deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-32186
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Turbo Addons Turbo Addons Elementor turbo-addons-elementor allows DOM-Based XSS.This issue affects Turbo Addons Elementor: from n/a through <= 1.7.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/turbo-addons-elementor/vulnerability/wordpress-turbo-addons-for-elementor-plugin-1-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32187
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Quý Lê 91 Administrator Z administrator-z allows DOM-Based XSS.This issue affects Administrator Z: from n/a through <= 2026.03.02.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/administrator-z/vulnerability/wordpress-administrator-z-plugin-2025-03-04-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32188
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ILLID Advanced Woo Labels advanced-woo-labels allows Stored XSS.This issue affects Advanced Woo Labels: from n/a through <= 2.15.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/advanced-woo-labels/vulnerability/wordpress-advanced-woo-labels-plugin-2-14-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32189
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Best WP Developer BWD Elementor Addons bwd-elementor-addons allows DOM-Based XSS.This issue affects BWD Elementor Addons: from n/a through <= 4.4.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bwd-elementor-addons/vulnerability/wordpress-bwd-elementor-addons-plugin-4-3-20-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32190
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smartwpress Musician's Pack For Elementor music-pack-for-elementor allows DOM-Based XSS.This issue affects Musician's Pack For Elementor: from n/a through <= 1.8.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/music-pack-for-elementor/vulnerability/wordpress-musician-s-pack-for-elementor-plugin-1-8-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32191
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon News Element Elementor Blog Magazine news-element allows DOM-Based XSS.This issue affects News Element Elementor Blog Magazine: from n/a through <= 1.0.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/news-element/vulnerability/wordpress-news-element-elementor-blog-magazine-plugin-1-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32192
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UltraPress Ultra Addons Lite for Elementor ut-elementor-addons-lite allows Stored XSS.This issue affects Ultra Addons Lite for Elementor: from n/a through <= 1.1.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ut-elementor-addons-lite/vulnerability/wordpress-ultra-addons-lite-for-elementor-plugin-1-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32193
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMinds Simple WP Events simple-wp-events allows Stored XSS.This issue affects Simple WP Events: from n/a through <= 1.8.17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-wp-events/vulnerability/wordpress-simple-wp-events-plugin-1-8-17-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32194
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through <= 1.5.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/lastudio-element-kit/vulnerability/wordpress-la-studio-element-kit-for-elementor-plugin-1-4-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32195
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Stored XSS.This issue affects Ecwid Shopping Cart: from n/a through <= 7.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ecwid-shopping-cart/vulnerability/wordpress-ecwid-shopping-cart-plugin-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32196
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Stored XSS.This issue affects News Kit Elementor Addons: from n/a through <= 1.4.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/news-kit-elementor-addons/vulnerability/wordpress-news-kit-elementor-addons-plugin-1-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32197
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in piotnetdotcom Piotnet Addons For Elementor piotnet-addons-for-elementor allows Stored XSS.This issue affects Piotnet Addons For Elementor: from n/a through <= 2.4.36.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/piotnet-addons-for-elementor/vulnerability/wordpress-piotnet-addons-for-elementor-plugin-2-4-34-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32200
Published: 2025-04-04
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-32201
Published: 2025-04-04
Description: Missing Authorization vulnerability in Xpro Xpro Theme Builder xpro-theme-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xpro Theme Builder: from n/a through <= 1.2.8.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/xpro-theme-builder/vulnerability/wordpress-xpro-theme-builder-plugin-1-2-8-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32203
Published: 2025-04-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in manu225 Falling things falling-things allows SQL Injection.This issue affects Falling things: from n/a through <= 1.08.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/falling-things/vulnerability/wordpress-falling-things-plugin-1-08-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32204
Published: 2025-04-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rocketelements Split Test For Elementor split-test-for-elementor allows SQL Injection.This issue affects Split Test For Elementor: from n/a through <= 1.8.3.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/split-test-for-elementor/vulnerability/wordpress-split-test-for-elementor-plugin-1-8-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32207
Published: 2025-04-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Cost Of Goods ni-woocommerce-cost-of-goods allows Stored XSS.This issue affects Ni WooCommerce Cost Of Goods: from n/a through <= 3.2.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ni-woocommerce-cost-of-goods/vulnerability/wordpress-ni-woocommerce-cost-of-goods-plugin-3-2-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32217
Published: 2025-04-04
Description: Missing Authorization vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ai Image Alt Text Generator for WP: from n/a through <= 1.1.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/ai-image-alt-text-generator-for-wp/vulnerability/wordpress-ai-image-alt-text-generator-for-wp-plugin-1-0-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32218
Published: 2025-04-04
Description: Missing Authorization vulnerability in RealMag777 TableOn posts-table-filterable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TableOn: from n/a through <= 1.0.5.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/posts-table-filterable/vulnerability/wordpress-tableon-wordpress-posts-table-filterable-plugin-1-0-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32219
Published: 2025-04-04
Description: Missing Authorization vulnerability in Syntactics, Inc. eaSYNC easync-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eaSYNC: from n/a through <= 1.3.19.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/easync-booking/vulnerability/wordpress-easync-plugin-1-3-19-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32220
Published: 2025-04-04
Description: Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through <= 10.30.23.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/salon-booking-system/vulnerability/wordpress-salon-booking-system-plugin-10-10-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32224
Published: 2025-04-04
Description: Missing Authorization vulnerability in Shivam Mani Tripathi Privyr CRM Integration privy-crm-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Privyr CRM Integration: from n/a through <= 1.0.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/privy-crm-integration/vulnerability/wordpress-privyr-crm-plugin-1-0-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32225
Published: 2025-04-04
Description: Missing Authorization vulnerability in WP Event Manager WP Event Manager wp-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Manager: from n/a through <= 3.2.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-event-manager/vulnerability/wordpress-wp-event-manager-plugin-3-1-47-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32226
Published: 2025-04-04
Description: Missing Authorization vulnerability in Anzar Ahmed Display product variations dropdown on shop page display-product-variations-dropdown-on-shop-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display product variations dropdown on shop page: from n/a through <= 1.1.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/display-product-variations-dropdown-on-shop-page/vulnerability/wordpress-display-product-variations-dropdown-on-shop-page-plugin-1-1-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32229
Published: 2025-04-04
Description: Missing Authorization vulnerability in Bowo Variable Inspector variable-inspector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Variable Inspector: from n/a through <= 2.6.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/variable-inspector/vulnerability/wordpress-variable-inspector-plugin-2-6-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32231
Published: 2025-04-04
Description: Missing Authorization vulnerability in Bookingor Bookingor bookingor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bookingor: from n/a through <= 2.0.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/bookingor/vulnerability/wordpress-bookingor-plugin-1-0-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32232
Published: 2025-04-04
Description: Missing Authorization vulnerability in ERA404 StaffList stafflist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects StaffList: from n/a through <= 3.2.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/stafflist/vulnerability/wordpress-stafflist-plugin-3-2-6-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32233
Published: 2025-04-04
Description: Missing Authorization vulnerability in WP Chill Revive.so revive-so allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Revive.so: from n/a through <= 2.0.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/revive-so/vulnerability/wordpress-revive-so-2-0-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32234
Published: 2025-04-04
Description: Missing Authorization vulnerability in aleswebs AdMail – Multilingual Back in-Stock Notifier for WooCommerce admail allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AdMail – Multilingual Back in-Stock Notifier for WooCommerce: from n/a through <= 1.7.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/admail/vulnerability/wordpress-admail-plugin-1-7-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32235
Published: 2025-04-04
Description: Missing Authorization vulnerability in sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through <= 5.9.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/mp3-music-player-by-sonaar/vulnerability/wordpress-mp3-audio-player-music-player-podcast-player-radio-by-sonaar-plugin-5-9-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32237
Published: 2025-04-04
Description: Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through <= 3.5.28.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/masterstudy-lms-learning-management-system/vulnerability/wordpress-masterstudy-lms-plugin-3-5-23-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32238
Published: 2025-04-04
Description: Generation of Error Message Containing Sensitive Information vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Retrieve Embedded Sensitive Data.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through <= 4.5.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://patchstack.com/database/Wordpress/Plugin/meeting-scheduler-by-vcita/vulnerability/wordpress-online-booking-scheduling-calendar-for-wordpress-by-vcita-plugin-4-5-2-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-32239
Published: 2025-04-04
Description: Missing Authorization vulnerability in Joao Romao Social Share Buttons & Analytics Plugin – GetSocial.io wp-share-buttons-analytics-by-getsocial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Share Buttons & Analytics Plugin – GetSocial.io: from n/a through <= 4.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-share-buttons-analytics-by-getsocial/vulnerability/wordpress-social-share-buttons-analytics-plugin-plugin-4-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32241
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in CleverReach® Official CleverReach Plugin for WooCommerce cleverreach-wc allows Cross Site Request Forgery.This issue affects Official CleverReach Plugin for WooCommerce: from n/a through <= 3.4.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/cleverreach-wc/vulnerability/wordpress-official-cleverreach-woocommerce-integration-plugin-3-4-3-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-32246
Published: 2025-04-04
Description: Missing Authorization vulnerability in Tim Nguyen 1-Click Backup & Restore Database 1-click-backup-restore-database-by-sunbytes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 1-Click Backup & Restore Database: from n/a through <= 1.0.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/1-click-backup-restore-database-by-sunbytes/vulnerability/wordpress-1-click-backup-restore-database-1-0-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32247
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in ABCdatos AI Content Creator ai-content-creator allows Cross Site Request Forgery.This issue affects AI Content Creator: from n/a through <= 1.2.6.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/ai-content-creator/vulnerability/wordpress-ai-content-creator-plugin-1-2-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-32248
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in SwiftXR SwiftXR (3D/AR/VR) Viewer swiftxr-3darvr-viewer allows Cross Site Request Forgery.This issue affects SwiftXR (3D/AR/VR) Viewer: from n/a through <= 1.0.7.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/swiftxr-3darvr-viewer/vulnerability/wordpress-swiftxr-3d-ar-vr-viewer-plugin-1-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-32249
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in Designinvento DirectoryPress directorypress allows Cross Site Request Forgery.This issue affects DirectoryPress: from n/a through <= 3.6.22.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/directorypress/vulnerability/wordpress-directorypress-business-directory-and-classified-ad-listing-plugin-3-6-19-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-32250
Published: 2025-04-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in rollbar Rollbar rollbar allows Cross Site Request Forgery.This issue affects Rollbar: from n/a through <= 2.7.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/rollbar/vulnerability/wordpress-rollbar-plugin-2-7-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-32251
Published: 2025-04-04
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in J. Tyler Wiest Jetpack Feedback Exporter jetpack-feedback-exporter allows Retrieve Embedded Sensitive Data.This issue affects Jetpack Feedback Exporter: from n/a through <= 1.23.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/jetpack-feedback-exporter/vulnerability/wordpress-jetpack-feedback-exporter-1-23-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-32252
Published: 2025-04-04
Description: Missing Authorization vulnerability in Black and White WP Genealogy – Your Family History Website wpgenealogy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Genealogy – Your Family History Website: from n/a through <= 0.1.9.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wpgenealogy/vulnerability/wordpress-wp-genealogy-plugin-0-1-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32253
Published: 2025-04-04
Description: Missing Authorization vulnerability in ComMotion Course Booking System course-booking-system allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Course Booking System: from n/a through <= 6.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/course-booking-system/vulnerability/wordpress-course-booking-system-plugin-6-0-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32254
Published: 2025-04-04
Description: Missing Authorization vulnerability in Iqonic Design WPBookit wpbookit allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPBookit: from n/a through <= 1.0.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wpbookit/vulnerability/wordpress-wpbookit-plugin-1-0-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32255
Published: 2025-04-04
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ERA404 StaffList stafflist allows Retrieve Embedded Sensitive Data.This issue affects StaffList: from n/a through <= 3.2.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/stafflist/vulnerability/wordpress-stafflist-plugin-3-2-6-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-32256
Published: 2025-04-04
Description: Missing Authorization vulnerability in devsoftbaltic SurveyJS surveyjs allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects SurveyJS: from n/a through <= 1.12.20.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/surveyjs/vulnerability/wordpress-surveyjs-plugin-1-12-20-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-32257
Published: 2025-04-04
Description: Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability in 1clickmigration 1 Click WordPress Migration 1-click-migration allows Retrieve Embedded Sensitive Data.This issue affects 1 Click WordPress Migration: from n/a through <= 2.5.7.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1258
References: https://patchstack.com/database/Wordpress/Plugin/1-click-migration/vulnerability/wordpress-1-click-wordpress-migration-plugin-2-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-32258
Published: 2025-04-04
Description: Missing Authorization vulnerability in InfoGiants Simple Website Logo simple-website-logo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Website Logo: from n/a through <= 1.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/simple-website-logo/vulnerability/wordpress-simple-website-logo-plugin-1-1-broken-access-control-vulnerability?_s_id=cve