deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-6705
Published: 2025-06-27
Description: A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. Specifically, the system’s build scripts were executed without proper isolation, potentially exposing a privileged token. This token enabled the publishing of new extension versions under any namespace, including those not controlled by an attacker. However, it did not permit deletion of existing extensions, overwriting of published versions, or access to administrative features of the registry.

The issue was reported on May 4, 2025, fully resolved by June 24, and followed by a comprehensive audit. No evidence of compromise was found, though 81 extensions were proactively deactivated as a precaution. The standard publishing process remained unaffected. Recommendations have been issued to mitigate similar risks in the future.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-653, CWE-913
References: https://github.com/EclipseFdn/publish-extensions/pull/881; https://open-vsx.org
CVE: CVE-2024-11739
Published: 2025-06-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Case Informatics Case ERP allows SQL Injection.This issue affects Case ERP: before V2.0.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0139
CVE: CVE-2025-50367
Published: 2025-06-27
Description: A stored blind XSS vulnerability exists in the Contact Page of the Phpgurukul Medical Card Generation System 1.0 mcgs/contact.php. The name field fails to properly sanitize user input, allowing an attacker to inject malicious JavaScript.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/1h3ll/CVEs/blob/main/BXSS-Medicalcard_Generations_System.md
CVE: CVE-2025-50369
Published: 2025-06-27
Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in the Manage Card functionality (/mcgs/admin/manage-card.php) of PHPGurukul Medical Card Generation System 1.0. The vulnerable endpoint allows an authorized admin to delete medical card records by sending a simple GET request without verifying the origin of the request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/1h3ll/CVEs/blob/main/CSRF-MANAGECARD_Medicalcard_Generations_System.md
CVE: CVE-2025-50370
Published: 2025-06-27
Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in the Inquiry Management functionality /mcgs/admin/readenq.php of the Phpgurukul Medical Card Generation System 1.0. The vulnerable endpoint allows an authenticated admin to delete inquiry records via a simple GET request, without requiring a CSRF token or validating the origin of the request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/1h3ll/CVEs/blob/main/CSRF-ReadEnquiry_Medicalcard_Generations_System.md
CVE: CVE-2024-12143
Published: 2025-06-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobilteg Mobile Informatics Mikro Hand Terminal - MikroDB allows SQL Injection.This issue affects Mikro Hand Terminal - MikroDB. 

NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0142
CVE: CVE-2024-12150
Published: 2025-06-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eron Software Wowwo CRM allows Blind SQL Injection.This issue affects Wowwo CRM. 

NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0141
CVE: CVE-2024-12364
Published: 2025-06-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mavi Yeşil Software Guest Tracking Software allows SQL Injection.This issue affects Guest Tracking Software. 

NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0140
CVE: CVE-2025-44557
Published: 2025-06-27
Description: A state machine transition flaw in the Bluetooth Low Energy (BLE) stack of Cypress PSoC4 v3.66 allows attackers to bypass the pairing process and authentication via a crafted pairing_failed packet.
CVSS Score: 8.1 (HIGH)
CWE: CWE-303
References: https://github.com/yangting111/BLE_TEST/blob/main/result/PoC/Cypress/Auth_bypass.md; https://www.infineon.com/cms/en/design-support/tools/sdk/psoc-software/psoc-4-components/psoc-creator-component-datasheet-bluetooth-low-energy-ble/
CVE: CVE-2025-44559
Published: 2025-06-27
Description: An issue in the Bluetooth Low Energy (BLE) stack of Realtek RTL8762E BLE SDK v1.4.0 allows attackers within Bluetooth range to cause a Denial of Service (DoS) via sending a specific sequence of crafted control packets.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://realtek.com; http://rtl8762e.com; https://github.com/yangting111/BLE_TEST/blob/main/result/PoC/Realtek/Cross-layer_Interaction_Deadlock.md
CVE: CVE-2025-46707
Published: 2025-06-27
Description: Software installed and running inside a Guest VM may override Firmware's state and gain access to the GPU.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-668
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2025-46708
Published: 2025-06-27
Description: Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-280
References: https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE: CVE-2025-52207
Published: 2025-06-27
Description: PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbitrary directory.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-23
References: https://github.com/mikopbx/Core/commit/3ee785429d3f1b33c9ab387ef4221127c9b8c5f3; https://www.mikopbx.com/
CVE: CVE-2025-6521
Published: 2025-06-27
Description: During the initial setup of the device the user connects to an access 
point broadcast by the Sight Bulb Pro. During the negotiation, AES 
Encryption keys are passed in cleartext. If captured, an attacker may be
 able to decrypt communications between the management app and the Sight
 Bulb Pro which may include sensitive information such as network 
credentials.
CVSS Score: 7.6 (HIGH)
CWE: CWE-327
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-177-02; https://www.trendmakerscares.com/Customer-Service-Hours
CVE: CVE-2025-53093
Published: 2025-06-27
Description: TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Starting in version 3.0.0 and prior to version 3.1.1, any user can insert arbitrary HTMLinto the DOM by inserting a payload into any allowed attribute of the `<tabber>` tag. Version 3.1.1 contains a patch for the bug.
CVSS Score: 8.6 (HIGH)
CWE: CWE-79, CWE-80
References: https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Components/TabberComponentTabs.php#L15-L31; https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/Tabber.php#L76; https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/blob/3a23b703ce36cfc4128e7921841f68230be4059a/includes/templates/Tabs.mustache#L1
CVE: CVE-2025-5310
Published: 2025-06-27
Description: Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented and unauthenticated target communication framework (TCF) interface on a specific port. Files can be created, deleted, or modified, potentially leading to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://ociocisa.sharepoint.com/teams/JCDC-ProductionOffice/Shared%20Documents/Forms/AllItems.aspx?OR=Teams%2DHL&CT=[PII_REDACTED]69&id=%2Fteams%2FJCDC%2DProductionOffice%2FShared%20Documents%2FPublications%2FICS%20Publishing%2F2025%20ICSAs%2FJUN%2017%2FVU%23285756%20%2D%20Dover%20Fueling%20Solutions%20ProGauge%20MAGLINK%20%2D%20Notice%20%28Draft%29%2Ehtml&viewid=243fd1ea%2Da122%2D4cc0%2Dbe91%2Dd0714ca46b87&parent=%2Fteams%2FJCDC%2DProductionOffice%2FShared%20Documents%2FPublications%2FICS%20Publishing%2F2025%20ICSAs%2FJUN%2017; https://www.cisa.gov/news-events/ics-advisories/icsa-25-168-05
CVE: CVE-2025-6522
Published: 2025-06-27
Description: Unauthenticated users on an adjacent network with the Sight Bulb Pro can
 run shell commands as root through a vulnerable proprietary TCP 
protocol available on Port 16668. This vulnerability allows an attacker 
to run arbitrary commands on the Sight Bulb Pro by passing a well formed
 JSON string.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-77
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-177-02; https://www.trendmakerscares.com/Customer-Service-Hours
CVE: CVE-2025-6772
Published: 2025-06-27
Description: A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2. It has been classified as critical. Affected is the function import_flow of the file /api/v2/serve/awel/flow/import. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22
References: https://github.com/eosphoros-ai/DB-GPT/issues/2774; https://vuldb.com/?ctiid.314088; https://vuldb.com/?id.314088
CVE: CVE-2025-6773
Published: 2025-06-27
Description: A vulnerability was found in HKUDS LightRAG up to 1.3.8. It has been declared as critical. Affected by this vulnerability is the function upload_to_input_dir of the file lightrag/api/routers/document_routes.py of the component File Upload. The manipulation of the argument file.filename leads to path traversal. It is possible to launch the attack on the local host. The identifier of the patch is 60777d535b719631680bcf5d0969bdef79ca4eaf. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/HKUDS/LightRAG/commit/60777d535b719631680bcf5d0969bdef79ca4eaf; https://github.com/HKUDS/LightRAG/issues/1692; https://github.com/HKUDS/LightRAG/issues/1692#issuecomment[PII_REDACTED]
CVE: CVE-2025-53094
Published: 2025-06-27
Description: ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. In versions up to and including 3.7.8, a CRLF (Carriage Return Line Feed) injection vulnerability exists in the construction and output of HTTP headers within `AsyncWebHeader.cpp`. Unsanitized input allows attackers to inject CR (`\r`) or LF (`\n`) characters into header names or values, leading to arbitrary header or response manipulation. Manipulation of HTTP headers and responses can enable a wide range of attacks, making the severity of this vulnerability high. A fix is available at pull request 211 and is expected to be part of version 3.7.9.
CWE: CWE-93, CWE-113
References: https://github.com/ESP32Async/ESPAsyncWebServer/blob/1095dfd1ecf1a903aede29854232af1b24f089b1/src/AsyncWebHeader.cpp#L6-L32; https://github.com/ESP32Async/ESPAsyncWebServer/pull/211; https://github.com/ESP32Async/ESPAsyncWebServer/security/advisories/GHSA-87j8-6f7g-h8wh
CVE: CVE-2025-6774
Published: 2025-06-27
Description: A vulnerability was found in gooaclok819 sublinkX up to 1.8. It has been rated as critical. Affected by this issue is the function AddTemp of the file api/template.go. The manipulation of the argument filename leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9 is able to address this issue. The patch is identified as 778d26aef723daa58df98c8060c43f5bf5d1b10b. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/gooaclok819/sublinkX/commit/778d26aef723daa58df98c8060c43f5bf5d1b10b; https://github.com/gooaclok819/sublinkX/issues/68#issuecomment[PII_REDACTED]; https://github.com/gooaclok819/sublinkX/issues/69
CVE: CVE-2025-6775
Published: 2025-06-27
Description: A vulnerability classified as critical has been found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This affects the function create_user of the file /app/api/v1/openvpn.py of the component User Creation Endpoint. The manipulation of the argument Username leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.8 is able to address this issue. The patch is named e23559b98c8ea2957f09978c29f4e512ba789eb6. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/xiaoyunjie/openvpn-cms-flask/commit/e23559b98c8ea2957f09978c29f4e512ba789eb6; https://github.com/xiaoyunjie/openvpn-cms-flask/issues/24; https://github.com/xiaoyunjie/openvpn-cms-flask/issues/24#issuecomment[PII_REDACTED]
CVE: CVE-2025-6776
Published: 2025-06-27
Description: A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function Upload of the file app/plugins/oss/app/controller.py of the component File Upload. The manipulation of the argument image leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.8 is able to address this issue. The name of the patch is e23559b98c8ea2957f09978c29f4e512ba789eb6. It is recommended to upgrade the affected component.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22
References: https://github.com/xiaoyunjie/openvpn-cms-flask/commit/e23559b98c8ea2957f09978c29f4e512ba789eb6; https://github.com/xiaoyunjie/openvpn-cms-flask/issues/23; https://github.com/xiaoyunjie/openvpn-cms-flask/releases/tag/v1.2.8
CVE: CVE-2025-6777
Published: 2025-06-27
Description: A vulnerability, which was classified as critical, has been found in code-projects Food Distributor Site 1.0. This issue affects some unknown processing of the file /admin/process_login.php. The manipulation of the argument username/password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/fubxx/CVE/blob/main/Food%20Distributor%20system%20SQL1.md; https://vuldb.com/?ctiid.314093
CVE: CVE-2025-6778
Published: 2025-06-27
Description: A vulnerability, which was classified as problematic, was found in code-projects Food Distributor Site 1.0. Affected is an unknown function of the file /admin/save_settings.php. The manipulation of the argument site_phone/site_email/address leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94
References: https://code-projects.org/; https://github.com/fubxx/CVE/blob/main/Food%20Distributor%20system%20XSS%202.md; https://github.com/fubxx/CVE/blob/main/Food%20Distributor%20system%20XSS%203.md
CVE: CVE-2025-53097
Published: 2025-06-27
Description: Roo Code is an AI-powered autonomous coding agent. Prior to version 3.20.3, there was an issue where the Roo Code agent's `search_files` tool did not respect the setting to disable reads outside of the VS Code workspace. This means that an attacker who was able to inject a prompt into the agent could potentially read a sensitive file and then write the information to a JSON schema. Users have the option to disable schema fetching in VS Code, but the feature is enabled by default. For users with this feature enabled, writing to the schema would trigger a network request without the user having a chance to deny. This issue is of moderate severity, since it requires the attacker to already be able to submit prompts to the agent. Version 3.20.3 fixed the issue where `search_files` did not respect the setting to limit it to the workspace. This reduces the scope of the damage if an attacker is able to take control of the agent through prompt injection or another vector.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-74
References: https://github.com/RooCodeInc/Roo-Code/commit/10b2fb32ed047bbd7b8d10ef185c1ed345efcc92; https://github.com/RooCodeInc/Roo-Code/commit/7d0b22f9e659dc6c26aab0bacbea27874986e772; https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-wr2q-46pg-f228
CVE: CVE-2025-53098
Published: 2025-06-27
Description: Roo Code is an AI-powered autonomous coding agent. The project-specific MCP configuration for the Roo Code agent is stored in the `.roo/mcp.json` file within the VS Code workspace. Because the MCP configuration format allows for execution of arbitrary commands, prior to version 3.20.3, it would have been possible for an attacker with access to craft a prompt to ask the agent to write a malicious command to the MCP configuration file. If the user had opted-in to auto-approving file writes within the project, this would have led to arbitrary command execution. This issue is of moderate severity, since it requires the attacker to already be able to submit prompts to the agent (for instance through a prompt injection attack), for the user to have MCP enabled (on by default), and for the user to have enabled auto-approved file writes (off by default). Version 3.20.3 fixes the issue by adding an additional layer of opt-in configuration for auto-approving writing to Roo's configuration files, including all files within the `.roo/` folder.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77
References: https://github.com/RooCodeInc/Roo-Code/commit/7d0b22f9e659dc6c26aab0bacbea27874986e772; https://github.com/RooCodeInc/Roo-Code/security/advisories/GHSA-5x8h-m52g-5v54
CVE: CVE-2024-36347
Published: 2025-06-27
Description: Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious microcode, potentially resulting in loss of integrity of x86 instruction execution, loss of confidentiality and integrity of data in x86 CPU privileged context and compromise of SMM execution environment.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-347
References: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7033.html
CVE: CVE-2024-39730
Published: 2025-06-28
Description: IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-451
References: https://www.ibm.com/support/pages/node/7238443
CVE: CVE-2024-52900
Published: 2025-06-28
Description: IBM Cognos Analytics 11.2.0 through 12.2.4 Fix Pack 5 and 12.0.0 through 12.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7238163
CVE: CVE-2025-36026
Published: 2025-06-28
Description: IBM Datacap 9.1.7, 9.1.8, and 9.1.9 

does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-614
References: https://www.ibm.com/support/pages/node/7238443
CVE: CVE-2025-36027
Published: 2025-06-28
Description: IBM Datacap 9.1.7, 9.1.8, and 9.1.9 



could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021
References: https://www.ibm.com/support/pages/node/7238443
CVE: CVE-2025-6350
Published: 2025-06-28
Description: The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hotspot-hover’ parameter in all versions up to, and including, 8.5.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wpvr/trunk/admin/classes/class-wpvr-ajax.php#L171; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3317520%40wpvr%2Ftrunk&old=3314284%40wpvr%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/ce3d82ec-5f94-4511-a6ba-8ee1dec06160?source=cve
CVE: CVE-2025-6379
Published: 2025-06-28
Description: The BeeTeam368 Extensions Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the handle_live_fn() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory. This vulnerability can be used to delete the wp-config.php file, which can be leveraged into a site takeover.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://themeforest.net/item/vidmov-video-wordpress-theme/35542187; https://www.wordfence.com/threat-intel/vulnerabilities/id/26abf509-f0a9-4849-9028-d6c42832158f?source=cve
CVE: CVE-2025-6381
Published: 2025-06-28
Description: The BeeTeam368 Extensions plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the handle_remove_temp_file() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory. This vulnerability can be used to delete the wp-config.php file, which can be leveraged into a site takeover.
CVSS Score: 8.8 (HIGH)
CWE: CWE-36
References: https://themeforest.net/item/vidmov-video-wordpress-theme/35542187; https://www.wordfence.com/threat-intel/vulnerabilities/id/aed40456-43c3-4647-9bce-e7c6139c84cd?source=cve
CVE: CVE-2025-6252
Published: 2025-06-28
Description: The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/qi-addons-for-elementor/trunk/assets/js/main.js; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3318746%40qi-addons-for-elementor%2Ftrunk&old=3308494%40qi-addons-for-elementor%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/0ef82a52-0a32-4dc4-b027-3d[PII_REDACTED]?source=cve