deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-58240
Published: 2025-08-28
Description: In the Linux kernel, the following vulnerability has been resolved:

tls: separate no-async decryption request handling from async

If we're not doing async, the handling is much simpler. There's no
reference counting, we just need to wait for the completion to wake us
up and return its result.

We should preferably also use a separate crypto_wait. I'm not seeing a
UAF as I did in the past, I think aec7961916f3 ("tls: fix race between
async notify and socket close") took care of it.

This will make the next fix easier.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/41532b785e9d79636b3815a64ddf6a096647d011; https://git.kernel.org/stable/c/48905146d11dbf1ddbb[PII_REDACTED]a83976953f5; https://git.kernel.org/stable/c/[PII_REDACTED]17a675d8ddf61414fc7a85c89f1186
CVE: CVE-2025-48963
Published: 2025-08-28
Description: Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40296.
CVSS Score: 7.3 (HIGH)
CWE: CWE-610
References: https://security-advisory.acronis.com/advisories/SEC-8568
CVE: CVE-2025-54540
Published: 2025-08-28
Description: QuickCMS is vulnerable to Reflected XSS via sSort parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/posts/2025/08/CVE-2025-54540; https://opensolution.org
CVE: CVE-2025-54541
Published: 2025-08-28
Description: QuickCMS is vulnerable to Cross-Site Request Forgery in page deletion functionality. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request deleting an article.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://cert.pl/posts/2025/08/CVE-2025-54540; https://opensolution.org
CVE: CVE-2025-54542
Published: 2025-08-28
Description: QuickCMS sends password and login via GET Request. This allows a local attacker with access to the victim's browser history to obtain the necessary credentials to log in as the user.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-598
References: https://cert.pl/posts/2025/08/CVE-2025-54540; https://opensolution.org
CVE: CVE-2025-54543
Published: 2025-08-28
Description: QuickCMS is vulnerable to Stored XSS via sDescriptionMeta parameter in page editor SEO functionality. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/posts/2025/08/CVE-2025-54540; https://opensolution.org
CVE: CVE-2025-54544
Published: 2025-08-28
Description: QuickCMS is vulnerable to Stored XSS via aDirFilesDescriptions parameter in files editor functionality. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/posts/2025/08/CVE-2025-54540; https://opensolution.org
CVE: CVE-2025-55175
Published: 2025-08-28
Description: QuickCMS is vulnerable to Reflected XSS via sLangEdit parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/posts/2025/08/CVE-2025-54540; https://opensolution.org
CVE: CVE-2025-39496
Published: 2025-08-28
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW WooBeWoo Product Filter Pro allows SQL Injection.This issue affects WooBeWoo Product Filter Pro: from n/a before 2.9.6.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/wordpress/plugin/woofilter-pro/vulnerability/wordpress-woobewoo-product-filter-pro-plugin-2-7-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-9376
Published: 2025-08-28
Description: The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to an insufficient capability check on the 'stopbadbots_check_wordpress_logged_in_cookie' function in all versions up to, and including, 11.58. This makes it possible for unauthenticated attackers to bypass blocklists, rate limits, and other plugin functionality.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://plugins.trac.wordpress.org/browser/stopbadbots/trunk/stopbadbots.php#L1958; https://plugins.trac.wordpress.org/changeset/3350927/; https://plugins.trac.wordpress.org/changeset/3351023/
CVE: CVE-2025-48100
Published: 2025-08-28
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in extremeidea bidorbuy Store Integrator bidorbuystoreintegrator allows Remote Code Inclusion.This issue affects bidorbuy Store Integrator: from n/a through <= 2.12.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/bidorbuystoreintegrator/vulnerability/wordpress-bidorbuy-store-integrator-plugin-2-10-0-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2025-48109
Published: 2025-08-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Xavier Media XM-Backup xm-backup allows Stored XSS.This issue affects XM-Backup: from n/a through <= 0.9.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/xm-backup/vulnerability/wordpress-xm-backup-plugin-0-9-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48110
Published: 2025-08-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mibuthu Link View link-view allows Stored XSS.This issue affects Link View: from n/a through <= 0.8.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/link-view/vulnerability/wordpress-link-view-plugin-0-8-0-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2025-48304
Published: 2025-08-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Gary Illyes Google XML News Sitemap plugin gn-xml-sitemap allows Stored XSS.This issue affects Google XML News Sitemap plugin: from n/a through <= 0.02.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/gn-xml-sitemap/vulnerability/wordpress-google-xml-news-sitemap-plugin-plugin-0-02-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48305
Published: 2025-08-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vikingjs Goal Tracker for Patreon goal-tracker-for-patreon allows Stored XSS.This issue affects Goal Tracker for Patreon: from n/a through <= 0.4.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/goal-tracker-for-patreon/vulnerability/wordpress-goal-tracker-for-patreon-plugin-0-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48306
Published: 2025-08-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in developers savyour Savyour Affiliate Partner savyour-affiliate-partner allows Stored XSS.This issue affects Savyour Affiliate Partner: from n/a through <= 2.1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/savyour-affiliate-partner/vulnerability/wordpress-savyour-affiliate-partner-plugin-2-1-4-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48307
Published: 2025-08-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in kasonzhao SEO For Images seo-for-images allows Stored XSS.This issue affects SEO For Images: from n/a through <= 1.0.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/seo-for-images/vulnerability/wordpress-seo-for-images-plugin-1-0-0-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48308
Published: 2025-08-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in nonletter Newsletter subscription optin module newsletter-subscription-widget-for-sendblaster allows Stored XSS.This issue affects Newsletter subscription optin module: from n/a through <= 1.2.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/newsletter-subscription-widget-for-sendblaster/vulnerability/wordpress-newsletter-subscription-optin-module-plugin-1-2-9-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48309
Published: 2025-08-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in web-able BetPress betpress allows Stored XSS.This issue affects BetPress: from n/a through <= 1.0.1 Lite.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/betpress/vulnerability/wordpress-betpress-plugin-1-0-1-lite-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48310
Published: 2025-08-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in wptableeditor Table Editor wp-table-editor allows Cross Site Request Forgery.This issue affects Table Editor: from n/a through <= 1.6.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-table-editor/vulnerability/wordpress-table-editor-plugin-1-6-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-48311
Published: 2025-08-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in OffClicks Invisible Optin invisible-optin allows Stored XSS.This issue affects Invisible Optin: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/invisible-optin/vulnerability/wordpress-invisible-optin-plugin-1-0-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48312
Published: 2025-08-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 文派翻译（WP Chinese Translation） WPAvatar wpavatar allows Stored XSS.This issue affects WPAvatar: from n/a through <= 1.9.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpavatar/vulnerability/wordpress-wpavatar-plugin-1-9-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48313
Published: 2025-08-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kevin heath Tripadvisor Shortcode tripadvisor-shortcode allows Stored XSS.This issue affects Tripadvisor Shortcode: from n/a through <= 2.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/tripadvisor-shortcode/vulnerability/wordpress-tripadvisor-shortcode-plugin-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48314
Published: 2025-08-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salubrio Add Code To Head add-code-to-head allows Stored XSS.This issue affects Add Code To Head: from n/a through <= 1.17.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/add-code-to-head/vulnerability/wordpress-add-code-to-head-plugin-1-17-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48315
Published: 2025-08-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stanton119 WordPress HTML custom-html-bodyhead allows Stored XSS.This issue affects WordPress HTML: from n/a through <= 0.51.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/custom-html-bodyhead/vulnerability/wordpress-wordpress-html-plugin-0-51-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48316
Published: 2025-08-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ItayXD Responsive Mobile-Friendly Tooltip responsive-mobile-friendly-tooltip allows Stored XSS.This issue affects Responsive Mobile-Friendly Tooltip: from n/a through <= 1.6.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/responsive-mobile-friendly-tooltip/vulnerability/wordpress-responsive-mobile-friendly-tooltip-plugin-1-6-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48318
Published: 2025-08-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in shen2 多说社会化评论框 duoshuo allows Cross Site Request Forgery.This issue affects 多说社会化评论框: from n/a through <= 1.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/duoshuo/vulnerability/wordpress-plugin-1-2-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-48319
Published: 2025-08-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gslauraspeck Mesa Mesa Reservation Widget mesa-mesa-reservation-widget allows Stored XSS.This issue affects Mesa Mesa Reservation Widget: from n/a through <= 1.0.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mesa-mesa-reservation-widget/vulnerability/wordpress-mesa-mesa-reservation-widget-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48320
Published: 2025-08-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in cuckoohello 百度分享按钮 baidushare-wp allows Stored XSS.This issue affects 百度分享按钮: from n/a through <= 1.0.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/baidushare-wp/vulnerability/wordpress-plugin-1-0-6-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48321
Published: 2025-08-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in dyiosah Ultimate twitter profile widget ultimate-twitter-profile-widget allows Stored XSS.This issue affects Ultimate twitter profile widget: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-twitter-profile-widget/vulnerability/wordpress-ultimate-twitter-profile-widget-plugin-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48322
Published: 2025-08-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Finn Dohrn Statify Widget statify-widget allows Stored XSS.This issue affects Statify Widget: from n/a through <= 1.4.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/statify-widget/vulnerability/wordpress-statify-widget-plugin-1-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48323
Published: 2025-08-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md Abunaser Khan Advance Food Menu advance-food-menu allows Stored XSS.This issue affects Advance Food Menu: from n/a through <= 1.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/advance-food-menu/vulnerability/wordpress-advance-food-menu-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48324
Published: 2025-08-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in khashabawy tli.tl auto Twitter poster tlitl-auto-twitter-poster allows Stored XSS.This issue affects tli.tl auto Twitter poster: from n/a through <= 3.4.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/tlitl-auto-twitter-poster/vulnerability/wordpress-tli-tl-auto-twitter-poster-plugin-3-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48325
Published: 2025-08-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in shmish111 WP Admin Theme wp-admin-theme allows Stored XSS.This issue affects WP Admin Theme: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-admin-theme/vulnerability/wordpress-wp-admin-theme-plugin-1-0-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48327
Published: 2025-08-28
Description: Missing Authorization vulnerability in inkthemes WP Mailgun SMTP wp-mailgun-smtp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Mailgun SMTP: from n/a through <= 1.0.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-mailgun-smtp/vulnerability/wordpress-wp-mailgun-smtp-plugin-1-0-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48343
Published: 2025-08-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in Aaron Axelsen WPMU Ldap Authentication wpmuldap allows Stored XSS.This issue affects WPMU Ldap Authentication: from n/a through <= 5.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wpmuldap/vulnerability/wordpress-wpmu-ldap-authentication-plugin-5-0-1-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48347
Published: 2025-08-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Mimoun-Prat bxSlider integration for WordPress bxslider-integration allows Stored XSS.This issue affects bxSlider integration for WordPress: from n/a through <= 1.7.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bxslider-integration/vulnerability/wordpress-bxslider-integration-for-wordpress-plugin-1-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48348
Published: 2025-08-28
Description: Incorrect Privilege Assignment vulnerability in chandrashekharsahu Site Offline site-offline allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Offline: from n/a through <= 1.5.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/site-offline/vulnerability/wordpress-site-offline-plugin-1-5-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48349
Published: 2025-08-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in origincode Video Gallery – Vimeo and YouTube Gallery smart-grid-gallery allows Stored XSS.This issue affects Video Gallery – Vimeo and YouTube Gallery: from n/a through <= 1.1.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/smart-grid-gallery/vulnerability/wordpress-video-gallery-vimeo-and-youtube-gallery-plugin-1-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48350
Published: 2025-08-28
Description: Missing Authorization vulnerability in Basar Ventures AutoWP autowp-ai-content-writer-rewriter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AutoWP: from n/a through <= 2.2.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/autowp-ai-content-writer-rewriter/vulnerability/wordpress-autowp-plugin-2-2-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-48351
Published: 2025-08-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in PluginsPoint Kento Splash Screen kento-splash-screen allows Stored XSS.This issue affects Kento Splash Screen: from n/a through <= 1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/kento-splash-screen/vulnerability/wordpress-kento-splash-screen-plugin-1-4-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48352
Published: 2025-08-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sitesearch-yandex Yandex Site search pinger yandex-pinger allows Stored XSS.This issue affects Yandex Site search pinger: from n/a through <= 1.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/yandex-pinger/vulnerability/wordpress-yandex-site-search-pinger-plugin-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48353
Published: 2025-08-28
Description: Cross-Site Request Forgery (CSRF) vulnerability in dactum Clickbank WordPress Plugin (Niche Storefront) clickbank-niche-storefronts allows Stored XSS.This issue affects Clickbank WordPress Plugin (Niche Storefront): from n/a through <= 1.3.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/clickbank-niche-storefronts/vulnerability/wordpress-clickbank-wordpress-plugin-niche-storefront-plugin-1-3-5-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48354
Published: 2025-08-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Stored XSS.This issue affects Better Post & Filter Widgets for Elementor: from n/a through <= 1.6.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/better-post-filter-widgets-for-elementor/vulnerability/wordpress-better-post-filter-widgets-for-elementor-plugin-1-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48356
Published: 2025-08-28
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Isra Kanpress kanpress allows Stored XSS.This issue affects Kanpress: from n/a through <= 1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/kanpress/vulnerability/wordpress-kanpress-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve