deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-28952
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Jonathan Lau CubePoints cubepoints allows Cross Site Request Forgery.This issue affects CubePoints: from n/a through <= 3.2.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/cubepoints/vulnerability/wordpress-cubepoints-3-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-28954
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in wphobby Backwp backwp allows Path Traversal.This issue affects Backwp: from n/a through <= 2.0.2.
CVSS Score: 7.4 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/backwp/vulnerability/wordpress-backwp-plugin-2-0-2-csrf-to-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-28958
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Vadim Bogaiskov Bg Orthodox Calendar bg-orthodox-calendar allows Stored XSS.This issue affects Bg Orthodox Calendar: from n/a through <= 0.13.10.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/bg-orthodox-calendar/vulnerability/wordpress-bg-orthodox-calendar-plugin-0-13-10-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28964
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in mangup Personal Favicon personal-favicon allows Stored XSS.This issue affects Personal Favicon: from n/a through <= 2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/personal-favicon/vulnerability/wordpress-personal-favicon-plugin-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28966
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in dilemma123 Recent Posts Slider Responsive recent-posts-slider-responsive allows Stored XSS.This issue affects Recent Posts Slider Responsive: from n/a through <= 1.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/recent-posts-slider-responsive/vulnerability/wordpress-recent-posts-slider-responsive-plugin-1-0-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-28974
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in mail250 Free WP Mail SMTP free-wp-mail-smtp allows Stored XSS.This issue affects Free WP Mail SMTP: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/free-wp-mail-smtp/vulnerability/wordpress-free-wp-mail-smtp-plugin-1-0-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28981
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Soli WP Mail Options wp-mail-options allows Stored XSS.This issue affects WP Mail Options: from n/a through <= 0.2.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-mail-options/vulnerability/wordpress-wp-mail-options-plugin-0-2-3-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28984
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in storepro Subscription Renewal Reminders for WooCommerce subscriptions-renewal-reminders allows Cross Site Request Forgery.This issue affects Subscription Renewal Reminders for WooCommerce: from n/a through <= 1.4.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/subscriptions-renewal-reminders/vulnerability/wordpress-subscription-renewal-reminders-for-woocommerce-plugin-1-3-7-cross-site-request-forgery-to-notice-dismissal-vulnerability?_s_id=cve
CVE: CVE-2025-28985
Published: 2025-06-06
Description: Missing Authorization vulnerability in Elastic Email Elastic Email Subscribe Form elastic-email-subscribe-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elastic Email Subscribe Form: from n/a through <= 1.2.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/elastic-email-subscribe-form/vulnerability/wordpress-elastic-email-subscribe-form-1-2-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-28986
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Webaholicson Epicwin Plugin epicwin-subscribers allows SQL Injection.This issue affects Epicwin Plugin: from n/a through <= 1.5.
CVSS Score: 8.2 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/epicwin-subscribers/vulnerability/wordpress-epicwin-plugin-plugin-1-5-csrf-to-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-28989
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arildur Read More Login read-more-login allows Stored XSS.This issue affects Read More Login: from n/a through <= 2.0.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/read-more-login/vulnerability/wordpress-read-more-login-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28994
Published: 2025-06-06
Description: Missing Authorization vulnerability in viralloops Viral Loops WP Integration viral-loops-wp-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Viral Loops WP Integration: from n/a through <= 3.8.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/viral-loops-wp-integration/vulnerability/wordpress-viral-loops-wp-integration-3-8-1-broken-access-control-vulnerability-2?_s_id=cve
CVE: CVE-2025-28995
Published: 2025-06-06
Description: Missing Authorization vulnerability in viralloops Viral Loops WP Integration viral-loops-wp-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Viral Loops WP Integration: from n/a through <= 3.8.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/viral-loops-wp-integration/vulnerability/wordpress-viral-loops-wp-integration-3-8-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-28996
Published: 2025-06-06
Description: Missing Authorization vulnerability in Thad Allender GPP Slideshow gpp-slideshow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GPP Slideshow: from n/a through <= 1.3.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/gpp-slideshow/vulnerability/wordpress-gpp-slideshow-1-3-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-28997
Published: 2025-06-06
Description: Missing Authorization vulnerability in EXEIdeas International WP AutoKeyword wp-autokeyword allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP AutoKeyword: from n/a through <= 1.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-autokeyword/vulnerability/wordpress-wp-autokeyword-1-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-29003
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mva7 The Holiday Calendar the-holiday-calendar allows Stored XSS.This issue affects The Holiday Calendar: from n/a through <= 1.18.2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/the-holiday-calendar/vulnerability/wordpress-the-holiday-calendar-1-18-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-29005
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Cross Site Request Forgery.This issue affects HR Management Lite: from n/a through <= 3.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/hr-management-lite/vulnerability/wordpress-hr-management-lite-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-29006
Published: 2025-06-06
Description: Missing Authorization vulnerability in centangle Direct Checkout for WooCommerce Lite woo-direct-checkout-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Direct Checkout for WooCommerce Lite: from n/a through <= 1.0.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/woo-direct-checkout-lite/vulnerability/wordpress-direct-checkout-for-woocommerce-lite-1-0-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-29008
Published: 2025-06-06
Description: Server-Side Request Forgery (SSRF) vulnerability in ShawonPro SocialMark socialmark allows Server Side Request Forgery.This issue affects SocialMark: from n/a through <= 2.0.7.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/socialmark/vulnerability/wordpress-socialmark-2-0-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-29010
Published: 2025-06-06
Description: Missing Authorization vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/portfolio-manager-powered-by-behance/vulnerability/wordpress-behance-portfolio-manager-1-7-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-29011
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CHR Designer YouTube Simple Gallery youtube-simple-gallery allows Stored XSS.This issue affects YouTube Simple Gallery: from n/a through <= 2.2.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/youtube-simple-gallery/vulnerability/wordpress-youtube-simple-gallery-2-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-29013
Published: 2025-06-06
Description: Missing Authorization vulnerability in faaiq Custom Category/Post Type Post order custom-post-order-category allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Category/Post Type Post order: from n/a through <= 1.6.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/custom-post-order-category/vulnerability/wordpress-custom-category-post-type-post-order-1-5-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-30624
Published: 2025-06-06
Description: Missing Authorization vulnerability in WordLift WordLift wordlift allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordLift: from n/a through <= 3.54.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wordlift/vulnerability/wordpress-wordlift-3-54-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-30625
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Pramschufer AppBanners appbanners allows Stored XSS.This issue affects AppBanners: from n/a through <= 1.5.14.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/appbanners/vulnerability/wordpress-appbanners-1-5-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30627
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in regolithsjk Elegant Visitor Counter elegant-visitor-counter allows Stored XSS.This issue affects Elegant Visitor Counter: from n/a through <= 3.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/elegant-visitor-counter/vulnerability/wordpress-elegant-visitor-counter-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30629
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Codehaveli Bitly URL Shortener codehaveli-bitly-url-shortener allows Cross Site Request Forgery.This issue affects Bitly URL Shortener: from n/a through <= 1.4.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/codehaveli-bitly-url-shortener/vulnerability/wordpress-bitly-url-shortener-1-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-30630
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pozzad Global Translator global-translator allows Stored XSS.This issue affects Global Translator: from n/a through <= 2.0.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/global-translator/vulnerability/wordpress-global-translator-2-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30632
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in pozzad Global Translator global-translator allows Cross Site Request Forgery.This issue affects Global Translator: from n/a through <= 2.0.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/global-translator/vulnerability/wordpress-global-translator-2-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-30634
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IWEBIX WP Featured Content Slider wp-featured-content-slider allows Stored XSS.This issue affects WP Featured Content Slider: from n/a through <= 2.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-featured-content-slider/vulnerability/wordpress-wp-featured-content-slider-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30636
Published: 2025-06-06
Description: Missing Authorization vulnerability in Ability, Inc Accessibility Suite online-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Suite: from n/a through <= 4.19.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/online-accessibility/vulnerability/wordpress-accessibility-suite-4-19-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-30637
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Stored XSS.This issue affects Booking Ultra Pro: from n/a through <= 1.1.20.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/booking-ultra-pro/vulnerability/wordpress-booking-ultra-pro-1-1-20-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30638
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PowieT Powie's Uptime Robot powies-uptime-robot allows Stored XSS.This issue affects Powie's Uptime Robot: from n/a through <= 0.9.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/powies-uptime-robot/vulnerability/wordpress-powie-s-uptime-robot-0-9-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30927
Published: 2025-06-06
Description: Missing Authorization vulnerability in Wordapp Team Wordapp wordapp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wordapp: from n/a through <= 1.7.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wordapp/vulnerability/wordpress-wordapp-1-7-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-30928
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vicchi WP Biographia wp-biographia allows Stored XSS.This issue affects WP Biographia: from n/a through <= 4.0.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-biographia/vulnerability/wordpress-wp-biographia-4-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30930
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unreal Themes ACF: Yandex Maps Field acf-yandex-maps-field allows Stored XSS.This issue affects ACF: Yandex Maps Field: from n/a through <= 1.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/acf-yandex-maps-field/vulnerability/wordpress-acf-yandex-maps-field-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30931
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamil Shafeev «Подсказки» от DaData.ru dadata-ru allows Stored XSS.This issue affects «Подсказки» от DaData.ru: from n/a through <= 1.0.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/dadata-ru/vulnerability/wordpress-podskazki-ot-dadata-ru-1-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30932
Published: 2025-06-06
Description: Missing Authorization vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Compress for MainWP: from n/a through <= 6.30.32.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-compress-mainwp/vulnerability/wordpress-wp-compress-for-mainwp-6-30-32-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-30934
Published: 2025-06-06
Description: Missing Authorization vulnerability in OLIVESYSTEM 診断ジェネレータ作成プラグイン os-diagnosis-generator allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 診断ジェネレータ作成プラグイン: from n/a through <= 1.4.16.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/os-diagnosis-generator/vulnerability/wordpress-1-4-16-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-30935
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NickDuncan Contact Form contact-form-ready allows DOM-Based XSS.This issue affects Contact Form: from n/a through <= 2.0.12.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/contact-form-ready/vulnerability/wordpress-contact-form-2-0-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30937
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stefanledin Responsify WP responsify-wp allows Stored XSS.This issue affects Responsify WP: from n/a through <= 1.9.11.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/responsify-wp/vulnerability/wordpress-responsify-wp-1-9-11-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30938
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in broadly Broadly for WordPress broadly allows Stored XSS.This issue affects Broadly for WordPress: from n/a through <= 3.0.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/broadly/vulnerability/wordpress-broadly-for-wordpress-3-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30939
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Debashish IFrame Widget iframe-widget allows Stored XSS.This issue affects IFrame Widget: from n/a through <= 4.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/iframe-widget/vulnerability/wordpress-iframe-widget-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30940
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in melipayamak Melipayamak melipayamak allows Stored XSS.This issue affects Melipayamak: from n/a through <= 2.2.12.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/melipayamak/vulnerability/wordpress-melipayamak-2-2-12-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30941
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marvie Pons Pinterest Verify Meta Tag pinterest-verify-meta-tag allows Stored XSS.This issue affects Pinterest Verify Meta Tag: from n/a through <= 1.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/pinterest-verify-meta-tag/vulnerability/wordpress-pinterest-verify-meta-tag-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30942
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes  Post Custom Templates Lite post-custom-templates-lite allows Stored XSS.This issue affects  Post Custom Templates Lite: from n/a through <= 1.14.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/post-custom-templates-lite/vulnerability/wordpress-post-custom-templates-lite-1-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30945
Published: 2025-06-06
Description: Missing Authorization vulnerability in taskbuilder Taskbuilder taskbuilder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Taskbuilder: from n/a through <= 4.0.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/taskbuilder/vulnerability/wordpress-taskbuilder-4-0-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-30946
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Michael Cannon Custom Bulk/Quick Edit custom-bulkquick-edit allows Cross Site Request Forgery.This issue affects Custom Bulk/Quick Edit: from n/a through <= 1.6.10.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/custom-bulkquick-edit/vulnerability/wordpress-custom-bulk-quick-edit-1-6-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-30948
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Giraphix Creative Layouts for Elementor layouts-for-elementor allows Cross Site Request Forgery.This issue affects Layouts for Elementor: from n/a through <= 1.11.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/layouts-for-elementor/vulnerability/wordpress-layouts-for-elementor-1-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-30950
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham All Currencies for WooCommerce woocommerce-all-currencies allows Stored XSS.This issue affects All Currencies for WooCommerce: from n/a through <= 2.4.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-all-currencies/vulnerability/wordpress-all-currencies-for-woocommerce-2-4-4-cross-site-scripting-xss-vulnerability?_s_id=cve