deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-9039
Published: 2025-08-14
Description: We identified an issue in the Amazon ECS agent where, under certain conditions, an introspection server could be accessed off-host by another instance if the instances are in the same security group or if their security groups allow incoming connections that include the port where the server is hosted. This issue does not affect instances where the option to allow off-host access to the introspection server is set to 'false'.

This issue has been addressed in ECS agent version 1.97.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. 

If customers cannot update to the latest AMI, they can modify the Amazon EC2 security groups to restrict incoming access to the introspection server port (51678).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-277
References: https://aws.amazon.com/security/security-bulletins/AWS-2025-018/; https://github.com/aws/amazon-ecs-agent/releases/tag/v1.97.1; https://github.com/aws/amazon-ecs-agent/security/advisories/GHSA-wm7x-ww72-r77q
CVE: CVE-2025-9043
Published: 2025-08-14
Description: The service executable path in Seagate Toolkit on Versions prior to 2.34.0.33 on Windows allows an attacker with Admin privileges to exploit a vulnerability as classified under CWE-428: Unquoted Search Path or Element. An attacker with write permissions to the root could place a malicious Program.exe file, which would execute with SYSTEM privileges.
CWE: CWE-428
References: https://www.seagate.com/product-security/#security-advisories; https://www.seagate.com/support/software/toolkit/
CVE: CVE-2023-43687
Published: 2025-08-14
Description: An issue was discovered in Malwarebytes before 4.6.14.326 and before 5.1.5.116 (and Nebula 2020-10-21 and later). There is a Race condition that leads to code execution because of a lack of locks between file verification and execution.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-421
References: https://www.malwarebytes.com/secure/cves/cve-2023-43687
CVE: CVE-2024-37945
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbits WPBITS Addons For Elementor Page Builder wpbits-addons-for-elementor allows Stored XSS.This issue affects WPBITS Addons For Elementor Page Builder: from n/a through <= 1.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wpbits-addons-for-elementor/vulnerability/wordpress-wpbits-addons-for-elementor-plugin-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-21110
Published: 2025-08-14
Description: Dell Data Lakehouse, versions prior to 1.5.0.0, contains an Execution with Unnecessary Privileges vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-250
References: https://www.dell.com/support/kbdoc/en-us/000356822/dsa-2025-313-security-update-for-dell-data-lakehouse-multiple-vulnerabilities
CVE: CVE-2025-51986
Published: 2025-08-14
Description: An issue was discovered in the demo/LINUXTCP implementation of cwalter-at freemodbus v.2018-09-12 allowing attackers to reach an infinite loop via a crafted length value for a packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://gist.github.com/jyjsunny/a9743a718ed3081b034c11201803f6b4
CVE: CVE-2025-52335
Published: 2025-08-14
Description: EyouCMS 1.7.3 is vulnerale to Cross Site Scripting (XSS) in index.php, which can be exploited to obtain sensitive information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://eyoucms.com; https://sour-burglar-bfe.notion.site/CVE-2025-52335-24e2b2fd021080da9667e7608c801180
CVE: CVE-2025-8972
Published: 2025-08-14
Description: A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/page-login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/zzb1388/cve/issues/31; https://itsourcecode.com/; https://vuldb.com/?ctiid.319967
CVE: CVE-2025-8973
Published: 2025-08-14
Description: A vulnerability has been found in SourceCodester Cashier Queuing System 1.0. Affected is an unknown function of the file /Actions.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/zzb1388/cve/issues/30; https://vuldb.com/?ctiid.319968; https://vuldb.com/?id.319968
CVE: CVE-2025-8974
Published: 2025-08-14
Description: A vulnerability was determined in linlinjava litemall up to 1.8.0. Affected by this issue is some unknown functionality of the file litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/util/JwtHelper.java of the component JSON Web Token Handler. The manipulation of the argument SECRET with the input X-Litemall-Token leads to hard-coded credentials. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.7 (LOW)
CWE: CWE-259, CWE-798
References: https://github.com/linlinjava/litemall/issues/568; https://github.com/linlinjava/litemall/issues/568#issue[PII_REDACTED]; https://vuldb.com/?ctiid.319970
CVE: CVE-2025-52765
Published: 2025-08-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in lisensee NetInsight Analytics Implementation Plugin netinsight-analytics-implementation-plugin allows Stored XSS.This issue affects NetInsight Analytics Implementation Plugin: from n/a through <= 1.0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/netinsight-analytics-implementation-plugin/vulnerability/wordpress-netinsight-analytics-implementation-plugin-plugin-plugin-1-0-3-cross-site-request-forgery-csrf-vulnerability-2?_s_id=cve
CVE: CVE-2025-52767
Published: 2025-08-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in lisensee NetInsight Analytics Implementation Plugin netinsight-analytics-implementation-plugin allows Cross Site Request Forgery.This issue affects NetInsight Analytics Implementation Plugin: from n/a through <= 1.0.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/netinsight-analytics-implementation-plugin/vulnerability/wordpress-netinsight-analytics-implementation-plugin-plugin-plugin-1-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-52769
Published: 2025-08-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in flexostudio flexo-social-gallery flexo-social-gallery allows Cross Site Request Forgery.This issue affects flexo-social-gallery: from n/a through <= 1.0006.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/flexo-social-gallery/vulnerability/wordpress-flexo-social-gallery-plugin-plugin-1-0006-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-52771
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bcupham Video Expander video-expander allows Stored XSS.This issue affects Video Expander: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/video-expander/vulnerability/wordpress-video-expander-plugin-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-52797
Published: 2025-08-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in josepsitjar StoryMap wp-storymap allows SQL Injection.This issue affects StoryMap: from n/a through <= 2.1.
CVSS Score: 8.2 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-storymap/vulnerability/wordpress-storymap-plugin-plugin-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53219
Published: 2025-08-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in pl4g4 WP-Database-Optimizer-Tools wp-database-optimizer-tools allows Cross Site Request Forgery.This issue affects WP-Database-Optimizer-Tools: from n/a through <= 0.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-database-optimizer-tools/vulnerability/wordpress-wp-database-optimizer-tools-plugin-plugin-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53221
Published: 2025-08-14
Description: Missing Authorization vulnerability in codeablepress CodeablePress codeablepress-simple-frontend-profile-picture-upload allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CodeablePress: from n/a through <= 1.0.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/codeablepress-simple-frontend-profile-picture-upload/vulnerability/wordpress-codeablepress-plugin-plugin-1-0-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-53241
Published: 2025-08-14
Description: Server-Side Request Forgery (SSRF) vulnerability in kodeshpa Simplified simplified allows Server Side Request Forgery.This issue affects Simplified: from n/a through <= 1.0.11.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/simplified/vulnerability/wordpress-simplified-plugin-plugin-1-0-9-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-53249
Published: 2025-08-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in hakeemnala Build App Online build-app-online allows Cross Site Request Forgery.This issue affects Build App Online: from n/a through <= 1.0.23.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/build-app-online/vulnerability/wordpress-build-app-online-plugin-plugin-1-0-23-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53330
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpEstate WP Rentals wprentals allows Stored XSS.This issue affects WP Rentals: from n/a through <= 3.16.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/wprentals/vulnerability/wordpress-wp-rentals-theme-theme-3-13-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53341
Published: 2025-08-14
Description: Missing Authorization vulnerability in Themovation App, SaaS & Software Startup Tech Theme - Stratus stratusx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects App, SaaS & Software Startup Tech Theme - Stratus: from n/a through <= 4.2.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/stratusx/vulnerability/wordpress-stratus-theme-theme-4-2-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-53342
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Modernize modernize allows Stored XSS.This issue affects Modernize: from n/a through <= 3.4.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/modernize/vulnerability/wordpress-modernize-theme-theme-3-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53343
Published: 2025-08-14
Description: Missing Authorization vulnerability in GoodLayers Modernize modernize allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Modernize: from n/a through <= 3.4.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/modernize/vulnerability/wordpress-modernize-theme-theme-3-4-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-53347
Published: 2025-08-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in Laborator Kalium kalium allows Cross Site Request Forgery.This issue affects Kalium: from n/a through <= 3.18.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Theme/kalium/vulnerability/wordpress-kalium-theme-plugin-3-18-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53575
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in primersoftware Primer MyData for Woocommerce primer-mydata allows Reflected XSS.This issue affects Primer MyData for Woocommerce: from n/a through <= 4.2.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/primer-mydata/vulnerability/wordpress-primer-mydata-for-woocommerce-plugin-plugin-4-2-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-53581
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artiosmedia RSS Feed Pro rss-feed-pro allows Stored XSS.This issue affects RSS Feed Pro: from n/a through <= 1.1.8.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/rss-feed-pro/vulnerability/wordpress-rss-feed-pro-plugin-plugin-1-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53582
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordLift WordLift wordlift allows Stored XSS.This issue affects WordLift: from n/a through <= 3.54.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wordlift/vulnerability/wordpress-wordlift-plugin-plugin-3-54-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-53587
Published: 2025-08-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in ApusTheme Findgo findgo allows Cross Site Request Forgery.This issue affects Findgo: from n/a through <= 1.3.57.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Theme/findgo/vulnerability/wordpress-findgo-theme-theme-1-3-57-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-54054
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Stored XSS.This issue affects 12 Step Meeting List: from n/a through <= 3.18.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/12-step-meeting-list/vulnerability/wordpress-12-step-meeting-list-plugin-plugin-3-18-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54708
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows DOM-Based XSS.This issue affects B Blocks: from n/a through <= 2.0.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/b-blocks/vulnerability/wordpress-b-blocks-plugin-plugin-2-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54712
Published: 2025-08-14
Description: Missing Authorization vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Elementor Addons: from n/a through <= 2.2.7.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/easy-elementor-addons/vulnerability/wordpress-easy-elementor-addons-plugin-plugin-2-2-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-54715
Published: 2025-08-14
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Path Traversal.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.9.0.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/vulnerability/wordpress-barcode-scanner-with-inventory-order-manager-plugin-plugin-1-9-0-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2025-54717
Published: 2025-08-14
Description: Missing Authorization vulnerability in e-plugins WP Membership wp-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Membership: from n/a through <= 1.6.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-membership/vulnerability/wordpress-wp-membership-plugin-plugin-1-6-3-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-54727
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Stored XSS.This issue affects CM On Demand Search And Replace: from n/a through <= 1.5.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cm-on-demand-search-and-replace/vulnerability/wordpress-cm-on-demand-search-and-replace-plugin-plugin-1-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54728
Published: 2025-08-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Cross Site Request Forgery.This issue affects CM On Demand Search And Replace: from n/a through <= 1.5.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/cm-on-demand-search-and-replace/vulnerability/wordpress-cm-on-demand-search-and-replace-plugin-plugin-1-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-54729
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Stored XSS.This issue affects Webba Booking: from n/a through <= 6.0.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/webba-booking-lite/vulnerability/wordpress-webba-booking-plugin-plugin-6-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54730
Published: 2025-08-14
Description: Missing Authorization vulnerability in PARETO Digital Embedder for Google Reviews embedder-for-google-reviews allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Embedder for Google Reviews: from n/a through <= 1.7.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/embedder-for-google-reviews/vulnerability/wordpress-embedder-for-google-reviews-plugin-plugin-1-7-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-54732
Published: 2025-08-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages allows Cross Site Request Forgery.This issue affects WPDM – Premium Packages: from n/a through <= 6.0.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wpdm-premium-packages/vulnerability/wordpress-wpdm-premium-packages-plugin-plugin-6-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-54736
Published: 2025-08-14
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NordicMade Savoy savoy allows Retrieve Embedded Sensitive Data.This issue affects Savoy: from n/a through <= 3.0.8.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Theme/savoy/vulnerability/wordpress-savoy-theme-plugin-3-0-8-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-54739
Published: 2025-08-14
Description: Missing Authorization vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nexter Blocks: from n/a through <= 4.5.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/the-plus-addons-for-block-editor/vulnerability/wordpress-nexter-blocks-plugin-plugin-4-5-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-54740
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Nelson Print My Blog print-my-blog allows Stored XSS.This issue affects Print My Blog: from n/a through <= 3.27.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/print-my-blog/vulnerability/wordpress-print-my-blog-plugin-plugin-3-27-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54746
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cartpauj Shortcode Redirect shortcode-redirect allows Stored XSS.This issue affects Shortcode Redirect: from n/a through <= 1.0.02.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/shortcode-redirect/vulnerability/wordpress-shortcode-redirect-plugin-plugin-1-0-02-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54747
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbakery Templatera templatera allows DOM-Based XSS.This issue affects Templatera: from n/a through <= 2.3.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/templatera/vulnerability/wordpress-templatera-plugin-plugin-2-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-54749
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductGallery jet-woo-product-gallery allows Stored XSS.This issue affects JetProductGallery: from n/a through <= 2.2.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/jet-woo-product-gallery/vulnerability/wordpress-jetproductgallery-plugin-plugin-2-2-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-55708
Published: 2025-08-14
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows SQL Injection.This issue affects Quiz And Survey Master: from n/a through <= 10.2.4.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-plugin-10-2-4-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-55709
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Stored XSS.This issue affects Visual Composer Website Builder: from n/a through < 45.15.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/visualcomposer/vulnerability/wordpress-visual-composer-website-builder-plugin-plugin-45-15-0-cross-site-scripting-xss-vulnerability?_s_id=cve