deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-6729
Published: 2025-07-04
Description: The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 via the 'wp_ajax_paym_status' AJAX action This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-918
References: https://wordpress.org/plugins/woocommerce-paymaster-gateway-019/; https://www.wordfence.com/threat-intel/vulnerabilities/id/2b9b501e-2ce7-43d8-bad2-6c3176eed8e2?source=cve
CVE: CVE-2025-6739
Published: 2025-07-04
Description: The WPQuiz plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'wpquiz' shortcode in all versions up to, and including, 0.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://wordpress.org/plugins/wpquiz/; https://www.wordfence.com/threat-intel/vulnerabilities/id/16444905-b111-4b4f-a9f0-d8728da2ebfb?source=cve
CVE: CVE-2025-6782
Published: 2025-07-04
Description: The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the dirGZActiveForm() function in all versions up to, and including, 1.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://wordpress.org/plugins/gozen-forms/; https://www.wordfence.com/threat-intel/vulnerabilities/id/d874a041-1cd4-4ca1-85bd-4050630d8502?source=cve
CVE: CVE-2025-6783
Published: 2025-07-04
Description: The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the emdedSc() function in all versions up to, and including, 1.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://wordpress.org/plugins/gozen-forms/; https://www.wordfence.com/threat-intel/vulnerabilities/id/784998a7-550d-4299-9995-af01e5ee1d21?source=cve
CVE: CVE-2025-6786
Published: 2025-07-04
Description: The DocCheck Login plugin for WordPress is vulnerable to unauthorized post access in all versions up to, and including, 1.1.5. This is due to plugin redirecting a user to login on a password protected post after the page has loaded. This makes it possible for unauthenticated attackers to read posts they should not have access to.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3332723%40doccheck-login&new=3332723%40doccheck-login&sfp_email=&sfph_mail=; https://wordpress.org/plugins/doccheck-login/; https://www.wordfence.com/threat-intel/vulnerabilities/id/0739b5ec-b1c4-4451-97c1-f8d5ed26a2d5?source=cve
CVE: CVE-2025-6787
Published: 2025-07-04
Description: The Smart Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'smartdocs_search' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3322589%40smart-docs&new=3322589%40smart-docs&sfp_email=&sfph_mail=; https://wordpress.org/plugins/smart-docs/; https://www.wordfence.com/threat-intel/vulnerabilities/id/70c41a28-982f-43e6-9415-3a2d996959f3?source=cve
CVE: CVE-2025-6814
Published: 2025-07-04
Description: The Booking X plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_now() function in versions 1.0 to 1.1.2. This makes it possible for unauthenticated attackers to download all plugin data, including user accounts, user meta, and PayPal credentials, by issuing a crafted POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/booking-x/tags/1.1.2/admin/class-bookingx-admin.php#L784; https://plugins.trac.wordpress.org/browser/booking-x/tags/1.1.2/includes/class-bookingx.php#L322; https://wordpress.org/plugins/booking-x/#developers
CVE: CVE-2025-7046
Published: 2025-07-04
Description: The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plugin's widgets in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The issue was partially fixed in version 3.2.0 and fully fixed in version 3.2.1
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/portfolio-elementor/trunk/elementor/elementor-widgets/image_gallery_widget.php#L492; https://plugins.trac.wordpress.org/browser/portfolio-elementor/trunk/elementor/elementor-widgets/portfolio_widget.php#L541; https://plugins.trac.wordpress.org/changeset/3318503/
CVE: CVE-2025-7053
Published: 2025-07-04
Description: A vulnerability was found in Cockpit up to 2.11.3. It has been rated as problematic. This issue affects some unknown processing of the file /system/users/save. The manipulation of the argument name/email leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.11.4 is able to address this issue. The patch is named bdcd5e3bc651c0839c7eea807f3eb6af856dbc76. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure and acted very professional. A patch and new release was made available very quickly.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Cockpit-HQ/Cockpit/commit/bdcd5e3bc651c0839c7eea807f3eb6af856dbc76; https://github.com/Cockpit-HQ/Cockpit/releases/tag/2.11.4; https://vuldb.com/?ctiid.314819
CVE: CVE-2025-5372
Published: 2025-07-04
Description: A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-682
References: https://access.redhat.com/errata/RHSA-2025:21977; https://access.redhat.com/errata/RHSA-2025:23024; https://access.redhat.com/security/cve/CVE-2025-5372
CVE: CVE-2025-6944
Published: 2025-07-04
Description: The Uncode Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uncode_hl_text' and 'uncode_text_icon' shortcodes in all versions up to, and including, 2.9.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://support.undsgn.com/hc/en-us/articles/213454129-Change-Log; https://www.wordfence.com/threat-intel/vulnerabilities/id/52935b60-3ec5-45e6-9d12-200bf107c9df?source=cve
CVE: CVE-2024-11937
Published: 2025-07-04
Description: The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's linkURL in the Mobile Menu element in all versions up to, and including, 4.10.69 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3210517%40premium-addons-for-elementor%2Ftrunk&old=3208033%40premium-addons-for-elementor%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/26337385-646f-4129-99be-7fa020f67f8e?source=cve
CVE: CVE-2025-32918
Published: 2025-07-04
Description: Improper neutralization of Livestatus command delimiters in autocomplete endpoint within the RestAPI of Checkmk versions <2.4.0p6, <2.3.0p35, <2.2.0p44, and 2.1.0 (EOL) allows an authenticated user to inject arbitrary Livestatus commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-140
References: https://checkmk.com/werk/17987
CVE: CVE-2025-53599
Published: 2025-07-04
Description: Whale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted javascript scheme.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-79
References: https://cve.naver.com/detail/cve-2025-53599.html
CVE: CVE-2025-53600
Published: 2025-07-04
Description: Whale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment.
CVSS Score: 7.5 (HIGH)
CWE: CWE-346
References: https://cve.naver.com/detail/cve-2025-53600.html
CVE: CVE-2025-6673
Published: 2025-07-04
Description: The Easy restaurant menu manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's nsc_eprm_menu_link shortcode in versions up to, and including 2.0.1, due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/easy-pdf-restaurant-menu-upload/tags/2.0.0/class/class_admin_easy_pdf_restaurant_menu.php#L68; https://plugins.trac.wordpress.org/changeset/3318491/; https://www.wordfence.com/threat-intel/vulnerabilities/id/382de43a-a714-4538-be12-76e74ad77327?source=cve
CVE: CVE-2024-9453
Published: 2025-07-04
Description: A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are centralized when collected. The token is typically valid for one year. This flaw allows a malicious user to jeopardize the environment if they have access to sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://access.redhat.com/security/cve/CVE-2024-9453; https://bugzilla.redhat.com/show_bug.cgi?id=2316231
CVE: CVE-2025-23972
Published: 2025-07-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in Brian S. Reed Contact Form 7 reCAPTCHA contact-form-7-recaptcha allows Cross Site Request Forgery.This issue affects Contact Form 7 reCAPTCHA: from n/a through <= 1.2.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/contact-form-7-recaptcha/vulnerability/wordpress-contact-form-7-recaptcha-plugin-1-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-24735
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chatra Chatra Live Chat + ChatBot + Cart Saver allows Stored XSS. This issue affects Chatra Live Chat + ChatBot + Cart Saver: from n/a through 1.0.11.
CVSS Score: 7.7 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/chatra-live-chat/vulnerability/wordpress-chatra-live-chat-chatbot-cart-saver-plugin-1-0-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24748
Published: 2025-07-04
Description: Missing Authorization vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/avada/vulnerability/wordpress-avada-theme-7-11-10-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24757
Published: 2025-07-04
Description: Missing Authorization vulnerability in AndonDesign uDesign udesign.This issue affects uDesign: from n/a through <= 4.11.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/udesign/vulnerability/wordpress-udesign-theme-4-11-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-24764
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A. Jones (Simply) Guest Author Name guest-author-name allows DOM-Based XSS.This issue affects (Simply) Guest Author Name: from n/a through <= 4.36.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/guest-author-name/vulnerability/wordpress-simply-guest-author-name-plugin-4-36-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-26591
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam WP fancybox wp-fancybox allows Stored XSS.This issue affects WP fancybox: from n/a through <= 1.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-fancybox/vulnerability/wordpress-wp-fancybox-plugin-1-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27326
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gallery-block allows Stored XSS.This issue affects Video Gallery Block: from n/a through <= 1.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/video-gallery-block/vulnerability/wordpress-video-gallery-block-display-your-videos-as-a-gallery-in-a-professional-way-plugin-1-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-27358
Published: 2025-07-04
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Code Injection.This issue affects Frontend File Manager: from n/a through <= 23.6.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-80
References: https://patchstack.com/database/Wordpress/Plugin/nmedia-user-file-uploader/vulnerability/wordpress-frontend-file-manager-plugin-23-2-content-injection-vulnerability?_s_id=cve
CVE: CVE-2025-28951
Published: 2025-07-04
Description: Unrestricted Upload of File with Dangerous Type vulnerability in CreedAlly Bulk Featured Image bulk-featured-image allows Upload a Web Shell to a Web Server.This issue affects Bulk Featured Image: from n/a through <= 1.2.4.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/bulk-featured-image/vulnerability/wordpress-bulk-featured-image-plugin-1-2-1-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-28957
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OwnerRez OwnerRez API ownerrez allows Stored XSS.This issue affects OwnerRez API: from n/a through <= 1.2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ownerrez/vulnerability/wordpress-ownerrez-plugin-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28963
Published: 2025-07-04
Description: Server-Side Request Forgery (SSRF) vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows Server Side Request Forgery.This issue affects URL Shortener: from n/a through <= 3.0.7.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/exact-links/vulnerability/wordpress-url-shortener-plugin-3-0-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-28967
Published: 2025-07-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Steve Truman Contact Us page - Contact people LITE contact-us-page-contact-people allows SQL Injection.This issue affects Contact Us page - Contact people LITE: from n/a through <= 3.7.4.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/contact-us-page-contact-people/vulnerability/wordpress-contact-us-page-contact-people-lite-plugin-3-7-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-28969
Published: 2025-07-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cybio Gallery Widget gallery-widget allows SQL Injection.This issue affects Gallery Widget: from n/a through <= 1.2.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/gallery-widget/vulnerability/wordpress-gallery-widget-plugin-1-2-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-28971
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CWD Web Designer Easy Elements Hider easy-elements-hider allows Stored XSS.This issue affects Easy Elements Hider: from n/a through <= 2.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/easy-elements-hider/vulnerability/wordpress-easy-elements-hider-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-29001
Published: 2025-07-04
Description: Missing Authorization vulnerability in ZoomIt WooCommerce Shop Page Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooCommerce Shop Page Builder: from n/a through 2.27.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/dzs-wootable/vulnerability/wordpress-woocommerce-shop-page-builder-plugin-2-27-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-29007
Published: 2025-07-04
Description: Missing Authorization vulnerability in LMSACE LMSACE Connect lmsace-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LMSACE Connect: from n/a through <= 3.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/lmsace-connect/vulnerability/wordpress-lmsace-connect-plugin-3-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-29012
Published: 2025-07-04
Description: Missing Authorization vulnerability in kamleshyadav CF7 7 Mailchimp Add-on CF7-mailchimp-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 7 Mailchimp Add-on: from n/a through < 2.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/CF7-mailchimp-addon/vulnerability/wordpress-cf7-7-mailchimp-add-on-plugin-2-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-30929
Published: 2025-07-04
Description: Missing Authorization vulnerability in amazewp fluXtore fluxtore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects fluXtore: from n/a through <= 1.6.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/fluxtore/vulnerability/wordpress-fluxtore-plugin-1-6-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-30943
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aakif Kadiwala Posts Slider Shortcode posts-slider-shortcode allows DOM-Based XSS.This issue affects Posts Slider Shortcode: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/posts-slider-shortcode/vulnerability/wordpress-posts-slider-shortcode-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30947
Published: 2025-07-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Cool fade popup cool-fade-popup allows Blind SQL Injection.This issue affects Cool fade popup: from n/a through <= 10.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/cool-fade-popup/vulnerability/wordpress-cool-fade-popup-plugin-10-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30969
Published: 2025-07-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus iFrame Images Gallery wp-iframe-images-gallery allows SQL Injection.This issue affects iFrame Images Gallery: from n/a through <= 9.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-iframe-images-gallery/vulnerability/wordpress-iframe-images-gallery-plugin-9-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30979
Published: 2025-07-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Pixelating image slideshow gallery pixelating-image-slideshow-gallery allows SQL Injection.This issue affects Pixelating image slideshow gallery: from n/a through <= 8.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/pixelating-image-slideshow-gallery/vulnerability/wordpress-pixelating-image-slideshow-gallery-plugin-8-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30983
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Card flip image slideshow card-flip-image-slideshow allows DOM-Based XSS.This issue affects Card flip image slideshow: from n/a through <= 1.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/card-flip-image-slideshow/vulnerability/wordpress-card-flip-image-slideshow-plugin-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53566
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows Stored XSS.This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through <= 7.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-stats-manager/vulnerability/wordpress-wp-visitor-statistics-real-time-traffic-plugin-7-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53568
Published: 2025-07-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in Tony Zeoli Radio Station radio-station allows Cross Site Request Forgery.This issue affects Radio Station: from n/a through <= 2.5.12.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/radio-station/vulnerability/wordpress-radio-station-plugin-2-5-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve