deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-57440
Published: 2025-09-22
Description: The Blackmagic ATEM Mini Pro 2.7 exposes an undocumented Telnet service on TCP port 9993, which accepts unauthenticated plaintext commands for controlling streaming, recording, formatting storage devices, and system reboot. This interface, referred to as the "ATEM Ethernet Protocol 1.0", provides complete device control without requiring credentials or encryption. An attacker on the same network (or with remote access to the exposed port) can exploit this interface to execute arbitrary streaming commands, erase disks, or shut down the device - effectively gaining full remote control.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-57440; https://www.blackmagicdesign.com/
CVE: CVE-2025-57441
Published: 2025-09-22
Description: The Blackmagic ATEM Mini Pro 2.7 exposes sensitive device and stream configuration information via an unauthenticated Telnet service on port 9990. Upon connection, the attacker can access a protocol preamble that leaks the video mode, routing configuration, input/output labels, device model, and even internal identifiers such as the unique ID. This can be used for reconnaissance and planning further attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-57441; https://www.blackmagicdesign.com/
CVE: CVE-2025-59418
Published: 2025-09-22
Description: BunnyPad is a note taking software. Prior to version 11.0.27000.0915, opening files greater than or equal to 20MB causes buffer overflow to occur. This issue has been patched in version 11.0.27000.0915. Users who wish not to upgrade should refrain from opening files larger than 10MB.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/GSYT-Productions/BunnyPad-SRC/commit/d9224eb5e13c24ac148a77dff93e53c21f066533; https://github.com/GSYT-Productions/BunnyPad-SRC/security/advisories/GHSA-qhw4-c7x5-vxmj
CVE: CVE-2025-59420
Published: 2025-09-22
Description: Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation. This issue has been patched in version 1.6.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-345, CWE-863, CWE-345
References: https://github.com/authlib/authlib/commit/6b1813e4392eb7c168c276099ff7783b176479df; https://github.com/authlib/authlib/security/advisories/GHSA-9ggr-2464-2j32; https://lists.debian.org/debian-lts-announce/2025/10/msg00032.html
CVE: CVE-2025-10810
Published: 2025-09-22
Description: A vulnerability was detected in Campcodes Online Learning Management System 1.0. The impacted element is an unknown function of the file /admin/edit_user.php. Performing manipulation of the argument firstname results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/luyisi-7/CVE/issues/1; https://vuldb.com/?ctiid.325168; https://vuldb.com/?id.325168
CVE: CVE-2025-10811
Published: 2025-09-22
Description: A flaw has been found in code-projects Hostel Management System 1.0. This affects an unknown function of the file /justines/admin/mod_comments/index.php?view=view. Executing manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/yihaofuweng/cve/issues/27; https://vuldb.com/?ctiid.325169
CVE: CVE-2025-36064
Published: 2025-09-22
Description: IBM Sterling Connect:Express for Microsoft Windows 3.1.0.0 through 3.1.0.22 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-307
References: https://www.ibm.com/support/pages/node/7245761
CVE: CVE-2025-52367
Published: 2025-09-22
Description: Cross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC 3 allows a remote attacker to execute arbitrary code via the subtitle field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://pivotx.com; https://medium.com/@hayton1088/cve-2025-52367-stored-xss-to-rce-via-privilege-escalation-in-pivotx-cms-v3-0-0-rc-3-a1b870bcb7b3; https://medium.com/@hayton1088/cve-2025-52367-stored-xss-to-rce-via-privilege-escalation-in-pivotx-cms-v3-0-0-rc-3-a1b870bcb7b3
CVE: CVE-2025-53450
Published: 2025-09-22
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Pluginwale Easy Pricing Table WP easy-pricing-table-wp allows PHP Local File Inclusion.This issue affects Easy Pricing Table WP: from n/a through <= 1.1.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/easy-pricing-table-wp/vulnerability/wordpress-easy-pricing-table-wp-plugin-1-1-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-53451
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in mihdan Mihdan: No External Links mihdan-no-external-links allows Cross Site Request Forgery.This issue affects Mihdan: No External Links: from n/a through <= 5.1.6.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/mihdan-no-external-links/vulnerability/wordpress-mihdan-no-external-links-plugin-5-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53452
Published: 2025-09-22
Description: Missing Authorization vulnerability in Barry Event Rocket allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Event Rocket: from n/a through 3.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/wordpress/plugin/event-rocket/vulnerability/wordpress-event-rocket-plugin-3-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-53454
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Stored XSS.This issue affects Ultimate WP Mail: from n/a through <= 1.3.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-wp-mail/vulnerability/wordpress-ultimate-wp-mail-plugin-1-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53455
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CashBill CashBill.pl – Płatności WooCommerce cashbill-payment-method allows Stored XSS.This issue affects CashBill.pl – Płatności WooCommerce: from n/a through <= 3.2.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cashbill-payment-method/vulnerability/wordpress-cashbill-pl-platnosci-woocommerce-plugin-3-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53456
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in activewebsight SEO Backlink Monitor seo-backlink-monitor allows Cross Site Request Forgery.This issue affects SEO Backlink Monitor: from n/a through <= 1.8.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/seo-backlink-monitor/vulnerability/wordpress-seo-backlink-monitor-plugin-1-6-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53457
Published: 2025-09-22
Description: Server-Side Request Forgery (SSRF) vulnerability in activewebsight SEO Backlink Monitor seo-backlink-monitor allows Server Side Request Forgery.This issue affects SEO Backlink Monitor: from n/a through <= 1.8.0.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/seo-backlink-monitor/vulnerability/wordpress-seo-backlink-monitor-plugin-1-6-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-53458
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davaxi Goracash goracash allows Stored XSS.This issue affects Goracash: from n/a through <= 1.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/goracash/vulnerability/wordpress-goracash-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53459
Published: 2025-09-22
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-53460
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi AffiliateWP – External Referral Links affiliatewp-external-referral-links allows Stored XSS.This issue affects AffiliateWP – External Referral Links: from n/a through <= 1.2.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/affiliatewp-external-referral-links/vulnerability/wordpress-affiliatewp-external-referral-links-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53461
Published: 2025-09-22
Description: Server-Side Request Forgery (SSRF) vulnerability in Binsaifullah Beaf image-compare-block allows Server Side Request Forgery.This issue affects Beaf: from n/a through <= 1.6.2.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/image-compare-block/vulnerability/wordpress-beaf-plugin-1-6-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-53462
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SAPO SAPO Feed sapo-feed allows Stored XSS.This issue affects SAPO Feed: from n/a through <= 2.4.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sapo-feed/vulnerability/wordpress-sapo-feed-plugin-2-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53463
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Mega – Absolute Addons for WPBakery Page Builder ht-mega-for-wpbakery allows DOM-Based XSS.This issue affects HT Mega – Absolute Addons for WPBakery Page Builder: from n/a through <= 1.0.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ht-mega-for-wpbakery/vulnerability/wordpress-ht-mega-absolute-addons-for-wpbakery-page-builder-plugin-1-0-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53464
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Online Optimisation WP Mailto Links wp-mailto-links allows Stored XSS.This issue affects WP Mailto Links: from n/a through <= 3.1.4.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-mailto-links/vulnerability/wordpress-wp-mailto-links-plugin-3-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53465
Published: 2025-09-22
Description: Deserialization of Untrusted Data vulnerability in raoinfotech GSheets Connector sheetlink allows Object Injection.This issue affects GSheets Connector: from n/a through <= 1.1.1.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/sheetlink/vulnerability/wordpress-gsheets-connector-plugin-1-1-1-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-53466
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeSolz Better Find and Replace real-time-auto-find-and-replace allows Stored XSS.This issue affects Better Find and Replace: from n/a through <= 1.7.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/real-time-auto-find-and-replace/vulnerability/wordpress-better-find-and-replace-plugin-1-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53467
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Login-Logout login-logout allows Stored XSS.This issue affects Login-Logout: from n/a through <= 3.8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/login-logout/vulnerability/wordpress-login-logout-plugin-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53468
Published: 2025-09-22
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus@hotmail.com Wp tabber widget wp-tabber-widget allows SQL Injection.This issue affects Wp tabber widget: from n/a through <= 4.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-tabber-widget/vulnerability/wordpress-wp-tabber-widget-plugin-4-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-53469
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mortgage Calculator BMI Adult & Kid Calculator bmi-adultkid-calculator allows Stored XSS.This issue affects BMI Adult & Kid Calculator: from n/a through <= 1.2.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/bmi-adultkid-calculator/vulnerability/wordpress-bmi-adult-kid-calculator-plugin-1-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53570
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Stored XSS.This issue affects DELUCKS SEO: from n/a through <= 2.7.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/delucks-seo/vulnerability/wordpress-delucks-seo-plugin-2-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-55887
Published: 2025-09-22
Description: Cross-Site Scripting (XSS) vulnerability was discovered in the meal reservation service ARD. The vulnerability exists in the transactionID GET parameter on the transaction confirmation page. Due to improper input validation and output encoding, an attacker can inject malicious JavaScript code that is executed in the context of a user s browser. This can lead to session hijacking, theft of cookies, and other malicious actions performed on behalf of the victim.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://alpes.com; http://ard.com; https://github.com/0xZeroSec/CVE-2025-55887
CVE: CVE-2025-57685
Published: 2025-09-22
Description: The LB-Link routers, including the BL-AC2100_AZ3 V1.0.4, BL-WR4000 v2.5.0, BL-WR9000_AE4 v2.4.9, BL-AC1900_AZ2 v1.0.2, BL-X26_AC8 v1.2.8, and BL-LTE300_DA4 V1.2.3 models, are vulnerable to unauthorized command injection. Attackers can exploit this vulnerability by accessing the /goform/set_serial_cfg interface to gain the highest level of device privileges without authorization, enabling them to remotely execute malicious commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: http://bl-ac2100.com; https://github.com/mono7s/LB-Link/blob/main/bs_SetSerial.md; https://www.b-link.net.cn/
CVE: CVE-2025-57898
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Vega WP Frontend Admin display-admin-page-on-frontend allows Stored XSS.This issue affects WP Frontend Admin: from n/a through <= 1.22.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/display-admin-page-on-frontend/vulnerability/wordpress-wp-frontend-admin-plugin-1-22-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57899
Published: 2025-09-22
Description: Missing Authorization vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Compress: from n/a through <= 6.50.54.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-compress-image-optimizer/vulnerability/wordpress-wp-compress-plugin-6-50-54-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-57900
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ataur R GutenKit gutenkit-blocks-addon allows Stored XSS.This issue affects GutenKit: from n/a through <= 2.4.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/gutenkit-blocks-addon/vulnerability/wordpress-gutenkit-plugin-2-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57901
Published: 2025-09-22
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-57902
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Md Taufiqur Rahman RIS Version Switcher – Downgrade or Upgrade WP Versions Easily ris-version-switcher allows Cross Site Request Forgery.This issue affects RIS Version Switcher – Downgrade or Upgrade WP Versions Easily: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/ris-version-switcher/vulnerability/wordpress-ris-version-switcher-downgrade-or-upgrade-wp-versions-easily-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-57903
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPSuperiors Developer WooCommerce Additional Fees On Checkout (Free) woo-additional-fees-on-checkout-wordpress allows Stored XSS.This issue affects WooCommerce Additional Fees On Checkout (Free): from n/a through <= 1.5.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woo-additional-fees-on-checkout-wordpress/vulnerability/wordpress-woocommerce-additional-fees-on-checkout-free-plugin-1-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57904
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP-EXPERTS.IN Sales Count Manager for WooCommerce wc-sales-count-manager allows Stored XSS.This issue affects Sales Count Manager for WooCommerce: from n/a through <= 2.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wc-sales-count-manager/vulnerability/wordpress-sales-count-manager-for-woocommerce-plugin-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57905
Published: 2025-09-22
Description: Cross-Site Request Forgery (CSRF) vulnerability in Amin Y AgreeMe Checkboxes For WooCommerce agreeme-checkboxes-for-woocommerce allows Cross Site Request Forgery.This issue affects AgreeMe Checkboxes For WooCommerce: from n/a through <= 1.1.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/agreeme-checkboxes-for-woocommerce/vulnerability/wordpress-agreeme-checkboxes-for-woocommerce-plugin-1-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-57906
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in epeken Epeken All Kurir epeken-all-kurir allows Stored XSS.This issue affects Epeken All Kurir: from n/a through <= 2.0.6.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/epeken-all-kurir/vulnerability/wordpress-epeken-all-kurir-plugin-2-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57907
Published: 2025-09-22
Description: Missing Authorization vulnerability in Heureka Group Heureka heureka allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Heureka: from n/a through <= 1.1.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/heureka/vulnerability/wordpress-heureka-plugin-1-1-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-57908
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProWCPlugins Product Time Countdown for WooCommerce product-countdown-for-woocommerce allows Stored XSS.This issue affects Product Time Countdown for WooCommerce: from n/a through <= 1.6.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/product-countdown-for-woocommerce/vulnerability/wordpress-product-time-countdown-for-woocommerce-plugin-1-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57909
Published: 2025-09-22
Description: Missing Authorization vulnerability in Rouergue Création Editor Custom Color Palette editor-custom-color-palette allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Editor Custom Color Palette: from n/a through <= 3.5.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/editor-custom-color-palette/vulnerability/wordpress-editor-custom-color-palette-plugin-3-4-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-57910
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AnyClip Video Platform AnyClip Luminous Studio anyclip-media allows Stored XSS.This issue affects AnyClip Luminous Studio: from n/a through <= 1.3.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/anyclip-media/vulnerability/wordpress-anyclip-luminous-studio-plugin-1-3-3-cross-site-scripting-xss-vulnerability-2?_s_id=cve
CVE: CVE-2025-57911
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Adverts adverts-click-tracker allows DOM-Based XSS.This issue affects Adverts: from n/a through <= 1.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/adverts-click-tracker/vulnerability/wordpress-adverts-plugin-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57912
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dialogity Dialogity Free Live Chat dialogity-website-chat allows Stored XSS.This issue affects Dialogity Free Live Chat: from n/a through <= 1.0.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/dialogity-website-chat/vulnerability/wordpress-dialogity-free-live-chat-plugin-1-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-57913
Published: 2025-09-22
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/portfolio-manager-powered-by-behance/vulnerability/wordpress-behance-portfolio-manager-plugin-1-7-4-cross-site-scripting-xss-vulnerability?_s_id=cve