deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-13801
Published: 2025-03-26
Description: The BWL Advanced FAQ Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'baf_set_notice_status' AJAX action in all versions up to, and including, 2.1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to '1' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://codecanyon.net/item/bwl-advanced-faq-manager/5007135; https://www.wordfence.com/threat-intel/vulnerabilities/id/b3a84201-6cd8-4528-ae7a-7fd813c8da18?source=cve
CVE: CVE-2025-1514
Published: 2025-03-26
Description: The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to unauthorized filter calling due to insufficient restrictions on the get_smth() function in all versions up to, and including, 1.0.6.7. This makes it possible for unauthenticated attackers to call arbitrary WordPress filters with a single parameter.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: https://plugins.trac.wordpress.org/browser/profit-products-tables-for-woocommerce/trunk/index.php#L1753; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3257043%40profit-products-tables-for-woocommerce&new=3257043%40profit-products-tables-for-woocommerce&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/6edf91de-9553-4aa1-a29f-89771c8e852e?source=cve
CVE: CVE-2025-2009
Published: 2025-03-26
Description: The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logging functionality in all versions up to, and including, 4.9.9.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/newsletters-lite/trunk/views/admin/settings/view_logs.php?rev=3212300#L107; https://plugins.trac.wordpress.org/changeset/3257980/newsletters-lite/trunk/views/admin/settings/view_logs.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/3825c80c-e4b1-4dd8-be77-38f718920b9a?source=cve
CVE: CVE-2025-2167
Published: 2025-03-26
Description: The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events_list' shortcodes in all versions up to, and including, 5.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3257882%40event-post&new=3257882%40event-post&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/32bcff2d-e322-4c9c-b1c2-f07aa54faff9?source=cve
CVE: CVE-2025-2257
Published: 2025-03-26
Description: The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.10 via the compression_level setting. This is due to the plugin using the compression_level setting in proc_open() without any validation. This makes it possible for authenticated attackers, with administrator-level access and above, to execute code on the server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://github.com/BoldGrid/boldgrid-backup/pull/622/files; https://plugins.svn.wordpress.org/boldgrid-backup/tags/1.16.7/admin/compressor/class-boldgrid-backup-admin-compressor-system-zip.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3257988%40boldgrid-backup&new=3257988%40boldgrid-backup&sfp_email=&sfph_mail=#file9
CVE: CVE-2025-1310
Published: 2025-03-26
Description: The Jobs for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.11 via the 'job_postings_get_file' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/job-postings/tags/2.7.11/include/class-job-get-uploaded-file.php#L91; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3257145%40job-postings&new=3257145%40job-postings&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/408312d3-9a9e-4b6b-9991-aee6b77745b2?source=cve
CVE: CVE-2025-1437
Published: 2025-03-26
Description: The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2025.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was partially patched in version 2024.5, and later improved in version 2025.3.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3255604%40advanced-iframe&new=3255604%40advanced-iframe&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3279464%40advanced-iframe&new=3279464%40advanced-iframe&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/676b4768-98ea-4e55-87de-ef7ae1d7a113?source=cve
CVE: CVE-2025-1439
Published: 2025-03-26
Description: The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2024.5 due to insufficient input sanitization and output escaping on user supplied attributes through the 'src' attribute when the src supplied returns a header with an injected value . This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3255604%40advanced-iframe&new=3255604%40advanced-iframe&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/5ac1145b-5ab1-47a9-9117-4870c52a70fc?source=cve
CVE: CVE-2025-1440
Published: 2025-03-26
Description: The Advanced iFrame plugin for WordPress is vulnerable to unauthorized excessive creation of options on the aip_map_url_callback() function in all versions up to, and including, 2024.5 due to insufficient restrictions. This makes it possible for unauthenticated attackers to update the advancediFrameParameterData option with an excessive amount of unvalidated data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3255604%40advanced-iframe&new=3255604%40advanced-iframe&sfp_email=&sfph_mail=#file1; https://www.wordfence.com/threat-intel/vulnerabilities/id/b92913fa-aa1e-40a0-9a48-d730b2102217?source=cve
CVE: CVE-2025-1703
Published: 2025-03-26
Description: The Ultimate Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ultimate-blocks/trunk/src/extensions/responsive-control/class-responsive-control.php#L46; https://plugins.trac.wordpress.org/changeset/3260377; https://plugins.trac.wordpress.org/changeset/3260377/ultimate-blocks/trunk/src/extensions/responsive-control/class-responsive-control.php
CVE: CVE-2025-1542
Published: 2025-03-26
Description: Improper permission control vulnerability in the OXARI ServiceDesk application could allow an attacker using a guest access or an unprivileged account to gain additional administrative permissions in the application.This issue affects OXARI ServiceDesk in versions before 2.0.324.0.
CWE: CWE-425
References: https://cert.pl/en/posts/2025/03/CVE-2025-1542/; https://www.oxari.com/en/product/oxari-servicedesk
CVE: CVE-2025-27551
Published: 2025-03-26
Description: DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes.

This vulnerability is associated with program files lib/DBIx/Class/EncodedColumn/Digest.pm.

This issue affects DBIx::Class::EncodedColumn until 0.00032.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-331, CWE-338, CWE-916
References: https://metacpan.org/release/WREIS/DBIx-Class-EncodedColumn-0.00032/changes; https://security.metacpan.org/docs/guides/random-data-for-security.html
CVE: CVE-2025-27552
Published: 2025-03-26
Description: DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes.

This vulnerability is associated with program files Crypt/Eksblowfish/Bcrypt.pm.

This issue affects DBIx::Class::EncodedColumn until 0.00032.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-331, CWE-338, CWE-916
References: https://metacpan.org/release/WREIS/DBIx-Class-EncodedColumn-0.00032/changes; https://security.metacpan.org/docs/guides/random-data-for-security.html
CVE: CVE-2025-2596
Published: 2025-03-26
Description: Session logout could be overwritten in Checkmk GmbH's Checkmk versions <2.3.0p30, <2.2.0p41, and 2.1.0p49 (EOL)
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-613
References: https://checkmk.com/werk/17808
CVE: CVE-2024-13411
Published: 2025-03-26
Description: The Zapier for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5.1 via the updated_user() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/browser/zapier/trunk/zapier.php#L114; https://plugins.trac.wordpress.org/browser/zapier/trunk/zapier.php#L210; https://plugins.trac.wordpress.org/browser/zapier/trunk/zapier.php#L284
CVE: CVE-2024-13889
Published: 2025-03-26
Description: The WordPress Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.8.3 via deserialization of untrusted input in the 'maybe_unserialize' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/wordpress-importer/trunk/class-wp-import.php#L602; https://plugins.trac.wordpress.org/browser/wordpress-importer/trunk/class-wp-import.php#L857; https://plugins.trac.wordpress.org/browser/wordpress-importer/trunk/class-wp-import.php#L891
CVE: CVE-2025-1312
Published: 2025-03-26
Description: The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttonTextColor’ parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/ultimate-blocks/trunk/src/blocks/call-to-action/block.php#L32; https://plugins.trac.wordpress.org/changeset/3260377/; https://www.wordfence.com/threat-intel/vulnerabilities/id/ac422162-be05-4420-9877-d6d41b83e881?source=cve
CVE: CVE-2025-1769
Published: 2025-03-26
Description: The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.5.0 via the download_file() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary log files on the server, which can contain sensitive information.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/trunk/admin/modules/history/history.php#L753; https://plugins.trac.wordpress.org/changeset/3261194/; https://wordpress.org/plugins/product-import-export-for-woo/#developers
CVE: CVE-2025-1911
Published: 2025-03-26
Description: The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the admin_log_page() function in all versions up to, and including, 2.5.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary log files on the server.
CVSS Score: 2.7 (LOW)
CWE: CWE-73
References: https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/trunk/admin/modules/history/history.php#L248; https://plugins.trac.wordpress.org/changeset/3261194/; https://wordpress.org/plugins/product-import-export-for-woo/#developers
CVE: CVE-2025-1912
Published: 2025-03-26
Description: The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the validate_file() Function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS Score: 7.6 (HIGH)
CWE: CWE-918
References: https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/trunk/admin/modules/import/classes/class-import-ajax.php#L175; https://plugins.trac.wordpress.org/changeset/3261194/; https://wordpress.org/plugins/product-import-export-for-woo/#developers
CVE: CVE-2025-1913
Published: 2025-03-26
Description: The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.5.0 via deserialization of untrusted input from the 'form_data' parameter This makes it possible for authenticated attackers, with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://github.com/S0haib518-KSA/CVE-2025-1913-PoC/; https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/trunk/admin/modules/import/classes/class-import-ajax.php; https://plugins.trac.wordpress.org/changeset/3261194/
CVE: CVE-2025-2110
Published: 2025-03-26
Description: The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its AJAX functions in all versions up to, and including, 6.30.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to compromise the site in various ways depending on the specific function exploited - for example, by retrieving sensitive settings and configuration details, or by altering and deleting them, thereby disclosing sensitive information, disrupting the plugin’s functionality, and potentially impacting overall site performance.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/6.30.15/classes/ajax.class.php; https://plugins.trac.wordpress.org/changeset/3254259/; https://wordpress.org/plugins/wp-compress-image-optimizer/#developers
CVE: CVE-2025-2228
Published: 2025-03-26
Description: The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.8 the 'register_user' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including usernames and passwords of any users who register via the Edit Login | Registration Form widget, as long as that user opens the email notification for successful registration.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/responsive-addons-for-elementor/trunk/includes/modules-manager/login-register/class-login-register.php#L369; https://plugins.trac.wordpress.org/changeset/3261241/; https://www.wordfence.com/threat-intel/vulnerabilities/id/659ef2e8-589c-4901-88ce-1d674c056ece?source=cve
CVE: CVE-2022-39163
Published: 2025-03-26
Description: IBM Cognos Controller 11.0.0 through 11.1.0 is vulnerable to a Client-Side Desync (CSD) attack where an attacker could exploit a desynchronized browser connection that could lead to further cross-site scripting (XSS) attacks.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-444
References: https://www.ibm.com/support/pages/node/7192746
CVE: CVE-2024-45351
Published: 2025-03-26
Description: A code execution vulnerability exists in the Xiaomi Game center application product. The vulnerability is caused by  improper input validation and can be exploited by attackers to execute malicious code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1284
References: https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=549
CVE: CVE-2025-23203
Published: 2025-03-26
Description: Icinga Director is an Icinga config deployment tool. A Security vulnerability has been found starting in version 1.0.0 and prior to 1.10.4 and 1.11.4 on several director endpoints of REST API. To reproduce this vulnerability an authenticated user with permission to access the Director is required (plus api access with regard to the api endpoints). And even though some of these Icinga Director users are restricted from accessing certain objects, are able to retrieve information related to them if their name is known. This makes it possible to change the configuration of these objects by those Icinga Director users restricted from accessing them. This results in further exploitation, data breaches and sensitive information disclosure. Affected endpoints include icingaweb2/director/service, if the host name is left out of the query; icingaweb2/directore/notification; icingaweb2/director/serviceset; and icingaweb2/director/scheduled-downtime. In addition, the endpoint `icingaweb2/director/services?host=filteredHostName` returns a status code 200 even though the services for the host is filtered. This in turn lets the restricted user know that the host `filteredHostName` exists even though the user is restricted from accessing it.  This could again result in further exploitation of this information and data breaches. Icinga Director has patches in versions 1.10.4 and 1.11.4. If upgrading is not feasible, disable the director module for the users other than admin role for the time being.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-284
References: https://github.com/Icinga/icingaweb2-module-director/commit/3fcb20178ff1722329bf8689795e6cc8e53a9978; https://github.com/Icinga/icingaweb2-module-director/commit/8d9ecf3b0a852aa2a756c518ef4f29db9ca0f9ee; https://github.com/Icinga/icingaweb2-module-director/releases/tag/v1.10.4
CVE: CVE-2025-24808
Published: 2025-03-26
Description: Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, someone who is about to reach the limit of users in a group DM may send requests to add new users in parallel. The requests might all go through ignoring the limit due to a race condition. The patch in versions `3.3.4` and `3.4.0.beta5` uses the `lock` step in service to wrap part of the `add_users_to_channel` service inside a distributed lock/mutex in order to avoid the race condition.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-362
References: https://github.com/discourse/discourse/commit/a16b2f224860f6678f89f5ffa012f0ede17e4095; https://github.com/discourse/discourse/security/advisories/GHSA-hfcx-qjw6-573r
CVE: CVE-2025-22283
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Riyaz GetSocial getsocial allows Reflected XSS.This issue affects GetSocial: from n/a through <= 2.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/getsocial/vulnerability/wordpress-getsocial-plugin-2-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23459
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NsThemes NS Simple Intro Loader ns-simple-intro-loader allows Reflected XSS.This issue affects NS Simple Intro Loader: from n/a through <= 2.2.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ns-simple-intro-loader/vulnerability/wordpress-ns-simple-intro-loader-plugin-2-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23460
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rhizomaticweb RWS Enquiry And Lead Follow-up rws-enquiry allows Reflected XSS.This issue affects RWS Enquiry And Lead Follow-up: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/rws-enquiry/vulnerability/wordpress-rws-enquiry-and-lead-follow-up-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23466
Published: 2025-03-26
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsiteeditor Site Editor Google Map site-editor-google-map allows Reflected XSS.This issue affects Site Editor Google Map: from n/a through <= 1.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/site-editor-google-map/vulnerability/wordpress-site-editor-google-map-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve