deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-12621
Published: 2025-01-09
Description: The Yumpu E-Paper publishing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'YUMPU' shortcode in all versions up to, and including, 3.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/yumpu-epaper-publishing/tags/3.0.8/lib/Shortcode.php#L24; https://plugins.trac.wordpress.org/browser/yumpu-epaper-publishing/tags/3.0.8/lib/Shortcode.php#L81; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3223423%40yumpu-epaper-publishing&new=3223423%40yumpu-epaper-publishing&sfp_email=&sfph_mail=
CVE: CVE-2024-12819
Published: 2025-01-09
Description: The Searchie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sio_embed_media' shortcode in all versions up to, and including, 1.17.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/searchie/trunk/SIO/Shortcodes/WidgetsEmbed.php; https://wordpress.org/plugins/searchie/; https://www.wordfence.com/threat-intel/vulnerabilities/id/8abed8c7-0c3f-4054-a116-82ce47d605de?source=cve
CVE: CVE-2024-12848
Published: 2025-01-09
Description: The SKT Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the 'addLibraryByArchive' function in all versions up to, and including, 4.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files that make remote code execution possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/skt-builder/trunk/sktbuilder.php#L960; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3213786%40skt-builder&new=3213786%40skt-builder&sfp_email=&sfph_mail=; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3218995%40skt-builder&new=3218995%40skt-builder&sfp_email=&sfph_mail=
CVE: CVE-2024-5769
Published: 2025-01-09
Description: The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add, update, and delete shipper tracking settings.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/mimo-woocommerce-order-tracking/tags/1.0.2/mimo-woocommerce-order-tracking.php#L137; https://plugins.trac.wordpress.org/browser/mimo-woocommerce-order-tracking/tags/1.0.2/mimo-woocommerce-order-tracking.php#L264; https://plugins.trac.wordpress.org/browser/mimo-woocommerce-order-tracking/tags/1.0.2/mimo-woocommerce-order-tracking.php#L292
CVE: CVE-2024-6155
Published: 2025-01-09
Description: The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to, and including, 9.0.0 due to a missing capability check in the greenshift_download_file_localy function, along with no SSRF protection and sanitization on uploaded SVG files. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application that can also be leveraged to download malicious SVG files containing Cross-Site Scripting payloads to the server. On Cloud-based servers, attackers could retrieve the instance metadata. The issue was partially patched in version 8.9.9 and fully patched in version 9.0.1.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-862, CWE-79, CWE-918
References: https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/tags/8.9.8/settings.php#L1385; https://www.wordfence.com/threat-intel/vulnerabilities/id/fe3cfaf4-67c8-47af-bd58-e8ad27a03fae?source=cve
CVE: CVE-2025-0349
Published: 2025-01-09
Description: A vulnerability classified as critical has been found in Tenda AC6 15.03.05.16. Affected is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument src/mac leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-121, CWE-787
References: https://github.com/wy876/cve/issues/5; https://vuldb.com/?ctiid.290862; https://vuldb.com/?id.290862
CVE: CVE-2022-22491
Published: 2025-01-09
Description: IBM App Connect Enterprise Certified Container 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, and 12.4 operands running in Red Hat OpenShift do not restrict writing to the local filesystem, which may result in exhausting the available storage in a Pod, resulting in that Pod being restarted.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://www.ibm.com/support/pages/node/7180500
CVE: CVE-2024-43176
Published: 2025-01-09
Description: IBM OpenPages 9.0 could allow an authenticated user to obtain sensitive information such as configurations that should only be available to privileged users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-282
References: https://www.ibm.com/support/pages/node/7174640
CVE: CVE-2023-24010
Published: 2025-01-09
Description: An attacker can arbitrarily craft malicious DDS Participants (or ROS 2 Nodes) with valid certificates to compromise and get full control of the attacked secure DDS databus system by exploiting vulnerable attributes in the configuration of PKCS#7 certificate’s validation. This is caused by a non-compliant implementation of permission document verification used by some DDS vendors. Specifically, an improper use of the OpenSSL PKCS7_verify function used to validate S/MIME signatures.
CVSS Score: 8.2 (HIGH)
CWE: CWE-200
References: https://gist.github.com/vmayoral/235c02d0b0ef85a29812eff6980ff80d; https://github.com/ros2/sros2/issues/282; https://gist.github.com/vmayoral/235c02d0b0ef85a29812eff6980ff80d
CVE: CVE-2023-24011
Published: 2025-01-09
Description: An attacker can arbitrarily craft malicious DDS Participants (or ROS 2 Nodes) with valid certificates to compromise and get full control of the attacked secure DDS databus system by exploiting vulnerable attributes in the configuration of PKCS#7 certificate’s validation. This is caused by a non-compliant implementation of permission document verification used by some DDS vendors. Specifically, an improper use of the OpenSSL PKCS7_verify function used to validate S/MIME signatures.
CVSS Score: 8.2 (HIGH)
CWE: CWE-200
References: https://gist.github.com/vmayoral/235c02d0b0ef85a29812eff6980ff80d; https://github.com/ros2/sros2/issues/282; https://gist.github.com/vmayoral/235c02d0b0ef85a29812eff6980ff80d
CVE: CVE-2023-24012
Published: 2025-01-09
Description: An attacker can arbitrarily craft malicious DDS Participants (or ROS 2 Nodes) with valid certificates to compromise and get full control of the attacked secure DDS databus system by exploiting vulnerable attributes in the configuration of PKCS#7 certificate’s validation. This is caused by a non-compliant implementation of permission document verification used by some DDS vendors. Specifically, an improper use of the OpenSSL PKCS7_verify function used to validate S/MIME signatures.
CVSS Score: 8.2 (HIGH)
CWE: CWE-200
References: https://gist.github.com/vmayoral/235c02d0b0ef85a29812eff6980ff80d; https://github.com/ros2/sros2/issues/282; https://gist.github.com/vmayoral/235c02d0b0ef85a29812eff6980ff80d
CVE: CVE-2024-10106
Published: 2025-01-09
Description: A buffer overflow vulnerability in the packet handoff plugin allows an attacker to overwrite memory outside the plugin's buffer.
CVSS Score: 3.7 (LOW)
References: https://community.silabs.com/069Vm00000I1JawIAF; https://github.com/SiliconLabs/simplicity_sdk/releases
CVE: CVE-2025-22295
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto tripetto allows Stored XSS.This issue affects WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: from n/a through <= 8.0.6.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/tripetto/vulnerability/wordpress-tripetto-plugin-8-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22307
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam Product Table for WooCommerce woo-product-table allows Reflected XSS.This issue affects Product Table for WooCommerce: from n/a through <= 4.0.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woo-product-table/vulnerability/wordpress-product-table-for-woocommerce-plugin-3-5-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22313
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light allows Reflected XSS.This issue affects Widgetize Pages Light: from n/a through <= 3.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/widgetize-pages-light/vulnerability/wordpress-widgetize-pages-light-plugin-3-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22330
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahesh Waghmare MG Parallax Slider mg-parallax-slider allows Reflected XSS.This issue affects MG Parallax Slider: from n/a through <= 1.0..
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mg-parallax-slider/vulnerability/wordpress-mg-parallax-slider-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22331
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in P3JX Cf7Save Extension cf7save-extension allows Reflected XSS.This issue affects Cf7Save Extension: from n/a through <= 1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cf7save-extension/vulnerability/wordpress-cf7save-extension-plugin-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22345
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tsinf TS Comfort DB ts-comfort-database allows Reflected XSS.This issue affects TS Comfort DB: from n/a through <= 2.0.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ts-comfort-database/vulnerability/wordpress-ts-comfort-db-plugin-2-0-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22361
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Opentracker Opentracker Analytics opentracker-analytics allows Reflected XSS.This issue affects Opentracker Analytics: from n/a through <= 1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/opentracker-analytics/vulnerability/wordpress-opentracker-analytics-plugin-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22504
Published: 2025-01-09
Description: Unrestricted Upload of File with Dangerous Type vulnerability in jumpdemand 4ECPS Web Forms 4ecps-webforms allows Upload a Web Shell to a Web Server.This issue affects 4ECPS Web Forms: from n/a through <= 0.2.18.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/4ecps-webforms/vulnerability/wordpress-4ecps-web-forms-plugin-0-2-18-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-22505
Published: 2025-01-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crispweb NC Wishlist for Woocommerce nc-wishlist-for-woocommerce allows SQL Injection.This issue affects NC Wishlist for Woocommerce: from n/a through <= 1.0.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/nc-wishlist-for-woocommerce/vulnerability/wordpress-nc-wishlist-for-woocommerce-plugin-1-0-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-22508
Published: 2025-01-09
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in roninwp FAT Event Lite fat-event-lite allows PHP Local File Inclusion.This issue affects FAT Event Lite: from n/a through <= 1.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/fat-event-lite/vulnerability/wordpress-fat-event-lite-plugin-1-1-unauthenticated-non-arbitrary-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-22510
Published: 2025-01-09
Description: Deserialization of Untrusted Data vulnerability in kkarpieszuk WC Price History for Omnibus wc-price-history allows Object Injection.This issue affects WC Price History for Omnibus: from n/a through <= 2.1.4.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/wc-price-history/vulnerability/wordpress-wc-price-history-for-omnibus-plugin-2-1-4-php-object-injection-vulnerability?_s_id=cve
CVE: CVE-2025-22521
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Farrell wp Hosting Performance Check wp-hosting-performance-check allows Reflected XSS.This issue affects wp Hosting Performance Check: from n/a through <= 2.18.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-hosting-performance-check/vulnerability/wordpress-wp-hosting-performance-check-plugin-2-18-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22527
Published: 2025-01-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yamna Khawaja Mailing Group Listserv wp-mailing-group allows SQL Injection.This issue affects Mailing Group Listserv: from n/a through <= 2.0.9.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-mailing-group/vulnerability/wordpress-mailing-group-listserv-plugin-2-0-9-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-22535
Published: 2025-01-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jonkern WPListCal wplistcal allows SQL Injection.This issue affects WPListCal: from n/a through <= 1.3.5.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wplistcal/vulnerability/wordpress-wplistcal-plugin-1-3-5-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-22537
Published: 2025-01-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in traveller11 Google Maps Travel Route google-maps-travel-route allows SQL Injection.This issue affects Google Maps Travel Route: from n/a through <= 1.3.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/google-maps-travel-route/vulnerability/wordpress-google-maps-travel-route-plugin-1-3-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-22539
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ka2 Custom DataBase Tables custom-database-tables allows Reflected XSS.This issue affects Custom DataBase Tables: from n/a through <= 2.1.34.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/custom-database-tables/vulnerability/wordpress-custom-database-tables-plugin-2-1-34-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22540
Published: 2025-01-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in seballero Emailing Subscription email-suscripcion allows Blind SQL Injection.This issue affects Emailing Subscription: from n/a through <= 1.4.1.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/email-suscripcion/vulnerability/wordpress-emailing-subscription-plugin-1-4-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-22542
Published: 2025-01-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ofek Nakar Virtual Bot virtual-bot allows Blind SQL Injection.This issue affects Virtual Bot: from n/a through <= 1.0.0.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/virtual-bot/vulnerability/wordpress-virtual-bot-plugin-1-0-0-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-22561
Published: 2025-01-09
Description: Missing Authorization vulnerability in kbowson Title Experiments Free wp-experiments-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Title Experiments Free: from n/a through <= 9.0.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wp-experiments-free/vulnerability/wordpress-title-experiments-free-plugin-9-0-4-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22594
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hccoder Better User Shortcodes better-user-shortcodes allows Reflected XSS.This issue affects Better User Shortcodes: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/better-user-shortcodes/vulnerability/wordpress-better-user-shortcodes-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22595
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yamna Khawaja Mailing Group Listserv wp-mailing-group allows Reflected XSS.This issue affects Mailing Group Listserv: from n/a through <= 2.0.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-mailing-group/vulnerability/wordpress-mailing-group-listserv-plugin-2-0-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22801
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes Free WooCommerce Theme 99fy Extension 99fy-core allows Stored XSS.This issue affects Free WooCommerce Theme 99fy Extension: from n/a through <= 1.2.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/99fy-core/vulnerability/wordpress-free-woocommerce-theme-99fy-extension-plugin-1-2-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22802
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail yeemail allows Stored XSS.This issue affects Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail: from n/a through <= 2.1.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/yeemail/vulnerability/wordpress-email-templates-customizer-yeemail-plugin-2-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22803
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Advanced Product Information for WooCommerce woo-advanced-product-information allows Stored XSS.This issue affects Advanced Product Information for WooCommerce: from n/a through <= 1.1.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/woo-advanced-product-information/vulnerability/wordpress-advanced-product-information-for-woocommerce-plugin-1-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22804
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Stored XSS.This issue affects Author Avatars List/Block: from n/a through <= 2.1.23.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/author-avatars/vulnerability/wordpress-author-avatars-list-block-plugin-2-1-23-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22805
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Skill Bar skillbars allows Stored XSS.This issue affects Skill Bar: from n/a through <= 1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/skillbars/vulnerability/wordpress-skill-bar-plugin-1-2-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22806
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor black-widgets allows DOM-Based XSS.This issue affects Black Widgets For Elementor: from n/a through <= 1.3.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/black-widgets/vulnerability/wordpress-black-widgets-for-elementor-plugin-1-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22807
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Responsive Flickr Slideshow mobile-friendly-flickr-slideshow allows Stored XSS.This issue affects Responsive Flickr Slideshow: from n/a through <= 2.6.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/mobile-friendly-flickr-slideshow/vulnerability/wordpress-responsive-flickr-slideshow-plugin-2-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-22808
Published: 2025-01-09
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Surbma Surbma | Premium WP surbma-premium-wp allows DOM-Based XSS.This issue affects Surbma | Premium WP: from n/a through <= 9.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/surbma-premium-wp/vulnerability/wordpress-surbma-premium-wp-plugin-9-0-cross-site-scripting-xss-vulnerability?_s_id=cve