deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-24766
Published: 2025-08-14
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wproyal News Magazine X news-magazine-x allows PHP Local File Inclusion.This issue affects News Magazine X: from n/a through <= 1.2.37.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/news-magazine-x/vulnerability/wordpress-news-magazine-x-1-2-35-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-24775
Published: 2025-08-14
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Made I.T. Forms forms-by-made-it allows Upload a Web Shell to a Web Server.This issue affects Forms: from n/a through <= 2.9.0.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/forms-by-made-it/vulnerability/wordpress-forms-2-9-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-25172
Published: 2025-08-14
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 VidMov vidmov allows PHP Local File Inclusion.This issue affects VidMov: from n/a through <= 1.9.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/vidmov/vulnerability/wordpress-vidmov-1-9-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-25174
Published: 2025-08-14
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beeteam368-extensions allows PHP Local File Inclusion.This issue affects BeeTeam368 Extensions: from n/a through <= 1.9.4.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/beeteam368-extensions/vulnerability/wordpress-beeteam368-extensions-plugin-1-9-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-28962
Published: 2025-08-14
Description: Missing Authorization vulnerability in stefanoai Advanced Google Universal Analytics advanced-google-universal-analytics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Google Universal Analytics: from n/a through <= 1.0.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/advanced-google-universal-analytics/vulnerability/wordpress-advanced-google-universal-analytics-plugin-1-0-3-broken-access-control-to-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-28975
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in redqteam Alike - WordPress Custom Post Comparison alike allows Reflected XSS.This issue affects Alike - WordPress Custom Post Comparison: from n/a through <= 3.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/alike/vulnerability/wordpress-alike-wordpress-custom-post-comparison-3-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28979
Published: 2025-08-14
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress WP Pipes allows PHP Local File Inclusion. This issue affects WP Pipes: from n/a through 1.4.3.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/wordpress/plugin/wp-pipes/vulnerability/wordpress-wp-pipes-1-4-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-28987
Published: 2025-08-14
Description: Server-Side Request Forgery (SSRF) vulnerability in PressForward PressForward pressforward allows Server Side Request Forgery.This issue affects PressForward: from n/a through <= 5.9.5.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/pressforward/vulnerability/wordpress-pressforward-5-8-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-28999
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZoomIt WooCommerce Shop Page Builder allows Reflected XSS. This issue affects WooCommerce Shop Page Builder: from n/a through 2.27.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/dzs-wootable/vulnerability/wordpress-woocommerce-shop-page-builder-2-27-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-29014
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZoomIt FoodMenu allows Reflected XSS. This issue affects FoodMenu: from n/a through 1.20.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/dzs-restaurantmenu/vulnerability/wordpress-foodmenu-1-20-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30626
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Multimedia Playlist Slider Addon for WPBakery Page Builder lbg_vp_youtube_vimeo_addon_visual_composer allows Reflected XSS.This issue affects Multimedia Playlist Slider Addon for WPBakery Page Builder: from n/a through <= 2.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/lbg_vp_youtube_vimeo_addon_visual_composer/vulnerability/wordpress-multimedia-playlist-slider-addon-for-wpbakery-page-builder-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-30635
Published: 2025-08-14
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeAtelier IDonatePro idonate-pro allows PHP Local File Inclusion.This issue affects IDonatePro: from n/a through <= 2.1.9.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/idonate-pro/vulnerability/wordpress-idonatepro-2-1-8-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-30639
Published: 2025-08-14
Description: Missing Authorization vulnerability in ThemeAtelier IDonatePro idonate-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IDonatePro: from n/a through <= 2.1.9.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/idonate-pro/vulnerability/wordpress-idonatepro-plugin-2-1-9-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-30993
Published: 2025-08-14
Description: Missing Authorization vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Thank You Page Customizer for WooCommerce: from n/a through <= 1.1.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/woo-thank-you-page-customizer/vulnerability/wordpress-thank-you-page-customizer-for-woocommerce-increase-your-sales-1-1-7-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-30998
Published: 2025-08-14
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rico Macchi WP Links Page wp-links-page allows SQL Injection.This issue affects WP Links Page: from n/a through <= 4.9.6.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-links-page/vulnerability/wordpress-wp-links-page-4-9-6-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-31007
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alvind Billplz Addon for Contact Form 7 billplz-for-contact-form-7 allows Reflected XSS.This issue affects Billplz Addon for Contact Form 7: from n/a through <= 1.2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/billplz-for-contact-form-7/vulnerability/wordpress-billplz-addon-for-contact-form-7-plugin-1-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-31425
Published: 2025-08-14
Description: Missing Authorization vulnerability in kamleshyadav WP Lead Capturing Pages leadcapture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Lead Capturing Pages: from n/a through < 2.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/leadcapture/vulnerability/wordpress-wp-lead-capturing-pages-plugin-2-3-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-32288
Published: 2025-08-14
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows PHP Local File Inclusion.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/rt18-extensions/vulnerability/wordpress-rt-theme-18-extensions-plugin-2-4-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-39483
Published: 2025-08-14
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in imithemes Eventer eventer allows Code Injection.This issue affects Eventer: from n/a through < 3.9.9.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/eventer/vulnerability/wordpress-eventer-plugin-3-9-6-shortcode-injection-vulnerability?_s_id=cve
CVE: CVE-2025-39510
Published: 2025-08-14
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Pinterest Automatic Pin wp-pinterest-automatic allows SQL Injection.This issue affects Pinterest Automatic Pin: from n/a through < 4.19.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-pinterest-automatic/vulnerability/wordpress-pinterest-automatic-pin-plugin-4-19-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-3703
Published: 2025-08-14
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wipeoutmedia CSS & JavaScript Toolbox css-javascript-toolbox allows PHP Local File Inclusion.This issue affects CSS & JavaScript Toolbox: from n/a through < 12.0.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/css-javascript-toolbox/vulnerability/wordpress-css-javascript-toolbox-12-0-3-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-47536
Published: 2025-08-14
Description: Deserialization of Untrusted Data vulnerability in keywordrush Content Egg content-egg allows Object Injection.This issue affects Content Egg: from n/a through <= 7.0.0.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/content-egg/vulnerability/wordpress-content-egg-7-0-0-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-47610
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wetail WooCommerce Fortnox Integration woocommerce-fortnox-integration allows Stored XSS.This issue affects WooCommerce Fortnox Integration: from n/a through <= 4.5.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woocommerce-fortnox-integration/vulnerability/wordpress-woocommerce-fortnox-integration-4-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47689
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in johnh10 Video Blogster Lite video-blogster-lite allows Reflected XSS.This issue affects Video Blogster Lite: from n/a through <= 1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/video-blogster-lite/vulnerability/wordpress-video-blogster-lite-plugin-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-48293
Published: 2025-08-14
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dylan Kuhn  Geo Mashup geo-mashup allows PHP Local File Inclusion.This issue affects  Geo Mashup: from n/a through <= 1.13.16.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/geo-mashup/vulnerability/wordpress-geo-mashup-plugin-1-13-16-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-48332
Published: 2025-08-14
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows PHP Local File Inclusion.This issue affects Gutenberg Blocks: from n/a through <= 3.3.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/advanced-gutenberg/vulnerability/wordpress-gutenberg-blocks-3-3-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49033
Published: 2025-08-14
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid  profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid : from n/a through <= 5.9.5.3.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/profilegrid-user-profiles-groups-and-communities/vulnerability/wordpress-profilegrid-5-9-5-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49036
Published: 2025-08-14
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in octagonwebstudio Premium Addons for KingComposer premium-addons-for-kingcomposer allows PHP Local File Inclusion.This issue affects Premium Addons for KingComposer: from n/a through <= 1.1.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/premium-addons-for-kingcomposer/vulnerability/wordpress-premium-addons-for-kingcomposer-plugin-1-1-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49037
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Federico Rota Authentication and xmlrpc log writer authentication-and-xmlrpc-log-writer allows Reflected XSS.This issue affects Authentication and xmlrpc log writer: from n/a through <= 1.2.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/authentication-and-xmlrpc-log-writer/vulnerability/wordpress-authentication-and-xmlrpc-log-writer-plugin-1-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49038
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soflyy WP Dynamic Links wp-dynamic-links allows Reflected XSS.This issue affects WP Dynamic Links: from n/a through <= 1.0.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-dynamic-links/vulnerability/wordpress-wp-dynamic-links-plugin-1-0-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49044
Published: 2025-08-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in tosend.it Simple Poll simple-poll allows Stored XSS.This issue affects Simple Poll: from n/a through <= 1.1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/simple-poll/vulnerability/wordpress-simple-poll-plugin-1-1-1-cross-site-request-forgery-csrf-to-stored-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49047
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in keeross DigitalOcean Spaces Sync do-spaces-sync allows Stored XSS.This issue affects DigitalOcean Spaces Sync: from n/a through <= 2.2.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/do-spaces-sync/vulnerability/wordpress-digitalocean-spaces-sync-plugin-2-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49048
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in inspectlet Inspectlet – User Session Recording and Heatmaps inspectlet-heatmaps-and-user-session-recording allows Stored XSS.This issue affects Inspectlet – User Session Recording and Heatmaps: from n/a through <= 2.0.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/inspectlet-heatmaps-and-user-session-recording/vulnerability/wordpress-inspectlet-user-session-recording-and-heatmaps-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49051
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in biscia7 Hide Text Shortcode hide-text-shortcode allows Stored XSS.This issue affects Hide Text Shortcode: from n/a through <= 1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/hide-text-shortcode/vulnerability/wordpress-hide-text-shortcode-plugin-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49052
Published: 2025-08-14
Description: Missing Authorization vulnerability in Dariolee Netease Music netease-music allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Netease Music: from n/a through <= 3.2.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/netease-music/vulnerability/wordpress-netease-music-plugin-3-2-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49053
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kadesthemes WP Airdrop Manager airdrop allows Stored XSS.This issue affects WP Airdrop Manager: from n/a through <= 1.0.5.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/airdrop/vulnerability/wordpress-wp-airdrop-manager-plugin-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49054
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mrdenny Time Sheets time-sheets allows Reflected XSS.This issue affects Time Sheets: from n/a through <= 2.1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/time-sheets/vulnerability/wordpress-time-sheets-plugin-2-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49056
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shen2 多说社会化评论框 duoshuo allows Reflected XSS.This issue affects 多说社会化评论框: from n/a through <= 1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/duoshuo/vulnerability/wordpress-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49057
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ko Min WP Voting wp-voting allows Reflected XSS.This issue affects WP Voting: from n/a through <= 1.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-voting/vulnerability/wordpress-wp-voting-plugin-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49058
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sound Strategies SoundSt SEO Search soundst-seo-search allows Reflected XSS.This issue affects SoundSt SEO Search: from n/a through <= 1.2.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/soundst-seo-search/vulnerability/wordpress-soundst-seo-search-plugin-1-2-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49059
Published: 2025-08-14
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CleverReach® CleverReach® WP cleverreach-wp allows SQL Injection.This issue affects CleverReach® WP: from n/a through <= 1.5.20.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/cleverreach-wp/vulnerability/wordpress-cleverreach-wp-plugin-1-5-20-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49061
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in perteus Porn Videos Embed porn-videos-embed allows Stored XSS.This issue affects Porn Videos Embed: from n/a through <= 0.9.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/porn-videos-embed/vulnerability/wordpress-porn-videos-embed-plugin-0-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49062
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cornfeed WP-jScrollPane wp-jscrollpane allows Reflected XSS.This issue affects WP-jScrollPane: from n/a through <= 2.0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-jscrollpane/vulnerability/wordpress-wp-jscrollpane-plugin-2-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49063
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in i3geek BaiduXZH Submit(百度熊掌号) i3geek-baiduxzh allows Reflected XSS.This issue affects BaiduXZH Submit(百度熊掌号): from n/a through <= 1.4.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/i3geek-baiduxzh/vulnerability/wordpress-baiduxzh-submit-plugin-1-4-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49064
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webilop User Language Switch user-language-switch allows Reflected XSS.This issue affects User Language Switch: from n/a through <= 1.6.10.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/user-language-switch/vulnerability/wordpress-user-language-switch-plugin-1-6-10-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49065
Published: 2025-08-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BestiaDurmiente Visit Counter visit-counter allows Stored XSS.This issue affects Visit Counter: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/visit-counter/vulnerability/wordpress-visit-counter-plugin-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49264
Published: 2025-08-14
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Cloud Infrastructure Services Cloud SAML SSO - Single Sign On Login cloud-sso-single-sign-on allows PHP Local File Inclusion.This issue affects Cloud SAML SSO - Single Sign On Login: from n/a through <= 1.0.18.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/cloud-sso-single-sign-on/vulnerability/wordpress-cloud-saml-sso-single-sign-on-login-1-0-18-local-file-inclusion-vulnerability?_s_id=cve