deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-56889
Published: 2025-02-06
Description: Incorrect access control in the endpoint /admin/m_delete.php of CodeAstro Complaint Management System v1.0 allows unauthorized attackers to arbitrarily delete complaints via modification of the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/vigneshr232/CVE-2024-56889/blob/main/CVE-2024-56889.md
CVE: CVE-2024-57392
Published: 2025-02-06
Description: Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Service (DoS) on the FTP service by sending a maliciously crafted message to the ProFTPD service port.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/Br1m4zz/protocol_vul_repoduce.git; https://lists.debian.org/debian-lts-announce/2025/03/msg00003.html
CVE: CVE-2024-57609
Published: 2025-02-06
Description: An issue in Kanaries Inc Pygwalker before v.0.4.9.9 allows a remote attacker to obtain sensitive information and execute arbitrary code via the redirect_path parameter of the login redirection function.
CVSS Score: 8.6 (HIGH)
CWE: CWE-94
References: https://github.com/nca785/CVE-2024-57609/
CVE: CVE-2025-1082
Published: 2025-02-06
Description: A vulnerability classified as problematic has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected is an unknown function of the file /api/admin/question/edit of the component Exam Edit Handler. The manipulation of the argument title/content leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/cydtseng/Vulnerability-Research/blob/main/xzs-mysql/StoredXSS-ExamEdit.md; https://vuldb.com/?ctiid.294858; https://vuldb.com/?id.294858
CVE: CVE-2025-1083
Published: 2025-02-06
Description: A vulnerability classified as problematic was found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected by this vulnerability is an unknown functionality of the component CORS Handler. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 3.1 (LOW)
CWE: CWE-346, CWE-942
References: https://github.com/cydtseng/Vulnerability-Research/blob/main/xzs-mysql/OverlyPermissiveCORS-Multiple.md; https://vuldb.com/?ctiid.294859; https://vuldb.com/?id.294859
CVE: CVE-2025-21177
Published: 2025-02-06
Description: Server-side request forgery (ssrf) in Microsoft Dynamics 365 Sales allows an authorized attacker to elevate privileges over a network.
CVSS Score: 8.7 (HIGH)
CWE: CWE-918
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21177
CVE: CVE-2025-21253
Published: 2025-02-06
Description: Microsoft Edge for IOS and Android Spoofing Vulnerability
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-451
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21253
CVE: CVE-2025-21267
Published: 2025-02-06
Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-358
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21267
CVE: CVE-2025-21279
Published: 2025-02-06
Description: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21279
CVE: CVE-2025-21283
Published: 2025-02-06
Description: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1222
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21283
CVE: CVE-2025-21342
Published: 2025-02-06
Description: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21342
CVE: CVE-2025-21404
Published: 2025-02-06
Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-449, CWE-451
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21404
CVE: CVE-2025-21408
Published: 2025-02-06
Description: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21408
CVE: CVE-2025-0674
Published: 2025-02-07
Description: Multiple Elber products are affected by an authentication bypass 
vulnerability which allows unauthorized access to the password 
management functionality. Attackers can exploit this issue by 
manipulating the endpoint to overwrite any user's password within the 
system. This grants them unauthorized administrative access to protected
 areas of the application, compromising the device's system security.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-03
CVE: CVE-2025-0675
Published: 2025-02-07
Description: Multiple Elber products suffer from an unauthenticated device configuration and client-side hidden functionality disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-912
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-03
CVE: CVE-2025-1084
Published: 2025-02-07
Description: A vulnerability, which was classified as problematic, has been found in Mindskip xzs-mysql 学之思开源考试系统 3.9.0. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352, CWE-862, CWE-352
References: https://github.com/cydtseng/Vulnerability-Research/blob/main/xzs-mysql/CrossSiteRequestForgery-Multiple.md; https://vuldb.com/?ctiid.294860; https://vuldb.com/?id.294860
CVE: CVE-2025-1085
Published: 2025-02-07
Description: A vulnerability, which was classified as problematic, was found in Animati PACS up to 1.24.12.09.03. This affects an unknown part of the file /login. The manipulation of the argument p leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94
References: https://vuldb.com/?ctiid.294861; https://vuldb.com/?id.294861; https://vuldb.com/?submit.489857
CVE: CVE-2025-1061
Published: 2025-02-07
Description: The Nextend Social Login Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.16. This is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://nextendweb.com/nextend-social-login-docs/pro-addon-changelog/; https://nextendweb.com/nextend-social-login-docs/provider-apple/; https://www.wordfence.com/threat-intel/vulnerabilities/id/6494e54c-db04-41f9-8b91-6ad12528cf01?source=cve
CVE: CVE-2025-1086
Published: 2025-02-07
Description: A vulnerability has been found in Safetytest Cloud-Master Server up to 1.1.1 and classified as critical. This vulnerability affects unknown code of the file /static/. The manipulation leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-23, CWE-24
References: https://vuldb.com/?ctiid.294862; https://vuldb.com/?id.294862; https://vuldb.com/?submit.491021
CVE: CVE-2025-22402
Published: 2025-02-07
Description: Dell Update Manager Plugin, version(s) 1.5.0 through 1.6.0, contain(s) an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
CVSS Score: 2.6 (LOW)
CWE: CWE-80, CWE-79
References: https://www.dell.com/support/kbdoc/en-us/000281885/dsa-2025-047-security-update-for-dell-update-manager-plugin-vulnerability
CVE: CVE-2025-1072
Published: 2025-02-07
Description: A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14.1 prior to 17.3.7, 17.4 prior to 17.4.4, and 17.5 prior to 17.5.2. A denial of service could occur upon importing maliciously crafted content using the Fogbugz importer.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#denial-of-service-by-importing-malicious-crafted-fogbugz-import-payload; https://gitlab.com/gitlab-org/gitlab/-/issues/463093; https://hackerone.com/reports/2504059
CVE: CVE-2024-13352
Published: 2025-02-07
Description: The Legull WordPress plugin through 1.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/2c141cc0-f79e-42bd-97a6[PII_REDACTED]4c/
CVE: CVE-2024-13492
Published: 2025-02-07
Description: The Guten Free Options WordPress plugin through 0.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a4a75b75-4801-4ed4-bcc6-4874ac169562/
CVE: CVE-2024-13841
Published: 2025-02-07
Description: The Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via the 'bse-elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private and draft posts created with Elementor that they should not have access to.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/builder-shortcode-extras/tags/1.0.0/includes/shortcodes/elementor.php#L116; https://www.wordfence.com/threat-intel/vulnerabilities/id/642dc1d3-a008-4af8-ba9e-dbdd37b93126?source=cve
CVE: CVE-2025-23085
Published: 2025-02-07
Description: A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions.

This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-401
References: https://nodejs.org/en/blog/vulnerability/january-2025-security-releases; https://lists.debian.org/debian-lts-announce/2025/02/msg00031.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2025-22880
Published: 2025-02-07
Description: Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00002_CNCSoft-G2%20-%20Heap-based%20Buffer%20Overflow_v1.pdf
CVE: CVE-2025-1077
Published: 2025-02-07
Description: A security vulnerability has been identified in the IBL Software Engineering Visual Weather and derived products (NAMIS, Aero Weather, Satellite Weather). The vulnerability is present in the Product Delivery Service (PDS) component in specific server configurations where the PDS pipeline utilizes the IPDS pipeline with Message Editor Output Filters enabled.

A remote unauthenticated

attacker can exploit this vulnerability to send unauthenticated requests to execute the IPDS pipeline with specially crafted Form Properties, enabling remote execution of arbitrary Python code. This vulnerability could lead to a full system compromise of the affected server, particularly if Visual Weather services are run under a privileged user account—contrary to the documented installation best practices.



Upgrade to the patched versions 7.3.10 (or higher), 8.6.0 (or higher).
CWE: CWE-20, CWE-502
References: https://www.iblsoft.com/security/advisory-isec-2024-001/
CVE: CVE-2025-0302
Published: 2025-02-07
Description: in OpenHarmony v4.1.2 and prior versions allow a local attacker cause DOS through integer overflow.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-02.md
CVE: CVE-2025-0303
Published: 2025-02-07
Description: in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through buffer overflow.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-02.md
CVE: CVE-2025-0304
Published: 2025-02-07
Description: in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use after free.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-02.md
CVE: CVE-2025-25071
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in topplugins Vignette Ads vignete-ads allows Stored XSS.This issue affects Vignette Ads: from n/a through <= 0.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/vignete-ads/vulnerability/wordpress-vignette-ads-plugin-0-2-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25072
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in thunderbax WP Admin Custom Page wp-admin-custom-page allows Stored XSS.This issue affects WP Admin Custom Page: from n/a through <= 1.5.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-admin-custom-page/vulnerability/wordpress-wp-admin-custom-page-plugin-1-5-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25073
Published: 2025-02-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vasilis Triantafyllou Easy WP Tiles easy-wp-tiles allows Stored XSS.This issue affects Easy WP Tiles: from n/a through <= 1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/easy-wp-tiles/vulnerability/wordpress-easy-wp-tiles-plugin-1-cross-site-scripting-xss-vulnerability-3?_s_id=cve
CVE: CVE-2025-25074
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Nirmal Kumar Ram WP Social Stream wp-social-stream allows Stored XSS.This issue affects WP Social Stream: from n/a through <= 1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-social-stream/vulnerability/wordpress-wp-social-stream-plugin-1-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25075
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Show notice or message on admin area show-notice-or-message-on-admin-area allows Stored XSS.This issue affects Show notice or message on admin area: from n/a through <= 2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/show-notice-or-message-on-admin-area/vulnerability/wordpress-show-notice-or-message-on-admin-area-plugin-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25076
Published: 2025-02-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicholaswilson Graceful Email Obfuscation graceful-email-obfuscation allows Stored XSS.This issue affects Graceful Email Obfuscation: from n/a through <= 0.2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/graceful-email-obfuscation/vulnerability/wordpress-graceful-email-obfuscation-plugin-0-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25077
Published: 2025-02-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dugbug Easy Chart Builder for WordPress easy-chart-builder allows Stored XSS.This issue affects Easy Chart Builder for WordPress: from n/a through <= 1.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/easy-chart-builder/vulnerability/wordpress-easy-chart-builder-for-wordpress-plugin-1-3-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25078
Published: 2025-02-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrew Norcross Google Earth Embed google-earth-tours allows Stored XSS.This issue affects Google Earth Embed: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/google-earth-tours/vulnerability/wordpress-google-earth-embed-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25079
Published: 2025-02-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Garrett Grimm Simple Select All Text Box simple-select-all-text-box allows Stored XSS.This issue affects Simple Select All Text Box: from n/a through <= 3.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-select-all-text-box/vulnerability/wordpress-simple-select-all-text-box-plugin-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25080
Published: 2025-02-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gubbigubbi Kona Gallery Block kona-instagram-feed-for-gutenberg allows Stored XSS.This issue affects Kona Gallery Block: from n/a through <= 1.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/kona-instagram-feed-for-gutenberg/vulnerability/wordpress-kona-gallery-block-plugin-1-7-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25081
Published: 2025-02-07
Description: Missing Authorization vulnerability in DeannaS Embed RSS embed-rss allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Embed RSS: from n/a through <= 3.1.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/embed-rss/vulnerability/wordpress-embed-rss-plugin-3-1-arbitrary-shortcode-execution-vulnerability-2?_s_id=cve
CVE: CVE-2025-25082
Published: 2025-02-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max Chirkov FlexIDX Home Search flexidx-home-search allows Stored XSS.This issue affects FlexIDX Home Search: from n/a through <= 2.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/flexidx-home-search/vulnerability/wordpress-flexidx-home-search-plugin-2-1-2-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25085
Published: 2025-02-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matt_mcbrien WP SimpleWeather wp-simpleweather allows Stored XSS.This issue affects WP SimpleWeather: from n/a through <= 0.2.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-simpleweather/vulnerability/wordpress-wp-simpleweather-plugin-0-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25088
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in blackus3r WP Keyword Monitor wp-keyword-monitor allows Cross Site Request Forgery.This issue affects WP Keyword Monitor: from n/a through <= 1.0.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-keyword-monitor/vulnerability/wordpress-wp-keyword-monitor-plugin-1-0-5-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25091
Published: 2025-02-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zackdesign NextGen Cooliris Gallery nextgen-cooliris-gallery allows Stored XSS.This issue affects NextGen Cooliris Gallery: from n/a through <= 0.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/nextgen-cooliris-gallery/vulnerability/wordpress-nextgen-cooliris-gallery-plugin-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25093
Published: 2025-02-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in paulswarthout Child Themes Helper child-themes-helper allows Path Traversal.This issue affects Child Themes Helper: from n/a through <= 2.2.7.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/child-themes-helper/vulnerability/wordpress-child-themes-helper-plugin-2-2-7-csrf-to-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-25094
Published: 2025-02-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amitythemes.com Breaking News Ticker breaking-news-ticker allows Stored XSS.This issue affects Breaking News Ticker: from n/a through <= 2.4.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/breaking-news-ticker/vulnerability/wordpress-breaking-news-ticker-plugin-2-4-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25095
Published: 2025-02-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reverbnationdev ReverbNation Widgets reverbnation-widgets allows Stored XSS.This issue affects ReverbNation Widgets: from n/a through <= 2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/reverbnation-widgets/vulnerability/wordpress-reverbnation-widgets-plugin-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-25096
Published: 2025-02-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in titusbicknell RSS in Page rss-in-page allows Stored XSS.This issue affects RSS in Page: from n/a through <= 2.9.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/rss-in-page/vulnerability/wordpress-rss-in-page-plugin-2-9-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve