deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-49578
Published: 2025-06-12
Description: Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/64cb5d7ab3a6dc0381fae54b31e8fc4afadc8beb; https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd; https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-2v3v-3whp-953h
CVE: CVE-2025-49579
Published: 2025-06-12
Description: Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/54c8717d45ce1594918f11cb9ce5d0ccd8dfee65; https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd; https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-g3cp-pq72-hjpv
CVE: CVE-2025-2745
Published: 2025-06-12
Description: A cross-site scripting vulnerability exists in AVEVA PI Web API version 2023 
SP1 and prior that, if exploited, could allow an authenticated attacker 
(with privileges to create/update annotations or upload media files) to 
persist arbitrary JavaScript code that will be executed by users who 
were socially engineered to disable content security policy protections 
while rendering annotation attachments from within a web browser.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://www.aveva.com/en/support-and-success/cyber-security-updates/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-08
CVE: CVE-2025-36539
Published: 2025-06-12
Description: AVEVA PI Data Archive products 
are vulnerable to an uncaught exception that, if exploited, could allow 
an authenticated user to shut down certain necessary PI Data Archive 
subsystems, resulting in a denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-248
References: https://www.aveva.com/en/support-and-success/cyber-security-updates/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-07
CVE: CVE-2025-44019
Published: 2025-06-12
Description: AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if 
exploited, could allow an authenticated user to shut down certain 
necessary PI Data Archive subsystems, resulting in a denial of service. 
Depending on the timing of the crash, data present in snapshots/write 
cache may be lost.
CVSS Score: 7.1 (HIGH)
CWE: CWE-248
References: https://my.osisoft.com/; https://www.aveva.com/en/support-and-success/cyber-security-updates/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-07
CVE: CVE-2025-48699
Published: 2025-06-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-4417
Published: 2025-06-12
Description: A cross-site scripting vulnerability exists in 
AVEVA PI Connector for CygNet 
Versions 1.6.14 and prior that, if exploited, could allow an 
administrator miscreant with local access to the connector admin portal 
to persist arbitrary JavaScript code that will be executed by other 
users who visit affected pages.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://www.aveva.com/en/support-and-success/cyber-security-updates/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-09
CVE: CVE-2025-4418
Published: 2025-06-12
Description: An improper validation of integrity check value vulnerability exists in 

AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, 
could allow a miscreant with elevated privileges to modify PI Connector 
for CygNet local data files (cache and buffers) in a way that causes the
 connector service to become unresponsive.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-354
References: https://www.aveva.com/en/support-and-success/cyber-security-updates/; https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-09
CVE: CVE-2025-5484
Published: 2025-06-12
Description: A username and password are required to authenticate to the central 
SinoTrack device management interface. The username for all devices is 
an identifier printed on the receiver. The default password is 
well-known and common to all devices. Modification of the default 
password is not enforced during device setup. A malicious actor can 
retrieve device identifiers with either physical access or by capturing 
identifiers from pictures of the devices posted on publicly accessible 
websites such as eBay.
CVSS Score: 8.3 (HIGH)
CWE: CWE-1390
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-160-01; https://www.sinotrackgps.com/help-center
CVE: CVE-2025-5485
Published: 2025-06-12
Description: User names used to access the web management interface are limited to 
the device identifier, which is a numerical identifier no more than 10 
digits. A malicious actor can enumerate potential targets by 
incrementing or decrementing from known identifiers or through 
enumerating random digit sequences.
CVSS Score: 8.6 (HIGH)
CWE: CWE-204
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-160-01; https://www.sinotrackgps.com/help-center
CVE: CVE-2025-6031
Published: 2025-06-12
Description: Amazon Cloud Cam is a home security camera that was deprecated on December 2, 2022, is end of life, and is no longer actively supported. 

When a user powers on the Amazon Cloud Cam, the device attempts to connect to a remote service infrastructure that has been deprecated due to end-of-life status. The device defaults to a pairing status in which an arbitrary user can bypass SSL pinning to associate the device to an arbitrary network, allowing for network traffic interception and modification.

We recommend customers discontinue usage of any remaining Amazon Cloud Cams.
CVSS Score: 7.5 (HIGH)
CWE: CWE-672
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-013/
CVE: CVE-2025-27689
Published: 2025-06-12
Description: Dell iDRAC Tools, version(s) prior to 11.3.0.0, contain(s) an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://www.dell.com/support/kbdoc/en-us/000323242/dsa-2025-169-security-update-for-dell-idrac-tools-vulnerabilities
CVE: CVE-2025-44091
Published: 2025-06-12
Description: yangyouwang crud v1.0.0 is vulnerable to Cross Site Scripting (XSS) via the role management function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/HL4245/f2e88b7afea9ee08cc4282f38b5ea1cf; https://github.com/HL4245/CVE/blob/main/%E7%AE%80%E7%BA%A6%E5%90%8E%E5%8F%B0%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F.md; https://github.com/HL4245/CVE/blob/main/%E7%AE%80%E7%BA%A6%E5%90%8E%E5%8F%B0%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F.md
CVE: CVE-2025-49589
Published: 2025-06-12
Description: PCSX2 is a free and open-source PlayStation 2 (PS2) emulator. A stack-based buffer overflow exists in the Kprintf_HLE function of PCSX2 versions up to 2.3.414. Opening a disc image that logs a specially crafted message may allow a remote attacker to execute arbitrary code if the user enabled IOP Console Logging. This vulnerability is fixed in 2.3.414.
CWE: CWE-121
References: https://github.com/PCSX2/pcsx2/pull/12823; https://github.com/PCSX2/pcsx2/pull/12826; https://github.com/PCSX2/pcsx2/security/advisories/GHSA-f494-4xf7-xj35
CVE: CVE-2025-41234
Published: 2025-06-12
Description: Description

In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack when it sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribute is derived from user-supplied input.

Specifically, an application is vulnerable when all the following are true:

  *  The header is prepared with org.springframework.http.ContentDisposition.
  *  The filename is set via ContentDisposition.Builder#filename(String, Charset).
  *  The value for the filename is derived from user-supplied input.
  *  The application does not sanitize the user-supplied input.
  *  The downloaded content of the response is injected with malicious commands by the attacker (see RFD paper reference for details).


An application is not vulnerable if any of the following is true:

  *  The application does not set a “Content-Disposition” response header.
  *  The header is not prepared with org.springframework.http.ContentDisposition.
  *  The filename is set via one of:  *  ContentDisposition.Builder#filename(String), or
  *  ContentDisposition.Builder#filename(String, ASCII)



  *  The filename is not derived from user-supplied input.
  *  The filename is derived from user-supplied input but sanitized by the application.
  *  The attacker cannot inject malicious content in the downloaded content of the response.


Affected Spring Products and VersionsSpring Framework:

  *  6.2.0 - 6.2.7
  *  6.1.0 - 6.1.20
  *  6.0.5 - 6.0.28
  *  Older, unsupported versions are not affected


MitigationUsers of affected versions should upgrade to the corresponding fixed version.

Affected version(s)Fix versionAvailability6.2.x6.2.8OSS6.1.x6.1.21OSS6.0.x6.0.29 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary.


CWE-113 in `Content-Disposition` handling in VMware Spring Framework versions 6.0.5 to 6.2.7 allows remote attackers to launch Reflected File Download (RFD) attacks via unsanitized user input in `ContentDisposition.Builder#filename(String, Charset)` with non-ASCII charsets.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-113
References: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N&version=3.1; https://nvd.nist.gov/vuln/detail/CVE-2025-41234; https://spring.io/security/cve-2025-41234
CVE: CVE-2025-4233
Published: 2025-06-12
Description: An insufficient implementation of cache vulnerability in Palo Alto Networks Prisma® Access Browser enables users to bypass certain data control policies.
CWE: CWE-524
References: https://security.paloaltonetworks.com/CVE-2025-4233
CVE: CVE-2025-4228
Published: 2025-06-13
Description: An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain files available within the Broker VM and escalate their privileges to root.
CWE: CWE-266
References: https://security.paloaltonetworks.com/CVE-2025-4228
CVE: CVE-2025-4230
Published: 2025-06-13
Description: A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI.

The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. 

Cloud NGFW and Prisma® Access are not affected by this vulnerability.
CWE: CWE-78
References: https://security.paloaltonetworks.com/CVE-2025-4230
CVE: CVE-2025-4231
Published: 2025-06-13
Description: A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user.

The attacker must have network access to the management web interface and successfully authenticate to exploit this issue.

Cloud NGFW and Prisma Access are not impacted by this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://security.paloaltonetworks.com/CVE-2025-4231
CVE: CVE-2025-4232
Published: 2025-06-13
Description: An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrative user to escalate their privileges to root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-155
References: https://security.paloaltonetworks.com/CVE-2025-4232
CVE: CVE-2025-30399
Published: 2025-06-13
Description: Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-426
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30399
CVE: CVE-2025-47959
Published: 2025-06-13
Description: Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code over a network.
CVSS Score: 7.1 (HIGH)
CWE: CWE-77
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47959
CVE: CVE-2025-4584
Published: 2025-06-13
Description: The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmeventlist' shortcode in all versions up to, and including, 1.2.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/irm-newsroom/trunk/irm-newsroom.php#L494; https://plugins.trac.wordpress.org/changeset/3312832; https://www.wordfence.com/threat-intel/vulnerabilities/id/3895df7a-9f24-45a5-b447-16f214cfbfcc?source=cve
CVE: CVE-2025-4585
Published: 2025-06-13
Description: The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmflat' shortcode in all versions up to, and including, 1.2.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/irm-newsroom/trunk/irm-newsroom.php#L439; https://plugins.trac.wordpress.org/changeset/3312832; https://www.wordfence.com/threat-intel/vulnerabilities/id/0da6d357-e55f-4bf6-9cd7-50e3dc712434?source=cve
CVE: CVE-2025-4586
Published: 2025-06-13
Description: The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmcalendarview' shortcode in all versions up to, and including, 1.2.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/irm-newsroom/trunk/irm-newsroom.php#L467; https://plugins.trac.wordpress.org/changeset/3312832; https://www.wordfence.com/threat-intel/vulnerabilities/id/c6210c35-31d7-4a8d-b34f-596977c7a33e?source=cve
CVE: CVE-2025-5123
Published: 2025-06-13
Description: The Contact Us Page – Contact People plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all versions up to, and including, 3.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/contact-us-page-contact-people/trunk/classes/class-people-contact.php#L743; https://wordpress.org/plugins/contact-us-page-contact-people/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/dcffc816-ff56-4875-b234-91dd1d073721?source=cve
CVE: CVE-2025-5233
Published: 2025-06-13
Description: The Color Palette plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hex’ parameter in all versions up to, and including, 4.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/color-palette/trunk/source/blocks/color/register.php#L62; https://wordpress.org/plugins/color-palette/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/bd352c95-6e76-478f-943b-938a96b372f4?source=cve
CVE: CVE-2025-5288
Published: 2025-06-13
Description: The REST API | Custom API Generator For Cross Platform And Import Export In WP plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the process_handler() function in versions 1.0.0 to 2.0.3. This makes it possible for unauthenticated attackers to POST an arbitrary import_api URL, import specially crafted JSON, and thereby create a new user with full Administrator privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/import-export-with-custom-rest-api/tags/2.0.3/backend/methods/wot-rapi-import-functions.php#L123; https://wordpress.org/plugins/import-export-with-custom-rest-api/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/0e2774fc-f028-436c-a8af-3c17378b9743?source=cve
CVE: CVE-2025-5491
Published: 2025-06-13
Description: Acer ControlCenter contains Remote Code Execution vulnerability. The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing remote users with low privileges to interact with it and access its features. One such feature enables the execution of arbitrary programs as NT AUTHORITY/SYSTEM. By leveraging this, remote attackers can execute arbitrary code on the target system with elevated privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://community.acer.com/en/kb/articles/18243-misconfigured-windows-named-pipe-permissions-in-accsvc-exe-allows-for-remote-code-execution?utm_source=community-search&utm_medium=organic-search&utm_term=Vulnerability; https://www.twcert.org.tw/en/cp-139-10181-933ae-2.html; https://www.twcert.org.tw/tw/cp-132-10180-36818-1.html
CVE: CVE-2025-5841
Published: 2025-06-13
Description: The ACF Onyx Poll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/acf-onyx-poll/tags/1.1.8/onyx-poll.php; https://plugins.trac.wordpress.org/browser/acf-onyx-poll/tags/1.2.0/onyx-poll.php#L63; https://wordpress.org/plugins/acf-onyx-poll/#developers
CVE: CVE-2025-5926
Published: 2025-06-13
Description: The Link Shield plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.4. This is due to missing or incorrect nonce validation on the link_shield_menu_options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/link-shield/trunk/link-shield.php#L24; https://www.wordfence.com/threat-intel/vulnerabilities/id/7e[PII_REDACTED]-4781-877b-badb4dc50763?source=cve
CVE: CVE-2025-5928
Published: 2025-06-13
Description: The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wp_sliding_panel_user_options() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/wp-sliding-logindashboard-panel/trunk/wp-sliding-login-dashboard-panel.php#L245; https://www.wordfence.com/threat-intel/vulnerabilities/id/ee7c679e-392c-40cd-b768-d78fae6065bb?source=cve
CVE: CVE-2025-5930
Published: 2025-06-13
Description: The WP2HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/changeset/3339090/; https://www.wordfence.com/threat-intel/vulnerabilities/id/ac34e369-de9e-4b13-8858-0b4300aef5f8?source=cve
CVE: CVE-2025-5938
Published: 2025-06-13
Description: The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the import_templates() function. This makes it possible for unauthenticated attackers to trigger an import via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/digital-marketing-agency-templates-for-elementor/trunk/includes/importer.php#L242; https://www.wordfence.com/threat-intel/vulnerabilities/id/e3[PII_REDACTED]-451a-a50c[PII_REDACTED]98?source=cve
CVE: CVE-2025-5939
Published: 2025-06-13
Description: The Telegram for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/telegram-for-wp/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/cf4a3171-f041-40ce-8148-239c24d7ce95?source=cve
CVE: CVE-2025-5950
Published: 2025-06-13
Description: The IndieBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘kind’ parameter in all versions up to, and including, 0.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/indieblocks/trunk/blocks/facepile-content/render.php#L39; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3311358%40indieblocks&new=3311358%40indieblocks&sfp_email=&sfph_mail=; https://wordpress.org/plugins/indieblocks/#developers