deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-39377
Published: 2025-04-24
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Appsero Helper appsero-helper allows SQL Injection.This issue affects Appsero Helper: from n/a through <= 1.3.4.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/appsero-helper/vulnerability/wordpress-appsero-helper-plugin-1-3-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-39378
Published: 2025-04-24
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows PHP Local File Inclusion.This issue affects Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light: from n/a through <= 2.4.37.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/vulnerability/wordpress-spreadsheet-price-changer-for-woocommerce-and-wp-e-commerce-light-plugin-2-4-37-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39379
Published: 2025-04-24
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Capturly Capturly capturly-optimize-your-website allows PHP Local File Inclusion.This issue affects Capturly: from n/a through <= 2.0.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/capturly-optimize-your-website/vulnerability/wordpress-capturly-plugin-2-0-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39381
Published: 2025-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Kiotviet KiotViet Sync allows Stored XSS. This issue affects KiotViet Sync: from n/a through 1.8.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/wordpress/plugin/kiotvietsync/vulnerability/wordpress-kiotviet-sync-plugin-1-8-4-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39382
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in danielpataki ACF: Google Font Selector acf-google-font-selector-field allows Reflected XSS.This issue affects ACF: Google Font Selector: from n/a through <= 3.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/acf-google-font-selector-field/vulnerability/wordpress-acf-google-font-selector-plugin-3-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39383
Published: 2025-04-24
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codeworkweb Xews Lite xews-lite allows PHP Local File Inclusion.This issue affects Xews Lite: from n/a through <= 1.0.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/xews-lite/vulnerability/wordpress-xews-lite-plugin-1-0-9-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39384
Published: 2025-04-24
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cedcommerce Product Lister for eBay product-lister-ebay allows PHP Local File Inclusion.This issue affects Product Lister for eBay: from n/a through <= 2.0.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/product-lister-ebay/vulnerability/wordpress-product-lister-for-ebay-plugin-2-0-9-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39385
Published: 2025-04-24
Description: Missing Authorization vulnerability in vowelweb Sirat sirat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sirat: from n/a through <= 1.5.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/sirat/vulnerability/wordpress-sirat-theme-1-5-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-39387
Published: 2025-04-24
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpoperations Opstore opstore allows PHP Local File Inclusion.This issue affects Opstore: from n/a through <= 1.4.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/opstore/vulnerability/wordpress-opstore-theme-1-4-5-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39390
Published: 2025-04-24
Description: Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booking and Rental Manager: from n/a through <= 2.3.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/booking-and-rental-manager-for-woocommerce/vulnerability/wordpress-booking-and-rental-manager-plugin-2-3-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-39391
Published: 2025-04-24
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zamartz Checkout Field Visibility for WooCommerce checkout-field-visibility-for-woocommerce allows PHP Local File Inclusion.This issue affects Checkout Field Visibility for WooCommerce: from n/a through <= 1.3.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/checkout-field-visibility-for-woocommerce/vulnerability/wordpress-checkout-field-visibility-for-woocommerce-plugin-1-2-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39397
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus@hotmail.com Anything Popup anything-popup allows Reflected XSS.This issue affects Anything Popup: from n/a through <= 7.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/anything-popup/vulnerability/wordpress-anything-popup-plugin-7-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39399
Published: 2025-04-24
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ashraful Sarkar Naiem License For Envato license-envato allows PHP Local File Inclusion.This issue affects License For Envato: from n/a through <= 1.0.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/license-envato/vulnerability/wordpress-license-for-envato-plugin-1-0-0-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39400
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Reflected XSS.This issue affects User Registration: from n/a through < 4.2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/user-registration/vulnerability/wordpress-user-registration-plugin-4-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39404
Published: 2025-04-24
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Heateor Support Sassy Social Share sassy-social-share allows Phishing.This issue affects Sassy Social Share: from n/a through <= 3.3.73.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/sassy-social-share/vulnerability/wordpress-sassy-social-share-plugin-3-3-73-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2025-39408
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress BruteGuard – Brute Force Login Protection bruteguard allows Reflected XSS.This issue affects BruteGuard – Brute Force Login Protection: from n/a through <= 0.1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bruteguard/vulnerability/wordpress-bruteguard-brute-force-login-protection-plugin-0-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46230
Published: 2025-04-24
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in GhozyLab Popup Builder easy-notify-lite allows PHP Local File Inclusion.This issue affects Popup Builder: from n/a through <= 1.1.35.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/easy-notify-lite/vulnerability/wordpress-popup-builder-1-1-35-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-46234
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Habibur Rahman Razib Control Listings control-listings allows Reflected XSS.This issue affects Control Listings: from n/a through <= 1.0.4.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/control-listings/vulnerability/wordpress-control-listings-plugin-1-0-4-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46248
Published: 2025-04-24
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows SQL Injection.This issue affects Frontend Dashboard: from n/a through <= 2.2.5.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/frontend-dashboard/vulnerability/wordpress-frontend-dashboard-2-2-5-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-46260
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wowDevs Sky Addons for Elementor sky-elementor-addons allows Stored XSS.This issue affects Sky Addons for Elementor: from n/a through <= 3.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sky-elementor-addons/vulnerability/wordpress-sky-addons-for-elementor-plugin-3-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46261
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through <= 3.9.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/seriously-simple-podcasting/vulnerability/wordpress-seriously-simple-podcasting-plugin-3-9-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46264
Published: 2025-04-24
Description: Unrestricted Upload of File with Dangerous Type vulnerability in blubrry PowerPress Podcasting powerpress allows Upload a Web Shell to a Web Server.This issue affects PowerPress Podcasting: from n/a through <= 11.12.5.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/powerpress/vulnerability/wordpress-powerpress-podcasting-11-12-7-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-46435
Published: 2025-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Yash Binani Time Based Greeting time-based-greeting allows Stored XSS.This issue affects Time Based Greeting: from n/a through <= 2.2.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/time-based-greeting/vulnerability/wordpress-time-based-greeting-plugin-2-2-2-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46436
Published: 2025-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Sebastian Echeverry SCSS-Library scss-library allows Cross Site Request Forgery.This issue affects SCSS-Library: from n/a through <= 0.4.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/scss-library/vulnerability/wordpress-scss-library-0-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-46438
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in warmwhisky GTDB Guitar Tuners guitar-tuner allows Stored XSS.This issue affects GTDB Guitar Tuners: from n/a through <= 4.2.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/guitar-tuner/vulnerability/wordpress-gtdb-guitar-tuners-4-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46439
Published: 2025-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Vladimir Prelovac Plugin Central plugin-central allows Path Traversal.This issue affects Plugin Central: from n/a through <= 2.5.1.
CVSS Score: 7.4 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/plugin-central/vulnerability/wordpress-plugin-central-plugin-2-5-1-csrf-to-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-46442
Published: 2025-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Casey Johnson Loan Calculator repayment-calculator allows Stored XSS.This issue affects Loan Calculator: from n/a through <= 1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/repayment-calculator/vulnerability/wordpress-loan-calculator-plugin-1-3-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46443
Published: 2025-04-24
Description: Server-Side Request Forgery (SSRF) vulnerability in Adam Pery Animate animate allows Server Side Request Forgery.This issue affects Animate: from n/a through <= 0.5.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/animate/vulnerability/wordpress-animate-0-5-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-46445
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pReya External Markdown external-markdown allows Stored XSS.This issue affects External Markdown: from n/a through <= 0.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/external-markdown/vulnerability/wordpress-external-markdown-0-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46447
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFable Fable Extra fable-extra allows DOM-Based XSS.This issue affects Fable Extra: from n/a through <= 1.0.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/fable-extra/vulnerability/wordpress-fable-extra-1-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46449
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Novium WoWHead Tooltips wowhead-tooltips allows Stored XSS.This issue affects WoWHead Tooltips: from n/a through <= 2.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wowhead-tooltips/vulnerability/wordpress-wowhead-tooltips-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46450
Published: 2025-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in x000x occupancyplan occupancyplan allows Stored XSS.This issue affects occupancyplan: from n/a through <= 1.0.3.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/occupancyplan/vulnerability/wordpress-occupancyplan-plugin-1-0-3-0-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46451
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Floating Social Bar floating-social-bar allows Stored XSS.This issue affects Floating Social Bar: from n/a through <= 1.1.7.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/floating-social-bar/vulnerability/wordpress-floating-social-bar-1-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46452
Published: 2025-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Olav Kolbu Google News allows Stored XSS. This issue affects Google News: from n/a through 2.5.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/wordpress/plugin/google-news/vulnerability/wordpress-google-news-plugin-2-5-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46453
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreatorTeam Zoho Creator Forms allows Stored XSS. This issue affects Zoho Creator Forms: from n/a through 1.0.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/zohocreator/vulnerability/wordpress-zoho-creator-forms-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46457
Published: 2025-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Ahsanullah Akanda Wp Custom CMS Block wp-custom-cms-block allows Stored XSS.This issue affects Wp Custom CMS Block: from n/a through <= 2.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-custom-cms-block/vulnerability/wordpress-wp-custom-cms-block-plugin-2-1-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46459
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ralf Hortt Confirm User Registration confirm-user-registration allows Stored XSS.This issue affects Confirm User Registration: from n/a through <= 2.1.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/confirm-user-registration/vulnerability/wordpress-confirm-user-registration-2-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46461
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Relentless Apps RRSSB rrssb allows DOM-Based XSS.This issue affects RRSSB: from n/a through <= 1.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/rrssb/vulnerability/wordpress-rrssb-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46462
Published: 2025-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in Trân Minh-Quân WPVN wpvn-username-changer allows Cross Site Request Forgery.This issue affects WPVN: from n/a through <= 0.7.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wpvn-username-changer/vulnerability/wordpress-wpvn-0-7-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-46465
Published: 2025-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in John Weissberg Print Science Designer print-science-designer allows Stored XSS.This issue affects Print Science Designer: from n/a through <= 1.3.155.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/print-science-designer/vulnerability/wordpress-print-science-designer-plugin-1-3-155-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46466
Published: 2025-04-24
Description: Cross-Site Request Forgery (CSRF) vulnerability in felixtz Modern Polls modern-polls allows Stored XSS.This issue affects Modern Polls: from n/a through <= 1.0.10.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/modern-polls/vulnerability/wordpress-modern-polls-plugin-1-0-10-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46467
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rahendra Putra K™ RAphicon raphicon allows DOM-Based XSS.This issue affects RAphicon: from n/a through <= 2.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/raphicon/vulnerability/wordpress-raphicon-2-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46469
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Buddle Send From send-from allows Stored XSS.This issue affects Send From: from n/a through <= 2.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/send-from/vulnerability/wordpress-send-from-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46470
Published: 2025-04-24
Description: Missing Authorization vulnerability in Peter Raschendorfer Smart Hashtags [#hashtagger] hashtagger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Hashtags [#hashtagger]: from n/a through <= 7.2.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/hashtagger/vulnerability/wordpress-smart-hashtags-hashtagger-7-2-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-46471
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gnanavelshenll WP Custom Post Popup custom-post-popup allows DOM-Based XSS.This issue affects WP Custom Post Popup: from n/a through <= 1.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/custom-post-popup/vulnerability/wordpress-wp-custom-post-popup-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46472
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue affects The Pack Elementor addons: from n/a through <= 2.1.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/the-pack-addon/vulnerability/wordpress-the-pack-elementor-addons-2-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46473
Published: 2025-04-24
Description: Deserialization of Untrusted Data vulnerability in Prisna Social Counter social-counter allows Object Injection.This issue affects Social Counter: from n/a through <= 2.0.5.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/social-counter/vulnerability/wordpress-social-counter-2-0-5-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-46475
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Dolson Able Player ableplayer allows DOM-Based XSS.This issue affects Able Player: from n/a through <= 1.2.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ableplayer/vulnerability/wordpress-able-player-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-46476
Published: 2025-04-24
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nayon46 Awesome Wp Image Gallery awesome-wp-image-gallery allows Stored XSS.This issue affects Awesome Wp Image Gallery: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/awesome-wp-image-gallery/vulnerability/wordpress-awesome-wp-image-gallery-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve