deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-58179
Published: 2025-09-05
Description: Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URLs it receives, allowing content from unauthorized third-party domains to be served. a A bug in impacted versions of the @astrojs/cloudflare adapter for deployment on Cloudflare’s infrastructure, allows an attacker to bypass the third-party domain restrictions and serve any content from the vulnerable origin. This issue is fixed in version 12.6.6.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://github.com/withastro/astro/commit/9ecf3598e2b29dd74614328fde3047ea90e67252; https://github.com/withastro/astro/security/advisories/GHSA-qpr4-c339-7vq8
CVE: CVE-2025-58352
Published: 2025-09-05
Description: Weblate is a web based localization tool. Versions lower than 5.13.1 contain a vulnerability that causes long session expiry during the  second factor verification. The long session expiry could be used to circumvent rate limiting of the second factor. This issue is fixed in version 5.13.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-613
References: https://github.com/WeblateOrg/weblate/commit/0b46fe596231dd456283ead66699ae5516f23908; https://github.com/WeblateOrg/weblate/pull/16002; https://github.com/WeblateOrg/weblate/security/advisories/GHSA-377j-wj38-4728
CVE: CVE-2025-58359
Published: 2025-09-05
Description: ZF FROST is a Rust implementation of FROST (Flexible Round-Optimised Schnorr Threshold signatures). In versions 2.0.0 through 2.1.0, refresh shares with smaller min_signers will reduce security of group. The inability to change min_signers (i.e. the threshold) with the refresh share functionality (frost_core::keys::refresh module) was not made clear to users. Using a smaller value would not decrease the threshold, and attempts to sign using a smaller threshold would fail. Additionally, after refreshing the shares with a smaller threshold, it would still be possible to sign with the original threshold, potentially causing a security loss to the participant's shares. This issue is fixed in version 2.2.0.
CWE: CWE-325
References: https://github.com/ZcashFoundation/frost/commit/379ef689c733b3d9c80fd409071d4f3af4dafed2; https://github.com/ZcashFoundation/frost/releases/tag/frost-core%2Fv2.2.0; https://github.com/ZcashFoundation/frost/security/advisories/GHSA-wgq8-vr6r-mqxm
CVE: CVE-2025-58362
Published: 2025-09-05
Description: Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility function which could allow path confusion and potential bypass of proxy-level ACLs (e.g. Nginx location blocks). The original implementation relied on fixed character offsets when parsing request URLs. Under certain malformed absolute-form Request-URIs, this could lead to incorrect path extraction depending on the application and environment. If proxy ACLs are used to protect sensitive endpoints such as /admin, this flaw could have allowed unauthorized access. The confidentiality impact depends on what data is exposed: if sensitive administrative data is exposed, the impact may be high, otherwise it may be moderate. This issue is fixed in version 4.9.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-706
References: https://github.com/honojs/hono/commit/1d79aedc3f82d8c9969b115fe61bc4bd705ec8de; https://github.com/honojs/hono/releases/tag/v4.9.6; https://github.com/honojs/hono/security/advisories/GHSA-9hp6-4448-45g2
CVE: CVE-2025-7445
Published: 2025-09-05
Description: Kubernetes secrets-store-sync-controller in versions before 0.0.2 discloses service account tokens in logs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://github.com/kubernetes/kubernetes/issues/133897; https://groups.google.com/g/kubernetes-security-announce/c/NP7cQvQ1aGA
CVE: CVE-2025-9990
Published: 2025-09-05
Description: The WordPress Helpdesk Integration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.8.10 via the portal_type parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://plugins.svn.wordpress.org/wp-helpdesk-integration/trunk/index.php; https://plugins.trac.wordpress.org/browser/wp-helpdesk-integration/trunk/index.php#L85; https://www.wordfence.com/threat-intel/vulnerabilities/id/49a935cc-7b95-4abd-9a4d-c7e14c765863?source=cve
CVE: CVE-2025-8684
Published: 2025-09-05
Description: The Flatsome Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's shortcodes in all versions up to, and including, 3.20.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://themeforest.net/item/flatsome-multipurpose-responsive-woocommerce-theme/5484319#item-description__change-log; https://www.wordfence.com/threat-intel/vulnerabilities/id/ffc82708-b04d-4fba-9a79-594ad25dc965?source=cve
CVE: CVE-2025-58401
Published: 2025-09-05
Description: Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form. As a result, an attacker may perform unauthorized operations on the linked Github account.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-312
References: https://github.com/Pierrad/obsidian-github-copilot/releases/tag/1.1.7; https://jvn.jp/en/jp/JVN41633999/
CVE: CVE-2025-41408
Published: 2025-09-05
Description: Improper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for Android versions prior to 14.15.0 allows a remote unauthenticated attacker may lead a user to access an arbitrary website on the vulnerable App. As a result, the user may become a victim of a phishing attack.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-939
References: https://jvn.jp/en/jp/JVN35290164/
CVE: CVE-2025-55037
Published: 2025-09-05
Description: Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote unauthenticated attacker if the settings are configured to construct messages from external sources.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/kujirahand/tkeasygui-python/releases/tag/v1.0.22; https://jvn.jp/en/jp/JVN48739895/
CVE: CVE-2025-55671
Published: 2025-09-05
Description: Uncontrolled search path element issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, arbitrary code may be executed with the privilege of running the program.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/kujirahand/tkeasygui-python/releases/tag/v1.0.22; https://jvn.jp/en/jp/JVN48739895/
CVE: CVE-2025-58400
Published: 2025-09-05
Description: RATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc. registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-428
References: https://jvn.jp/en/jp/JVN98737186/; https://www.ratocsystems.com/dlsoft/dlsoft_storage/dlsoft_hddcase/raidmanager/; https://www.ratocsystems.com/topics/userinfo/raidmanager202508/
CVE: CVE-2025-8944
Published: 2025-09-05
Description: The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod` setting.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://wpscan.com/vulnerability/cf77b7f2-525b-4fe8-b612-185a1c18c197/
CVE: CVE-2025-48395
Published: 2025-09-05
Description: An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI. This security issue has been fixed in the latest version of NMC G2 which is available on the Eaton download center.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-22
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1003.pdf
CVE: CVE-2025-58276
Published: 2025-09-05
Description: Permission verification vulnerability in the home screen module
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2025/9/
CVE: CVE-2025-58280
Published: 2025-09-05
Description: Vulnerability of exposing object heap addresses in the Ark eTS module.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 8.4 (HIGH)
CWE: CWE-1321
References: https://consumer.huawei.com/en/support/bulletin/2025/9/
CVE: CVE-2025-58281
Published: 2025-09-05
Description: Out-of-bounds read vulnerability in the runtime interpreter module.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 8.4 (HIGH)
CWE: CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2025/9/
CVE: CVE-2025-58296
Published: 2025-09-05
Description: Race condition vulnerability in the audio module.
Impact: Successful exploitation of this vulnerability may affect function stability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2025/9/
CVE: CVE-2025-58313
Published: 2025-09-05
Description: Race condition vulnerability in the device standby module.
Impact: Successful exploitation of this vulnerability may cause feature exceptions of the device standby module.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2025/9/
CVE: CVE-2024-21977
Published: 2025-09-05
Description: Incomplete cleanup after loading a CPU microcode patch may allow a privileged attacker to degrade the entropy of the RDRAND instruction, potentially resulting in loss of integrity for SEV-SNP guests.
CVSS Score: 3.2 (LOW)
CWE: CWE-459
References: https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3014.html; https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4012.html; https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5007.html
CVE: CVE-2025-10011
Published: 2025-09-05
Description: A weakness has been identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /module/TabelaArredondamento/edit. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-74
References: https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-10011.md; https://github.com/marcelomulder/CVE/blob/main/i-educar/SQL%20Injection%20(Blind%20Time-Based)%20Vulnerability%20in%20%60id%60%20Parameter%20on%20%60.module.TabelaArredondamento.edit%60%20Endpoint.md; https://vuldb.com/?ctiid.322736
CVE: CVE-2025-58783
Published: 2025-09-05
Description: Missing Authorization vulnerability in gutentor Gutentor gutentor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutentor: from n/a through <= 3.5.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/gutentor/vulnerability/wordpress-gutentor-plugin-3-5-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58784
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arisoft ARI Fancy Lightbox ari-fancy-lightbox allows Stored XSS.This issue affects ARI Fancy Lightbox: from n/a through <= 1.4.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ari-fancy-lightbox/vulnerability/wordpress-ari-fancy-lightbox-plugin-1-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58785
Published: 2025-09-05
Description: Missing Authorization vulnerability in Jiro Sasamoto Ray Enterprise Translation lingotek-translation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ray Enterprise Translation: from n/a through <= 1.7.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/lingotek-translation/vulnerability/wordpress-ray-enterprise-translation-plugin-1-7-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-58786
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VW THEMES Ibtana – Ecommerce Product Addons ibtana-ecommerce-product-addons allows DOM-Based XSS.This issue affects Ibtana – Ecommerce Product Addons: from n/a through <= 0.4.7.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ibtana-ecommerce-product-addons/vulnerability/wordpress-ibtana-ecommerce-product-addons-plugin-0-4-7-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58787
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Popup themify-popup allows Stored XSS.This issue affects Themify Popup: from n/a through <= 1.4.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/themify-popup/vulnerability/wordpress-themify-popup-plugin-1-4-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58788
Published: 2025-09-05
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal License Manager for WooCommerce license-manager-for-woocommerce allows Blind SQL Injection.This issue affects License Manager for WooCommerce: from n/a through <= 3.0.12.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/license-manager-for-woocommerce/vulnerability/wordpress-license-manager-for-woocommerce-plugin-3-0-12-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-58789
Published: 2025-09-05
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle WP Full Stripe Free wp-full-stripe-free allows SQL Injection.This issue affects WP Full Stripe Free: from n/a through <= 8.2.5.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-full-stripe-free/vulnerability/wordpress-wp-full-stripe-free-plugin-8-3-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-58790
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKube Kiwi kiwi-social-share allows Stored XSS.This issue affects Kiwi: from n/a through <= 2.1.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/kiwi-social-share/vulnerability/wordpress-kiwi-plugin-2-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58791
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arjan Olsder SEO Auto Linker wpa-seo-auto-linker allows Stored XSS.This issue affects SEO Auto Linker: from n/a through <= 1.5.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpa-seo-auto-linker/vulnerability/wordpress-seo-auto-linker-plugin-1-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58792
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in WPKube Authors List authors-list allows Cross Site Request Forgery.This issue affects Authors List: from n/a through <= 2.0.6.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/authors-list/vulnerability/wordpress-authors-list-plugin-2-0-6-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58793
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean WPB Elementor Addons wpb-elementor-addons allows Stored XSS.This issue affects WPB Elementor Addons: from n/a through <= 1.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpb-elementor-addons/vulnerability/wordpress-wpb-elementor-addons-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58794
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Cross Site Request Forgery.This issue affects Notification for Telegram: from n/a through <= 3.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/notification-for-telegram/vulnerability/wordpress-notification-for-telegram-plugin-3-4-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58795
Published: 2025-09-05
Description: Missing Authorization vulnerability in Payoneer Checkout Payoneer Checkout payoneer-checkout allows Content Spoofing.This issue affects Payoneer Checkout: from n/a through <= 3.4.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/payoneer-checkout/vulnerability/wordpress-payoneer-checkout-plugin-3-4-0-content-spoofing-vulnerability?_s_id=cve
CVE: CVE-2025-58796
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dudaster Elementor Element Condition ele-conditions allows Stored XSS.This issue affects Elementor Element Condition: from n/a through <= 1.0.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ele-conditions/vulnerability/wordpress-elementor-element-condition-plugin-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58797
Published: 2025-09-05
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Mahmudul Hasan Arif Ninja Charts ninja-charts allows Retrieve Embedded Sensitive Data.This issue affects Ninja Charts: from n/a through <= 3.3.5.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/ninja-charts/vulnerability/wordpress-ninja-charts-plugin-3-3-2-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-58798
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in Bjorn Manintveld BCM Duplicate Menu bcm-duplicate-menu allows Cross Site Request Forgery.This issue affects BCM Duplicate Menu: from n/a through <= 1.1.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/bcm-duplicate-menu/vulnerability/wordpress-bcm-duplicate-menu-plugin-1-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58799
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in themelocation Custom WooCommerce Checkout Fields Editor add-fields-to-checkout-page-woocommerce allows Cross Site Request Forgery.This issue affects Custom WooCommerce Checkout Fields Editor: from n/a through <= 1.3.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/add-fields-to-checkout-page-woocommerce/vulnerability/wordpress-custom-woocommerce-checkout-fields-editor-plugin-1-3-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58800
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in Steve Truman WP Email Template wp-email-template allows Cross Site Request Forgery.This issue affects WP Email Template: from n/a through <= 2.8.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-email-template/vulnerability/wordpress-wp-email-template-plugin-2-8-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58801
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in KCS Responder responder allows Cross Site Request Forgery.This issue affects Responder: from n/a through <= 4.3.8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/responder/vulnerability/wordpress-responder-plugin-4-3-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58802
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in michalzagdan TrustMate.io – WooCommerce integration trustmate-io-integration-for-woocommerce allows Cross Site Request Forgery.This issue affects TrustMate.io – WooCommerce integration: from n/a through <= 1.16.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/trustmate-io-integration-for-woocommerce/vulnerability/wordpress-trustmate-io-woocommerce-integration-plugin-1-14-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58804
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in brijrajs WooCommerce Single Page Checkout woo-single-page-checkout allows Cross Site Request Forgery.This issue affects WooCommerce Single Page Checkout: from n/a through <= 1.2.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/woo-single-page-checkout/vulnerability/wordpress-woocommerce-single-page-checkout-plugin-1-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58805
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light allows Stored XSS.This issue affects Widgetize Pages Light: from n/a through <= 3.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/widgetize-pages-light/vulnerability/wordpress-widgetize-pages-light-plugin-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-58806
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in Tom Longridge WordPress Error Monitoring by Bugsnag bugsnag allows Stored XSS.This issue affects WordPress Error Monitoring by Bugsnag: from n/a through <= 1.6.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/bugsnag/vulnerability/wordpress-wordpress-error-monitoring-by-bugsnag-plugin-1-6-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58807
Published: 2025-09-05
Description: Cross-Site Request Forgery (CSRF) vulnerability in Dsingh Purge Varnish Cache purge-varnish allows Stored XSS.This issue affects Purge Varnish Cache: from n/a through <= 2.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/purge-varnish/vulnerability/wordpress-purge-varnish-cache-plugin-2-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-58808
Published: 2025-09-05
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Babar prettyPhoto prettyphoto allows Stored XSS.This issue affects prettyPhoto: from n/a through <= 1.2.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/prettyphoto/vulnerability/wordpress-prettyphoto-plugin-1-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve