deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-47526
Published: 2025-05-07
Description: Missing Authorization vulnerability in GS Plugins GS Variation Swatches for WooCommerce gs-woo-variation-swatches allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Variation Swatches for WooCommerce: from n/a through <= 3.0.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/gs-woo-variation-swatches/vulnerability/wordpress-gs-variation-swatches-for-woocommerce-3-0-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-47528
Published: 2025-05-07
Description: Missing Authorization vulnerability in pewilliams Ovation Elements ovation-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ovation Elements: from n/a through <= 1.1.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/ovation-elements/vulnerability/wordpress-ovation-elements-1-1-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-47531
Published: 2025-05-07
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Xylus Themes XT Event Widget for Social Events xt-facebook-events allows PHP Local File Inclusion.This issue affects XT Event Widget for Social Events: from n/a through <= 1.1.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/xt-facebook-events/vulnerability/wordpress-xt-event-widget-for-social-events-1-1-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-47533
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Iqonic Design Graphina graphina-elementor-charts-and-graphs allows PHP Local File Inclusion.This issue affects Graphina: from n/a through <= 3.0.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/graphina-elementor-charts-and-graphs/vulnerability/wordpress-graphina-plugin-3-0-4-cross-site-request-forgery-csrf-to-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-47537
Published: 2025-05-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows SQL Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 5.3.8.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/pdf-for-woocommerce/vulnerability/wordpress-pdf-invoices-for-woocommerce-drag-and-drop-template-builder-5-3-8-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-47538
Published: 2025-05-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdever Cart tracking for WooCommerce cart-tracking-for-woocommerce allows SQL Injection.This issue affects Cart tracking for WooCommerce: from n/a through <= 1.0.17.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/cart-tracking-for-woocommerce/vulnerability/wordpress-cart-tracking-for-woocommerce-1-0-17-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-47540
Published: 2025-05-07
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs weMail wemail allows Retrieve Embedded Sensitive Data.This issue affects weMail: from n/a through <= 1.14.13.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/wemail/vulnerability/wordpress-wemail-1-14-13-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-47542
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Michael Simple calendar for Elementor simple-calendar-for-elementor allows Cross Site Request Forgery.This issue affects Simple calendar for Elementor: from n/a through <= 1.6.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/simple-calendar-for-elementor/vulnerability/wordpress-simple-calendar-for-elementor-1-6-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47543
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Cross Site Request Forgery.This issue affects TrueBooker: from n/a through <= 1.0.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/truebooker-appointment-booking/vulnerability/wordpress-truebooker-1-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47544
Published: 2025-05-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing allows Blind SQL Injection.This issue affects Dynamic Pricing With Discount Rules for WooCommerce: from n/a through <= 4.5.8.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/aco-woo-dynamic-pricing/vulnerability/wordpress-dynamic-pricing-with-discount-rules-for-woocommerce-4-5-8-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-47545
Published: 2025-05-07
Description: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Ays Pro Poll Maker poll-maker allows Leveraging Race Conditions.This issue affects Poll Maker: from n/a through <= 5.7.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-362
References: https://patchstack.com/database/Wordpress/Plugin/poll-maker/vulnerability/wordpress-poll-maker-5-7-7-race-condition-vulnerability?_s_id=cve
CVE: CVE-2025-47546
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Cross Site Request Forgery.This issue affects WP Compress: from n/a through <= 6.30.30.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-compress-image-optimizer/vulnerability/wordpress-wp-compress-6-30-30-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47547
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Stored XSS.This issue affects SendPulse Email Marketing Newsletter: from n/a through <= 2.1.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sendpulse-email-marketing-newsletter/vulnerability/wordpress-sendpulse-email-marketing-newsletter-2-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47548
Published: 2025-05-07
Description: Server-Side Request Forgery (SSRF) vulnerability in Varun Dubey Wbcom Designs - Activity Link Preview For BuddyPress activity-link-preview-for-buddypress allows Server Side Request Forgery.This issue affects Wbcom Designs - Activity Link Preview For BuddyPress: from n/a through <= 1.4.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/activity-link-preview-for-buddypress/vulnerability/wordpress-wbcom-designs-activity-link-preview-for-buddypress-1-4-4-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-47549
Published: 2025-05-07
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Themefic BEAF beaf-before-and-after-gallery allows Upload a Web Shell to a Web Server.This issue affects BEAF: from n/a through <= 4.6.10.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/beaf-before-and-after-gallery/vulnerability/wordpress-beaf-4-6-10-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-47550
Published: 2025-05-07
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Instantio instantio allows Upload a Web Shell to a Web Server.This issue affects Instantio: from n/a through <= 3.3.16.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/instantio/vulnerability/wordpress-instantio-3-3-16-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-47551
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in ctltwp Wiki Embed wiki-embed allows Cross Site Request Forgery.This issue affects Wiki Embed: from n/a through <= 1.4.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wiki-embed/vulnerability/wordpress-wiki-embed-plugin-1-4-6-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-47587
Published: 2025-05-07
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YaySMTP yaysmtp allows Blind SQL Injection.This issue affects YaySMTP: from n/a through <= 2.6.4.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/yaysmtp/vulnerability/wordpress-yaysmtp-2-6-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-47589
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in motov.net Ebook Store ebook-store allows DOM-Based XSS.This issue affects Ebook Store: from n/a through <= 5.8009.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ebook-store/vulnerability/wordpress-ebook-store-5-8007-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47590
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in JExtensions Store WPSpeed wpspeed allows Cross Site Request Forgery.This issue affects WPSpeed: from n/a through <= 2.6.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wpspeed/vulnerability/wordpress-wpspeed-2-6-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47591
Published: 2025-05-07
Description: Missing Authorization vulnerability in CreedAlly Bulk Featured Image bulk-featured-image allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Featured Image: from n/a through <= 1.2.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/bulk-featured-image/vulnerability/wordpress-bulk-featured-image-1-2-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-47592
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Árpád Lehel Mátyus Terms Popup On User Login terms-popup-on-user-login allows Stored XSS.This issue affects Terms Popup On User Login: from n/a through <= 2.0.8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/terms-popup-on-user-login/vulnerability/wordpress-legal-terms-and-conditions-popup-for-user-login-and-woocommerce-checkout-tpul-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47593
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonas Hjalmarsson Really Simple Under Construction Page really-simple-under-construction allows Stored XSS.This issue affects Really Simple Under Construction Page: from n/a through <= 1.4.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/really-simple-under-construction/vulnerability/wordpress-really-simple-under-construction-page-1-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47594
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in DAEXT Soccer Live Scores allows Cross Site Request Forgery. This issue affects Soccer Live Scores: from n/a through 1.0.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/wordpress/plugin/soccer-live-scores/vulnerability/wordpress-soccer-live-scores-1-0-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47595
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darshan Saroya Color Your Bar color-your-bar allows Stored XSS.This issue affects Color Your Bar: from n/a through <= 2.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/color-your-bar/vulnerability/wordpress-color-your-bar-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47596
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Beacon Lead Magnets and Lead Capture beacon-by allows Cross Site Request Forgery.This issue affects Beacon Lead Magnets and Lead Capture: from n/a through <= 1.5.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/beacon-by/vulnerability/wordpress-beacon-lead-magnets-and-lead-capture-1-5-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47597
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Maulik Vora WP Podcasts Manager wp-podcasts-manager allows Cross Site Request Forgery.This issue affects WP Podcasts Manager: from n/a through <= 1.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-podcasts-manager/vulnerability/wordpress-wp-podcasts-manager-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47602
Published: 2025-05-07
Description: Missing Authorization vulnerability in ammarahmad786 Calculate Prices based on Distance For WooCommerce calculate-prices-based-on-distance-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Calculate Prices based on Distance For WooCommerce: from n/a through <= 1.3.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/calculate-prices-based-on-distance-for-woocommerce/vulnerability/wordpress-calculate-prices-based-on-distance-for-woocommerce-1-3-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-47604
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Mitigation, Inc. Inline Related Posts intelly-related-posts allows Stored XSS.This issue affects Inline Related Posts: from n/a through <= 3.8.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/intelly-related-posts/vulnerability/wordpress-inline-related-posts-3-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47605
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AppJetty WP jQuery DataTable wp-jquery-datatable allows Stored XSS.This issue affects WP jQuery DataTable: from n/a through <= 4.1.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-jquery-datatable/vulnerability/wordpress-wp-jquery-datatable-4-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47606
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Igor Benic Simple Giveaways giveasap allows Cross Site Request Forgery.This issue affects Simple Giveaways: from n/a through <= 2.49.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/giveasap/vulnerability/wordpress-simple-giveaways-2-48-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47607
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AppJetty Show All Comments show-all-comments-in-one-page allows Stored XSS.This issue affects Show All Comments: from n/a through <= 7.0.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/show-all-comments-in-one-page/vulnerability/wordpress-show-all-comments-7-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47609
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in easymebiz EasyMe Connect easyme-connect allows Cross Site Request Forgery.This issue affects EasyMe Connect: from n/a through <= 3.0.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/easyme-connect/vulnerability/wordpress-easyme-connect-3-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47612
Published: 2025-05-07
Description: Missing Authorization vulnerability in ClickWhale ClickWhale clickwhale allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ClickWhale: from n/a through <= 2.4.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/clickwhale/vulnerability/wordpress-clickwhale-2-4-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-47614
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in Chris Clark LessButtons Social Sharing and Statistics lessbuttons allows Cross Site Request Forgery.This issue affects LessButtons Social Sharing and Statistics: from n/a through <= 1.6.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/lessbuttons/vulnerability/wordpress-lessbuttons-social-sharing-and-statistics-plugin-1-6-1-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-47615
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flowdee Amazon Product in a Post amazon-product-in-a-post-plugin allows Stored XSS.This issue affects Amazon Product in a Post: from n/a through <= 5.2.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/amazon-product-in-a-post-plugin/vulnerability/wordpress-amazon-product-in-a-post-5-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47616
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC aBlocks ablocks allows Stored XSS.This issue affects aBlocks: from n/a through <= 1.9.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ablocks/vulnerability/wordpress-ablocks-1-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47617
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aharonyan WP Front User Submit / Front Editor front-editor allows Stored XSS.This issue affects WP Front User Submit / Front Editor: from n/a through <= 5.0.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/front-editor/vulnerability/wordpress-wp-front-user-submit-front-editor-4-9-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47620
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in bundgaard Martins Free Monetized Ad Exchange Network martins-free-and-easy-ad-network-get-more-visitors allows Reflected XSS.This issue affects Martins Free Monetized Ad Exchange Network: from n/a through <= 1.0.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/martins-free-and-easy-ad-network-get-more-visitors/vulnerability/wordpress-martins-free-monetized-ad-exchange-network-plugin-1-0-5-csrf-to-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47621
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meks Meks Flexible Shortcodes meks-flexible-shortcodes allows Stored XSS.This issue affects Meks Flexible Shortcodes: from n/a through <= 1.3.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/meks-flexible-shortcodes/vulnerability/wordpress-meks-flexible-shortcodes-1-3-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47622
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados Email Notification on Login email-notification-on-login allows Stored XSS.This issue affects Email Notification on Login: from n/a through <= 1.7.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/email-notification-on-login/vulnerability/wordpress-email-notification-on-login-1-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47623
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Easy PayPal Buy Now Button wp-ecommerce-paypal allows Stored XSS.This issue affects Easy PayPal Buy Now Button: from n/a through <= 2.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-ecommerce-paypal/vulnerability/wordpress-easy-paypal-buy-now-button-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47624
Published: 2025-05-07
Description: Cross-Site Request Forgery (CSRF) vulnerability in apasionados DoFollow Case by Case dofollow-case-by-case allows Cross Site Request Forgery.This issue affects DoFollow Case by Case: from n/a through <= 3.5.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/dofollow-case-by-case/vulnerability/wordpress-dofollow-case-by-case-3-5-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-47625
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados DoFollow Case by Case dofollow-case-by-case allows Stored XSS.This issue affects DoFollow Case by Case: from n/a through <= 3.5.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/dofollow-case-by-case/vulnerability/wordpress-dofollow-case-by-case-3-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47626
Published: 2025-05-07
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados Submission DOM tracking for Contact Form 7 cf7-submission-dom-tracking allows Stored XSS.This issue affects Submission DOM tracking for Contact Form 7: from n/a through <= 2.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cf7-submission-dom-tracking/vulnerability/wordpress-submission-dom-tracking-for-contact-form-7-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47628
Published: 2025-05-07
Description: Missing Authorization vulnerability in quomodosoft QS Dark Mode qs-dark-mode allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects QS Dark Mode: from n/a through <= 3.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/qs-dark-mode/vulnerability/wordpress-qs-dark-mode-3-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-47629
Published: 2025-05-07
Description: Deserialization of Untrusted Data vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Object Injection.This issue affects WP-CRM System: from n/a through <= 3.4.5.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/wp-crm-system/vulnerability/wordpress-wp-crm-system-3-4-1-php-object-injection-vulnerability?_s_id=cve