deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-1053
Published: 2025-02-14
Description: Under certain error conditions at time of SANnav installation or upgrade, the encryption key can be written into and obtained from a Brocade SANnav supportsave.  An attacker with privileged access to the Brocade SANnav database could use the encryption key to obtain passwords used by Brocade SANnav.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-532
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25399
CVE: CVE-2025-26519
Published: 2025-02-14
Description: musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787
References: https://git.musl-libc.org/cgit/musl/commit/?id=c47ad25ea3b484e10326f933e927c0bc8cded3da; https://git.musl-libc.org/cgit/musl/commit/?id=e5adcd97b5196e29991b524237381a0202a60659; https://www.openwall.com/lists/oss-security/2025/02/13/2
CVE: CVE-2024-2240
Published: 2025-02-14
Description: Docker daemon in Brocade SANnav before SANnav 2.3.1b runs without auditing. The vulnerability could allow a remote authenticated attacker to execute various attacks.
CVSS Score: 7.2 (HIGH)
CWE: CWE-250
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25401
CVE: CVE-2025-23406
Published: 2025-02-14
Description: Out-of-bounds read vulnerability caused by improper checking of TCP MSS option values exists in Cente middleware TCP/IP Network Series, which may lead to processing a specially crafted packet to cause the affected product crashed.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://jvn.jp/en/vu/JVNVU92227620/; https://www.cente.jp/obstacle/5451/
CVE: CVE-2024-13493
Published: 2025-02-14
Description: The Sensly Online Presence WordPress plugin through 0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/dfbdd474-92e5-422b-a185-e441a6014557/
CVE: CVE-2024-13641
Published: 2025-02-14
Description: The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the 'attachment' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/attachment directory which can contain file attachments for order refunds.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/woo-refund-and-exchange-lite/trunk/common/class-woo-refund-and-exchange-lite-common.php#L127; https://plugins.trac.wordpress.org/changeset/3236486/; https://www.wordfence.com/threat-intel/vulnerabilities/id/5f88a21d-28a9-4c91-9bf9-6b69f6a420e8?source=cve
CVE: CVE-2024-13692
Published: 2025-02-14
Description: The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.4.5 via several functions due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite linked refund image attachments, overwrite refund request message, overwrite order messages, and read order messages of other users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-285, CWE-639
References: https://plugins.trac.wordpress.org/browser/woo-refund-and-exchange-lite/trunk/common/class-woo-refund-and-exchange-lite-common.php#L127; https://plugins.trac.wordpress.org/browser/woo-refund-and-exchange-lite/trunk/common/class-woo-refund-and-exchange-lite-common.php#L186; https://plugins.trac.wordpress.org/browser/woo-refund-and-exchange-lite/trunk/common/class-woo-refund-and-exchange-lite-common.php#L374
CVE: CVE-2024-7052
Published: 2025-02-14
Description: The Forminator Forms  WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/4e52cab5-821c-4ca8-9024-67f716cf78fe/
CVE: CVE-2024-57969
Published: 2025-02-14
Description: app/Model/Attribute.php in MISP before 2.4.198 ignores an ACL during a GUI attribute search.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://github.com/MISP/MISP/commit/4f27f83a775aba4d3cca9255f69c3c9998b7df7f; https://github.com/MISP/MISP/compare/v2.4.197...v2.4.198
CVE: CVE-2024-9601
Published: 2025-02-14
Description: The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’  and 'UniqueID' parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2025-26767 is a duplicate of this issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/qubely/trunk/core/blocks/postgrid.php#L1419; https://plugins.trac.wordpress.org/changeset/3235188/; https://www.wordfence.com/threat-intel/vulnerabilities/id/58387a60-ef68-4911-9349-97b0f7e7726f?source=cve
CVE: CVE-2025-22630
Published: 2025-02-14
Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Marketing Fire Widget Options widget-options allows OS Command Injection.This issue affects Widget Options: from n/a through <= 4.1.0.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-77
References: https://patchstack.com/database/Wordpress/Plugin/widget-options/vulnerability/wordpress-widget-options-plugin-4-1-0-arbitrary-code-execution-vulnerability?_s_id=cve
CVE: CVE-2025-1298
Published: 2025-02-14
Description: Logic vulnerability in the mobile application (com.transsion.carlcare) may lead to the risk of account takeover.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-290
References: https://security.tecno.com/SRC/blogdetail/383?lang=en_US; https://security.tecno.com/SRC/securityUpdates
CVE: CVE-2025-26788
Published: 2025-02-14
Description: StrongKey FIDO Server before 4.15.1 treats a non-discoverable (namedcredential) flow as a discoverable transaction.
CVSS Score: 8.4 (HIGH)
CWE: CWE-639
References: https://docs.strongkey.com/index.php/skfs-v3/skfs-release-notes; https://www.securing.pl/en/cve-2025-26788-passkey-authentication-bypass-in-strongkey-fido-server/
CVE: CVE-2025-26789
Published: 2025-02-14
Description: An issue was discovered in Logpoint AgentX before 1.5.0. A vulnerability caused by limited access controls allowed li-admin users to access sensitive information about AgentX Manager in a Logpoint deployment.
CWE: CWE-1336
References: https://servicedesk.logpoint.com/hc/en-us/articles/[PII_REDACTED]5741-Unauthorized-information-access-due-to-inadequate-access-controls
CVE: CVE-2025-26791
Published: 2025-02-14
Description: DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-79
References: https://ensy.zip/posts/dompurify-323-bypass/; https://github.com/cure53/DOMPurify/commit/d18ffcb554e[PII_REDACTED]da03ac75dd7829f0f02; https://github.com/cure53/DOMPurify/releases/tag/3.2.4
CVE: CVE-2024-13735
Published: 2025-02-14
Description: The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.11.2 due to insufficient input sanitization and output escaping of a campaign name. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://docs.hurrytimer.com/getting-started/creating-a-one-time-campaign; https://plugins.trac.wordpress.org/changeset/3239755/; https://wordpress.org/plugins/hurrytimer/#developers
CVE: CVE-2024-52577
Published: 2025-02-14
Description: In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose class is present in the Ignite server classpath and sends it to Ignite server endpoints. Deserialization of such a message by the Ignite server may result in the execution of arbitrary code on the Apache Ignite server side.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-502
References: https://lists.apache.org/thread/1bst0n27m9kb3b6f6hvlghn182vqb2hh; http://www.openwall.com/lists/oss-security/2025/02/14/2
CVE: CVE-2024-13791
Published: 2025-02-14
Description: Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://github.com/WordPressBugBounty/plugins-bit-assist/blob/main/bit-assist/backend/app/HTTP/Controllers/DownloadController.php; https://plugins.trac.wordpress.org/changeset/3239816/#file3; https://wordpress.org/plugins/bit-assist/#developers
CVE: CVE-2025-0821
Published: 2025-02-14
Description: Bit Assist plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://plugins.trac.wordpress.org/browser/bit-assist/tags/1.5.2/backend/app/HTTP/Controllers/WidgetChannelController.php#L89; https://plugins.trac.wordpress.org/changeset/3239816/#file5; https://wordpress.org/plugins/bit-assist/#developers
CVE: CVE-2025-26522
Published: 2025-02-14
Description: This vulnerability exists in RupeeWeb trading platform due to improper implementation of OTP validation mechanism in certain API endpoints. A remote attacker with valid credentials could exploit this vulnerability by manipulating API responses.  

Successful exploitation of this vulnerability could allow the attacker to bypass Two-Factor Authentication (2FA) for other user accounts.
CWE: CWE-302
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0020
CVE: CVE-2025-26523
Published: 2025-02-14
Description: This vulnerability exists in RupeeWeb trading platform due to insufficient authorization controls on certain API endpoints handling addition and deletion operations. Successful exploitation of this vulnerability could allow an authenticated remote attacker to modify information belonging to other user accounts.
CWE: CWE-266
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0020
CVE: CVE-2025-26524
Published: 2025-02-14
Description: This vulnerability exists in RupeeWeb trading platform due to missing rate limiting on OTP requests in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoints which could lead to the OTP bombing/ flooding on the targeted system.
CWE: CWE-799
References: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0020
CVE: CVE-2024-13152
Published: 2025-02-14
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BSS Software Mobuy Online Machinery Monitoring Panel allows SQL Injection.This issue affects Mobuy Online Machinery Monitoring Panel: before 2.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-25-0033
CVE: CVE-2024-52500
Published: 2025-02-14
Description: Missing Authorization vulnerability in monetagwp Monetag Official Plugin monetag-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Monetag Official Plugin: from n/a through <= 1.1.3.
CVSS Score: 7.2 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/monetag-official/vulnerability/wordpress-monetag-official-plugin-plugin-1-1-3-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-0867
Published: 2025-02-14
Description: The standard user uses the run as function to start the MEAC applications with administrative privileges. To ensure that the system can startup on its own, the credentials of the administrator were stored. Consequently, the EPC2 user can execute any command with administrative privileges. This allows a privilege escalation to the administrative level.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-522
References: https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF; https://sick.com/psirt; https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
CVE: CVE-2025-22698
Published: 2025-02-14
Description: Missing Authorization vulnerability in Ability, Inc Accessibility Suite online-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Suite: from n/a through <= 4.18.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/online-accessibility/vulnerability/wordpress-accessibility-suite-by-ability-inc-plugin-4-16-multiple-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22702
Published: 2025-02-14
Description: Missing Authorization vulnerability in ThemeGoods Photography photography allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photography: from n/a through <= 7.7.2.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Theme/photography/vulnerability/wordpress-photography-theme-7-5-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-22705
Published: 2025-02-14
Description: Cross-Site Request Forgery (CSRF) vulnerability in godthor Disqus Popular Posts disqus-popular-posts allows Reflected XSS.This issue affects Disqus Popular Posts: from n/a through <= 2.1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/disqus-popular-posts/vulnerability/wordpress-disqus-popular-posts-plugin-2-1-1-csrf-to-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23428
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arash Safari QMean – WordPress Did You Mean qmean allows Reflected XSS.This issue affects QMean – WordPress Did You Mean: from n/a through <= 2.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/qmean/vulnerability/wordpress-qmean-plugin-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23431
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in khaninejad Envato Affiliater envato-affiliater allows Reflected XSS.This issue affects Envato Affiliater: from n/a through <= 1.2.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/envato-affiliater/vulnerability/wordpress-envato-affiliater-plugin-1-2-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23474
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mike Martel Live Dashboard live-dashboard allows Reflected XSS.This issue affects Live Dashboard: from n/a through <= 0.3.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/live-dashboard/vulnerability/wordpress-live-dashboard-plugin-0-3-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23492
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CantonBolo WordPress 淘宝客插件 taobaoke allows Reflected XSS.This issue affects WordPress 淘宝客插件: from n/a through <= 1.1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/taobaoke/vulnerability/wordpress-plugin-1-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23523
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hoststreamsell HSS Embed Streaming Video hss-embed-streaming-video allows Reflected XSS.This issue affects HSS Embed Streaming Video: from n/a through <= 3.23.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/hss-embed-streaming-video/vulnerability/wordpress-hss-embed-streaming-video-plugin-3-23-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23525
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kvvaradha Kv Compose Email From Dashboard kv-send-email-from-admin allows Reflected XSS.This issue affects Kv Compose Email From Dashboard: from n/a through <= 1.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/kv-send-email-from-admin/vulnerability/wordpress-kv-compose-email-from-dashboard-plugin-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23534
Published: 2025-02-14
Description: Missing Authorization vulnerability in Mark Winiarski WPLingo wplingo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLingo: from n/a through <= 1.1.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wplingo/vulnerability/wordpress-wplingo-plugin-1-1-2-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-23568
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fredsted WP Login Attempt Log wp-login-attempt-log allows Reflected XSS.This issue affects WP Login Attempt Log: from n/a through <= 1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-login-attempt-log/vulnerability/wordpress-wp-login-attempt-log-plugin-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23571
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in makong Internal Links Generator internal-links-generator allows Reflected XSS.This issue affects Internal Links Generator: from n/a through <= 3.51.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/internal-links-generator/vulnerability/wordpress-internal-links-generator-plugin-3-51-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23598
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in craig.edmunds@gmail.com Recip.ly reciply allows Reflected XSS.This issue affects Recip.ly: from n/a through <= 1.1.8.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/reciply/vulnerability/wordpress-recip-ly-plugin-1-1-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23646
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Brooks Library Instruction Recorder library-instruction-recorder allows Reflected XSS.This issue affects Library Instruction Recorder: from n/a through <= 1.1.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/library-instruction-recorder/vulnerability/wordpress-library-instruction-recorder-plugin-1-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23647
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ariagle WP-Clap wp-clap allows Reflected XSS.This issue affects WP-Clap: from n/a through <= 1.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-clap/vulnerability/wordpress-wp-clap-plugin-1-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23648
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wjharil AdsMiddle adsmiddle allows Reflected XSS.This issue affects AdsMiddle: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/adsmiddle/vulnerability/wordpress-adsmiddle-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23650
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in razvypp Tidy.ro tidyro allows Reflected XSS.This issue affects Tidy.ro: from n/a through <= 1.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/tidyro/vulnerability/wordpress-tidy-ro-plugin-1-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23651
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in adamskaat Scroll Top scroll-to-top-builder allows Reflected XSS.This issue affects Scroll Top: from n/a through <= 1.3.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/scroll-to-top-builder/vulnerability/wordpress-scroll-top-plugin-1-3-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23652
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fabio Zuanon Add custom content after post add-custom-content-after-post allows Reflected XSS.This issue affects Add custom content after post: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/add-custom-content-after-post/vulnerability/wordpress-add-custom-content-after-post-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-23653
Published: 2025-02-14
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nabeel Tahir Form To Online Booking cf7-calendly-integration allows Reflected XSS.This issue affects Form To Online Booking: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/cf7-calendly-integration/vulnerability/wordpress-form-to-online-booking-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve