Comment Validation Reloaded: from n/a through <= 0.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/comment-validation-reloaded/vulnerability/wordpress-comment-validation-reloaded-plugin-0-5-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31032
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Pagopar - Grupo M S.A. Pagopar – WooCommerce Gateway pagopar-woocommerce-gateway allows Stored XSS.This issue affects Pagopar – WooCommerce Gateway: from n/a through <= 2.7.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/pagopar-woocommerce-gateway/vulnerability/wordpress-pagopar-woocommerce-gateway-plugin-2-7-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31033
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Adam Nowak Buddypress Humanity buddypress-humanity allows Cross Site Request Forgery.This issue affects Buddypress Humanity: from n/a through <= 1.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/buddypress-humanity/vulnerability/wordpress-buddypress-humanity-plugin-1-2-csrf-to-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-31034
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in AboZain Albanna Customize Login Page customize-login-page allows Cross Site Request Forgery.This issue affects Customize Login Page: from n/a through <= 1.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/customize-login-page/vulnerability/wordpress-customize-login-page-plugin-1-1-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-31035
Published: 2025-04-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Chris WP Editor.md – The Perfect WordPress Markdown Editor wp-editormd allows Stored XSS.This issue affects WP Editor.md – The Perfect WordPress Markdown Editor: from n/a through <= 10.2.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-editormd/vulnerability/wordpress-wp-editor-md-the-perfect-wordpress-markdown-editor-10-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31036
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in WPSOLR WPSolr wpsolr-free allows Privilege Escalation.This issue affects WPSolr: from n/a through <= 24.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wpsolr-free/vulnerability/wordpress-wpsolr-plugin-24-0-csrf-to-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-31038
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Essential Marketer Essential Breadcrumbs essential-breadcrumbs allows Privilege Escalation.This issue affects Essential Breadcrumbs: from n/a through <= 1.1.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/essential-breadcrumbs/vulnerability/wordpress-essential-breadcrumbs-plugin-1-1-1-csrf-to-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-31042
Published: 2025-04-09
Description: Missing Authorization vulnerability in rtakao Sandwich Adsense firsth3tagadsense allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sandwich Adsense: from n/a through <= 4.0.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/firsth3tagadsense/vulnerability/wordpress-sandwich-adsense-4-0-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31375
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in bhoogterp Scheduled scheduled allows Stored XSS.This issue affects Scheduled: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/scheduled/vulnerability/wordpress-scheduled-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31377
Published: 2025-04-09
Description: Missing Authorization vulnerability in Asaquzzaman mishu Woo Product Feed For Marketing Channels woocommerce-to-google-merchant-center allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Product Feed For Marketing Channels: from n/a through <= 1.9.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-to-google-merchant-center/vulnerability/wordpress-woo-product-feed-for-marketing-channels-1-9-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-31382
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in theode Language Field language-field allows Stored XSS.This issue affects Language Field: from n/a through <= 0.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/language-field/vulnerability/wordpress-language-field-plugin-0-9-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31383
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in sodena FrescoChat Live Chat flexytalk-widget allows Stored XSS.This issue affects FrescoChat Live Chat: from n/a through <= 3.2.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/flexytalk-widget/vulnerability/wordpress-frescochat-live-chat-plugin-3-2-6-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31385
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in intelcaprep Site Table of Contents site-table-of-contents allows Stored XSS.This issue affects Site Table of Contents: from n/a through <= 0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/site-table-of-contents/vulnerability/wordpress-site-table-of-contents-plugin-0-3-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31388
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in doa The World the-world allows Stored XSS.This issue affects The World: from n/a through <= 0.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/the-world/vulnerability/wordpress-the-world-plugin-0-4-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31390
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in bdoga Social Crowd social-crowd allows Stored XSS.This issue affects Social Crowd: from n/a through <= 0.9.6.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/social-crowd/vulnerability/wordpress-social-crowd-plugin-0-9-6-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31391
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in regen Script Compressor script-compressor allows Stored XSS.This issue affects Script Compressor: from n/a through <= 1.7.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/script-compressor/vulnerability/wordpress-script-compressor-plugin-1-7-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31392
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Shameem Reza Smart Product Gallery Slider smart-product-gallery-slider allows Cross Site Request Forgery.This issue affects Smart Product Gallery Slider: from n/a through <= 1.0.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/smart-product-gallery-slider/vulnerability/wordpress-smart-product-gallery-slider-plugin-1-0-4-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31393
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in vfvalent Social Bookmarking RELOADED social-bookmarking-reloaded allows Stored XSS.This issue affects Social Bookmarking RELOADED: from n/a through <= 3.18.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/social-bookmarking-reloaded/vulnerability/wordpress-social-bookmarking-reloaded-plugin-3-18-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31394
Published: 2025-04-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kailey (trepmal) More Mime Type Filters more-mime-type-filters allows Stored XSS.This issue affects More Mime Type Filters: from n/a through <= 0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/more-mime-type-filters/vulnerability/wordpress-more-mime-type-filters-plugin-0-3-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31395
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in a.ankit Easy Custom CSS easy-custom-css allows Stored XSS.This issue affects Easy Custom CSS: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/easy-custom-css/vulnerability/wordpress-easy-custom-css-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31399
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Chandan Garg CG Scroll To Top cg-scroll-to-top allows Stored XSS.This issue affects CG Scroll To Top: from n/a through <= 3.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/cg-scroll-to-top/vulnerability/wordpress-cg-scroll-to-top-plugin-3-5-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31400
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in icyleaf WS Audio Player ws-audio-player allows Stored XSS.This issue affects WS Audio Player: from n/a through <= 1.1.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/ws-audio-player/vulnerability/wordpress-ws-audio-player-plugin-1-1-8-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31401
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in mmetrodw MMX – Make Me Christmas mmx-make-me-christmas allows Stored XSS.This issue affects MMX – Make Me Christmas: from n/a through <= 1.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/mmx-make-me-christmas/vulnerability/wordpress-mmx-make-me-christmas-plugin-1-0-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31402
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in NewsBoard Plugin NewsBoard Post and RSS Scroller newsboard allows Stored XSS.This issue affects NewsBoard Post and RSS Scroller: from n/a through <= 1.2.12.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/newsboard/vulnerability/wordpress-newsboard-post-and-rss-scroller-plugin-1-2-12-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31404
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Wladyslaw Madejczyk AF Tell a Friend af-tell-a-friend allows Stored XSS.This issue affects AF Tell a Friend: from n/a through <= 1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/af-tell-a-friend/vulnerability/wordpress-af-tell-a-friend-plugin-1-4-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32476
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in blueinstyle Advanced Tag Lists advanced-tag-list allows Stored XSS.This issue affects Advanced Tag Lists: from n/a through <= 1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/advanced-tag-list/vulnerability/wordpress-advanced-tag-lists-plugin-1-2-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32477
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Jordi Salord WP-Easy Menu wp-easy-menu allows Stored XSS.This issue affects WP-Easy Menu: from n/a through <= 0.41.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-easy-menu/vulnerability/wordpress-wp-easy-menu-plugin-0-41-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32478
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Mario Aguiar WP SexyLightBox wp-sexylightbox allows Stored XSS.This issue affects WP SexyLightBox: from n/a through <= 0.5.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-sexylightbox/vulnerability/wordpress-wp-sexylightbox-plugin-0-5-3-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32479
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in ab-tools Flags Widget flags-widget allows Stored XSS.This issue affects Flags Widget: from n/a through <= 1.0.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/flags-widget/vulnerability/wordpress-flags-widget-plugin-1-0-7-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32480
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in dalziel Windows Live Writer windows-live-writer allows Stored XSS.This issue affects Windows Live Writer: from n/a through <= 0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/windows-live-writer/vulnerability/wordpress-windows-live-writer-plugin-0-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32481
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in ninotheme Nino Social Connect nino-social-connect allows Stored XSS.This issue affects Nino Social Connect: from n/a through <= 2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/nino-social-connect/vulnerability/wordpress-nino-social-connect-plugin-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32482
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in quanganhdo Custom Smilies custom-smilies allows Stored XSS.This issue affects Custom Smilies: from n/a through <= 1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/custom-smilies/vulnerability/wordpress-custom-smilies-plugin-1-2-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32483
Published: 2025-04-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Salisbury Request Call Back request-call-back allows Stored XSS.This issue affects Request Call Back: from n/a through <= 1.4.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/request-call-back/vulnerability/wordpress-request-call-back-1-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32484
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WP-Planification wp-planification allows Stored XSS.This issue affects WP-Planification: from n/a through <= 2.3.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-planification/vulnerability/wordpress-wp-planification-wp-planning-plugin-2-3-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32485
Published: 2025-04-09
Description: Cross-Site Request Forgery (CSRF) vulnerability in Bjoern WP Performance Pack wp-performance-pack allows Cross Site Request Forgery.This issue affects WP Performance Pack: from n/a through <= 2.5.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-performance-pack/vulnerability/wordpress-wp-performance-pack-2-5-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-32487
Published: 2025-04-09
Description: Server-Side Request Forgery (SSRF) vulnerability in Joe Waymark waymark allows Server Side Request Forgery.This issue affects Waymark: from n/a through <= 1.5.2.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/waymark/vulnerability/wordpress-waymark-1-5-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-32488
Published: 2025-04-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in آریا وردپرس Aria Font aria-font allows Stored XSS.This issue affects Aria Font: from n/a through <= 1.4.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/aria-font/vulnerability/wordpress-aria-font-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32489
Published: 2025-04-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Wetterwarner wetterwarner allows Stored XSS.This issue affects Wetterwarner: from n/a through <= 2.7.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wetterwarner/vulnerability/wordpress-wetterwarner-2-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve