deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-27646
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Edit User Account Exposure V-2024-001.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27647
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Addition of Partial Admin Users Without Authentication V-2024-002.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27648
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Cross Tenant Password Exposure V-2024-003.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27649
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.893 Application 20.0.2140 allows Incorrect Access Control: PHP V-2023-016.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27650
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Private Keys in Docker Overlay V-2023-013.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27651
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: Elatec V-2023-014.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27652
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: rfIDEAS V-2023-015.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27653
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Preauthenticated Cross Site Scripting (XSS): Badge Registration V-2023-012.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27654
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Cross Site Scripting (XSS) V-2023-017.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27655
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: CPA v1 V-2023-009.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27656
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Password Stored in Process List V-2023-011.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-256
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27657
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Remote Code Execution V-2023-008.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27658
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Authentication Bypass OVE-20[PII_REDACTED].
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
CVE: CVE-2025-27659
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows SQL Injection OVE-20[PII_REDACTED].
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
CVE: CVE-2025-27660
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross Site Scripting OVE-20[PII_REDACTED].
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
CVE: CVE-2025-27661
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Session Fixation OVE-20[PII_REDACTED].
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-384
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
CVE: CVE-2025-27662
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Password in URL OVE-20[PII_REDACTED].
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-256
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
CVE: CVE-2025-27663
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Weak Password Encryption / Encoding OVE-20[PII_REDACTED].
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
CVE: CVE-2025-27664
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient CSRF Protection OVE-20[PII_REDACTED].
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
CVE: CVE-2025-27665
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Antivirus Protection and thus drivers can have known malicious code OVE-20[PII_REDACTED].
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-693
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
CVE: CVE-2025-27666
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Authorization Checks OVE-20[PII_REDACTED].
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
CVE: CVE-2025-27667
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Administrative User Email Enumeration OVE-20[PII_REDACTED].
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-203
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
CVE: CVE-2025-27668
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Arbitrary Content Inclusion via Iframe OVE-20[PII_REDACTED].
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-829
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
CVE: CVE-2025-27669
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Remote Network Scanning (XSPA)/DoS OVE-20[PII_REDACTED].
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
CVE: CVE-2025-27670
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Signature Validation OVE-20[PII_REDACTED].
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-347
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
CVE: CVE-2025-27671
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Device Impersonation OVE-20[PII_REDACTED].
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-290
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
CVE: CVE-2025-27672
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows OAUTH Security Bypass OVE-20[PII_REDACTED].
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
CVE: CVE-2025-27673
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cookie Returned in Response Body OVE-20[PII_REDACTED].
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-539
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm
CVE: CVE-2025-27674
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Hardcoded IdP Key V-2023-006.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-321
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27675
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Vulnerable OpenID Implementation V-2023-004.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27676
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross-Site Scripting in Reports V-2023-002.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27677
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Symbolic Links For Unprivileged File Interaction V-2022-002.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27678
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Client Remote Code Execution V-2023-001.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27679
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross-Site Scripting in Badge Registration V-2023-005.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27680
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.750 Application 20.0.1442 allows Insecure Firmware Image with Insufficient Verification of Data Authenticity V-2024-004.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-345
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27681
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 mishandles Client Inter-process Security V-2022-004.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-602
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27682
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Insecure Log Permissions V-2022-005.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27683
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Driver Unrestricted Upload of File with Dangerous Type V-2022-006.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27684
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Debug Bundle Contains Sensitive Data V-2022-003.
CVSS Score: 7.5 (HIGH)
CWE: CWE-215
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-27685
Published: 2025-03-05
Description: Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Configuration File Contains CA & Private Key V-2022-001.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm; https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html; http://seclists.org/fulldisclosure/2025/Apr/18
CVE: CVE-2025-1393
Published: 2025-03-05
Description: An unauthenticated remote attacker can use hard-coded credentials to gain full administration privileges on the affected product.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://certvde.com/en/advisories/VDE-2025-021
CVE: CVE-2024-13350
Published: 2025-03-05
Description: The SearchIQ – The Search Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siq_searchbox' shortcode in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3251250/; https://www.wordfence.com/threat-intel/vulnerabilities/id/a04f074c-448d-4c5f-ae46-0ad1a3effdb4?source=cve
CVE: CVE-2024-13827
Published: 2025-03-05
Description: The Razorpay Subscription Button Elementor Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg() and remove_query_arg() functions without appropriate escaping on the URL in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/razorpay-subscription-button-elementor/tags/1.0.3/includes/rzp-payment-buttons.php#L78; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3254569%40razorpay-subscription-button-elementor%2Ftrunk&old=2749051%40razorpay-subscription-button-elementor%2Ftrunk; https://wordpress.org/plugins/razorpay-subscription-button-elementor/#developers
CVE: CVE-2024-13866
Published: 2025-03-05
Description: The Simple Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/simple-notification/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/e814f798-5ebc-4bea-838f-d0a803f9bdbc?source=cve
CVE: CVE-2024-8682
Published: 2025-03-05
Description: The JNews - WordPress Newspaper Magazine Blog AMP Theme theme for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 11.6.6. This is due to the plugin not properly validate if the user can register option is enabled prior to creating a user though the register_handler() function. This makes it possible for unauthenticated attackers to register as a user even when user registration is disabled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://themeforest.net/item/jnews-one-stop-solution-for-web-publishing/20566392; https://www.wordfence.com/threat-intel/vulnerabilities/id/4b0d7ee7-a358-4487-a0cc-31ed810ae8bc?source=cve
CVE: CVE-2025-0990
Published: 2025-03-05
Description: The I Am Gloria plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.4. This is due to missing or incorrect nonce validation on the iamgloria23_gloria_settings_page function. This makes it possible for unauthenticated attackers to reset the tenant ID via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wordpress.org/plugins/gloria-assistant-by-webtronic-labs/; https://www.wordfence.com/threat-intel/vulnerabilities/id/33fd44dc-b4f8-4429-8dcd-5161602bb318?source=cve
CVE: CVE-2025-1008
Published: 2025-03-05
Description: The Recently Purchased Products For Woo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘view’ parameter in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/recently-purchased-products-for-woo/tags/1.1.3/includes/class-rppw-public.php#L160; https://plugins.trac.wordpress.org/changeset/3250357/; https://wordpress.org/plugins/recently-purchased-products-for-woo/#developers
CVE: CVE-2025-1435
Published: 2025-03-05
Description: The bbPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.11. This is due to missing or incorrect nonce validation on the bbp_user_add_role_on_register() function. This makes it possible for unauthenticated attackers to elevate their privileges to that of a bbPress Keymaster via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Rather than implementing a nonce check to provide protection against this vulnerability, which would break functionality, the plugin no longer makes it possible to select a role during registration.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/bbpress/trunk/includes/users/signups.php#L151; https://plugins.trac.wordpress.org/changeset/3247345/bbpress/branches/2.6/includes/users/capabilities.php; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3247345%40bbpress&new=3247345%40bbpress&sfp_email=&sfph_mail=
CVE: CVE-2025-22493
Published: 2025-03-05
Description: Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software (FRS). Absence of this secure flag could lead into the session cookie being transmitted over unencrypted HTTP connections. This security issue has been resolved in the latest version of FRS v1.5.100.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-319
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2024-1009.pdf
CVE: CVE-2024-11731
Published: 2025-03-05
Description: The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ms_slider shortcode in all versions up to, and including, 3.10.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This issue was partially fixed in version 3.10.8.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/master-slider/tags/3.10.8/includes/msp-shortcodes.php#L526; https://plugins.trac.wordpress.org/changeset/3288436; https://wordpress.org/plugins/master-slider/#developers