deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-2332
Published: 2025-03-27
Description: The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.13 via deserialization of untrusted input in the 'returnMetaValueAsCustomerInput' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://plugins.trac.wordpress.org/browser/wp-ultimate-exporter/trunk/exportExtensions/ExportExtension.php#L3332; https://plugins.trac.wordpress.org/changeset/3257504/; https://www.wordfence.com/threat-intel/vulnerabilities/id/9546ab46-737c-4bd3-9542-8ab1b776b3ea?source=cve
CVE: CVE-2025-2685
Published: 2025-03-27
Description: The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘table-name’ parameter in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/tablepress/trunk/views/class-all-tables-list-table.php#L242; https://plugins.trac.wordpress.org/changeset/3261229/; https://www.wordfence.com/threat-intel/vulnerabilities/id/e285849f-886e-49ba-bb43-8c67655fe239?source=cve
CVE: CVE-2024-45353
Published: 2025-03-27
Description: An intent redriction vulnerability exists in the Xiaomi quick App framework application product. The vulnerability is caused by improper input validation and can be exploited by attackers tointent redriction.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-346
References: https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=551
CVE: CVE-2024-45354
Published: 2025-03-27
Description: A code execution vulnerability exists in the Xiaomi shop applicationproduct. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-346
References: https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=552
CVE: CVE-2024-45355
Published: 2025-03-27
Description: A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-306
References: https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=553
CVE: CVE-2024-45356
Published: 2025-03-27
Description: A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods.
CVSS Score: 7.3 (HIGH)
CWE: CWE-306
References: https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=554
CVE: CVE-2024-45361
Published: 2025-03-27
Description: A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to leak sensitive user information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319
References: https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=558
CVE: CVE-2025-29993
Published: 2025-03-27
Description: The affected versions of PowerCMS allow HTTP header injection. This vulnerability can be leveraged to direct the affected product to send email with a tampered URL, such as password reset mail.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: https://jvn.jp/en/jp/JVN39026557/; https://www.powercms.jp/news/release-powercms-661-528-459.html
CVE: CVE-2025-30763
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Olaf Lederer EO4WP fw-integration-for-emailoctopus allows Stored XSS.This issue affects EO4WP: from n/a through <= 1.0.8.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/fw-integration-for-emailoctopus/vulnerability/wordpress-eo4wp-1-0-8-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30764
Published: 2025-03-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in AntoineH Football Pool football-pool allows Cross Site Request Forgery.This issue affects Football Pool: from n/a through <= 2.12.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/football-pool/vulnerability/wordpress-football-pool-plugin-2-12-2-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-30765
Published: 2025-03-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPPOOL FlexStock stock-sync-with-google-sheet-for-woocommerce allows Blind SQL Injection.This issue affects FlexStock: from n/a through <= 3.13.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/stock-sync-with-google-sheet-for-woocommerce/vulnerability/wordpress-flexstock-3-13-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30766
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows DOM-Based XSS.This issue affects Happy Addons for Elementor: from n/a through <= 3.16.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/happy-elementor-addons/vulnerability/wordpress-happy-addons-for-elementor-3-16-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30767
Published: 2025-03-27
Description: Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through <= 5.3.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/pdf-for-wpforms/vulnerability/wordpress-pdf-for-wpforms-plugin-5-3-0-arbitrary-shortcode-execution-vulnerability?_s_id=cve
CVE: CVE-2025-30768
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mlaza jAlbum Bridge jalbum-bridge allows Stored XSS.This issue affects jAlbum Bridge: from n/a through <= 2.0.18.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/jalbum-bridge/vulnerability/wordpress-jalbum-bridge-2-0-18-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30769
Published: 2025-03-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in alexvtn WIP WooCarousel Lite wip-woocarousel-lite allows Stored XSS.This issue affects WIP WooCarousel Lite: from n/a through <= 1.1.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wip-woocarousel-lite/vulnerability/wordpress-wip-woocarousel-lite-plugin-1-1-7-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30770
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Charitable charitable allows DOM-Based XSS.This issue affects Charitable: from n/a through <= 1.8.4.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/charitable/vulnerability/wordpress-charitable-1-8-4-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30771
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alain-Aymerick FRANCOIS WP Cassify wp-cassify allows DOM-Based XSS.This issue affects WP Cassify: from n/a through <= 2.3.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-cassify/vulnerability/wordpress-wp-cassify-2-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30772
Published: 2025-03-27
Description: Missing Authorization vulnerability in WPClever WPC Smart Upsell Funnel for WooCommerce wpc-smart-upsell-funnel allows Privilege Escalation.This issue affects WPC Smart Upsell Funnel for WooCommerce: from n/a through <= 3.0.4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wpc-smart-upsell-funnel/vulnerability/wordpress-wpc-smart-upsell-funnel-for-woocommerce-plugin-3-0-4-arbitrary-option-update-to-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-30773
Published: 2025-03-27
Description: Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through <= 2.9.6.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/translatepress-multilingual/vulnerability/wordpress-translatepress-2-9-6-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30775
Published: 2025-03-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows SQL Injection.This issue affects WPGuppy: from n/a through <= 1.1.3.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wpguppy-lite/vulnerability/wordpress-wpguppy-plugin-1-1-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30776
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Sitekit sitekit allows Stored XSS.This issue affects Sitekit: from n/a through <= 1.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sitekit/vulnerability/wordpress-sitekit-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30777
Published: 2025-03-27
Description: Authorization Bypass Through User-Controlled Key vulnerability in DevItems Support Genix support-genix-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Support Genix: from n/a through <= 1.4.11.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/Wordpress/Plugin/support-genix-lite/vulnerability/wordpress-support-genix-1-4-11-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE: CVE-2025-30779
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick van Wobbie Doneren met Mollie doneren-met-mollie allows Stored XSS.This issue affects Doneren met Mollie: from n/a through <= 2.10.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/doneren-met-mollie/vulnerability/wordpress-doneren-met-mollie-2-10-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30780
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cubecolour Audio Album audio-album allows Stored XSS.This issue affects Audio Album: from n/a through <= 1.5.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/audio-album/vulnerability/wordpress-audio-album-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30781
Published: 2025-03-27
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WPFactory Scheduled & Automatic Order Status Controller for WooCommerce order-status-rules-for-woocommerce allows Phishing.This issue affects Scheduled & Automatic Order Status Controller for WooCommerce: from n/a through <= 3.7.1.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/order-status-rules-for-woocommerce/vulnerability/wordpress-scheduled-automatic-order-status-controller-for-woocommerce-3-7-1-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2025-30783
Published: 2025-03-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in jgwhite33 WP Google Review Slider wp-google-places-review-slider allows SQL Injection.This issue affects WP Google Review Slider: from n/a through <= 16.0.
CVSS Score: 8.2 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-google-places-review-slider/vulnerability/wordpress-wp-google-review-slider-plugin-16-0-csrf-to-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30784
Published: 2025-03-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Shuffle WP Subscription Forms wp-subscription-forms allows SQL Injection.This issue affects WP Subscription Forms: from n/a through <= 1.2.3.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-subscription-forms/vulnerability/wordpress-wp-subscription-forms-1-2-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30785
Published: 2025-03-27
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle Subscribe to Download Lite subscribe-to-download-lite allows PHP Local File Inclusion.This issue affects Subscribe to Download Lite: from n/a through <= 1.2.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/subscribe-to-download-lite/vulnerability/wordpress-subscribe-to-download-lite-1-2-9-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-30786
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oooorgle Quotes llama quotes-llama allows DOM-Based XSS.This issue affects Quotes llama: from n/a through <= 3.1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/quotes-llama/vulnerability/wordpress-quotes-llama-3-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30787
Published: 2025-03-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows Stored XSS.This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a through <= 5.25.08.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/elisqlreports/vulnerability/wordpress-ez-sql-reports-shortcode-widget-and-db-backup-plugin-5-25-08-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30788
Published: 2025-03-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows SQL Injection.This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a through <= 5.25.08.
CVSS Score: 8.2 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/elisqlreports/vulnerability/wordpress-ez-sql-reports-shortcode-widget-and-db-backup-plugin-5-25-08-csrf-to-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30789
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in clearoutio Clearout Email Validator clearout-email-validator allows Stored XSS.This issue affects Clearout Email Validator: from n/a through <= 3.2.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/clearout-email-validator/vulnerability/wordpress-clearout-email-validator-3-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30790
Published: 2025-03-27
Description: Missing Authorization vulnerability in alexvtn Chatbox Manager wa-chatbox-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Chatbox Manager: from n/a through <= 1.2.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wa-chatbox-manager/vulnerability/wordpress-chatbox-manager-1-2-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-30791
Published: 2025-03-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdever Cart tracking for WooCommerce cart-tracking-for-woocommerce allows SQL Injection.This issue affects Cart tracking for WooCommerce: from n/a through <= 1.0.16.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/cart-tracking-for-woocommerce/vulnerability/wordpress-cart-tracking-for-woocommerce-plugin-1-0-16-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30792
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ufukart Comment Approved Notifier Extended comment-approved-notifier-extended allows Stored XSS.This issue affects Comment Approved Notifier Extended: from n/a through <= 5.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/comment-approved-notifier-extended/vulnerability/wordpress-comment-approved-notifier-extended-plugin-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30795
Published: 2025-03-27
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Phishing.This issue affects FunnelKit Automations: from n/a through <= 3.5.1.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/wp-marketing-automations/vulnerability/wordpress-automation-by-autonami-plugin-3-5-1-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2025-30799
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup WP Google Street View wp-google-street-view allows Stored XSS.This issue affects WP Google Street View: from n/a through <= 1.1.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-google-street-view/vulnerability/wordpress-wp-google-street-view-plugin-1-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30800
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atawai Gum Elementor Addon gum-elementor-addon allows Stored XSS.This issue affects Gum Elementor Addon: from n/a through <= 1.3.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/gum-elementor-addon/vulnerability/wordpress-gum-elementor-addon-plugin-1-3-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30801
Published: 2025-03-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Abu Bakar TWB Woocommerce Reviews twb-woocommerce-reviews allows Cross Site Request Forgery.This issue affects TWB Woocommerce Reviews: from n/a through <= 1.7.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/twb-woocommerce-reviews/vulnerability/wordpress-twb-woocommerce-reviews-plugin-1-7-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-30803
Published: 2025-03-27
Description: Missing Authorization vulnerability in Greg Ross Just Writing Statistics just-writing-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Just Writing Statistics: from n/a through <= 5.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/just-writing-statistics/vulnerability/wordpress-just-writing-statistics-plugin-5-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-30804
Published: 2025-03-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in maennchen1.de wpShopGermany IT-RECHT KANZLEI wpshopgermany-it-recht-kanzlei allows Cross Site Request Forgery.This issue affects wpShopGermany IT-RECHT KANZLEI: from n/a through <= 2.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wpshopgermany-it-recht-kanzlei/vulnerability/wordpress-wpshopgermany-it-recht-kanzlei-plugin-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-30805
Published: 2025-03-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in wpdesk Flexible Cookies flexible-cookies allows Cross Site Request Forgery.This issue affects Flexible Cookies: from n/a through <= 1.1.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/flexible-cookies/vulnerability/wordpress-flexible-cookies-plugin-1-1-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-30806
Published: 2025-03-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Constantin Boiangiu Vimeotheque codeflavors-vimeo-video-post-lite allows SQL Injection.This issue affects Vimeotheque: from n/a through <= 2.3.4.2.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/codeflavors-vimeo-video-post-lite/vulnerability/wordpress-vimeotheque-plugin-2-3-4-2-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30809
Published: 2025-03-27
Description: Missing Authorization vulnerability in Shahjada Live Forms liveforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Forms: from n/a through <= 4.8.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/liveforms/vulnerability/wordpress-wordpress-contact-form-drag-and-drop-form-builder-plugin-live-forms-plugin-4-8-4-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-30810
Published: 2025-03-27
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders Inc., Lead Form Data Collection to CRM wp-leads-builder-any-crm allows Blind SQL Injection.This issue affects Lead Form Data Collection to CRM: from n/a through <= 3.0.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-leads-builder-any-crm/vulnerability/wordpress-lead-form-data-collection-to-crm-plugin-3-0-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30811
Published: 2025-03-27
Description: Cross-Site Request Forgery (CSRF) vulnerability in Javier Revilla ValidateCertify validar-certificados-de-cursos allows Cross Site Request Forgery.This issue affects ValidateCertify: from n/a through <= 1.6.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/validar-certificados-de-cursos/vulnerability/wordpress-validatecertify-plugin-1-6-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-30812
Published: 2025-03-27
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Addons for Elementor skt-addons-for-elementor allows Stored XSS.This issue affects SKT Addons for Elementor: from n/a through <= 3.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/skt-addons-for-elementor/vulnerability/wordpress-skt-addons-for-elementor-plugin-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve