deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-53569
Published: 2025-07-04
Description: Cross-Site Request Forgery (CSRF) vulnerability in Trust Payments Trust Payments Gateway for WooCommerce (JavaScript Library) trust-payments-gateway-3ds2 allows Cross Site Request Forgery.This issue affects Trust Payments Gateway for WooCommerce (JavaScript Library): from n/a through <= 1.3.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/trust-payments-gateway-3ds2/vulnerability/wordpress-trust-payments-gateway-for-woocommerce-javascript-library-plugin-1-3-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-5351
Published: 2025-07-04
Description: A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-415
References: https://access.redhat.com/security/cve/CVE-2025-5351; https://bugzilla.redhat.com/show_bug.cgi?id=2369367
CVE: CVE-2025-5920
Published: 2025-07-04
Description: The Sharable Password Protected Posts before version 1.1.1 allows access to password protected posts by providing a secret key in a GET parameter. However, the key is exposed by the REST API.
CVSS Score: 7.5 (HIGH)
References: https://wpscan.com/vulnerability/dddd6074-1e1f-441f-86f7-316c30262c70/; https://wpscan.com/vulnerability/dddd6074-1e1f-441f-86f7-316c30262c70/
CVE: CVE-2025-38174
Published: 2025-07-04
Description: In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Do not double dequeue a configuration request

Some of our devices crash in tb_cfg_request_dequeue():

 general protection fault, probably for non-canonical address 0xdead[PII_REDACTED]22

 CPU: 6 PID: 91007 Comm: kworker/6:2 Tainted: G U W 6.6.65
 RIP: 0010:tb_cfg_request_dequeue+0x2d/0xa0
 Call Trace:
 <TASK>
 ? tb_cfg_request_dequeue+0x2d/0xa0
 tb_cfg_request_work+0x33/0x80
 worker_thread+0x386/0x8f0
 kthread+0xed/0x110
 ret_from_fork+0x38/0x50
 ret_from_fork_asm+0x1b/0x30

The circumstances are unclear, however, the theory is that
tb_cfg_request_work() can be scheduled twice for a request:
first time via frame.callback from ring_work() and second
time from tb_cfg_request().  Both times kworkers will execute
tb_cfg_request_dequeue(), which results in double list_del()
from the ctl->request_queue (the list poison deference hints
at it: 0xdead[PII_REDACTED]22).

Do not dequeue requests that don't have TB_CFG_REQUEST_ACTIVE
bit set.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0771bcbe2f6e5d5f263cf466efe571d2754a46da; https://git.kernel.org/stable/c/0a3011d47dbc92a33621861c423cb64833d7fe57; https://git.kernel.org/stable/c/0f73628e9da1ee39daf5f188190cdbaee5e0c98c
CVE: CVE-2025-38175
Published: 2025-07-04
Description: In the Linux kernel, the following vulnerability has been resolved:

binder: fix yet another UAF in binder_devices

Commit e77aff5528a18 ("binderfs: fix use-after-free in binder_devices")
addressed a use-after-free where devices could be released without first
being removed from the binder_devices list. However, there is a similar
path in binder_free_proc() that was missed:

  ==================================================================
  BUG: KASAN: slab-use-after-free in binder_remove_device+0xd4/0x100
  Write of size 8 at addr ffff0000c773b900 by task umount/467
  CPU: 12 UID: 0 PID: 467 Comm: umount Not tainted 6.15.0-rc7-00138-g57483a362741 #9 PREEMPT
  Hardware name: linux,dummy-virt (DT)
  Call trace:
   binder_remove_device+0xd4/0x100
   binderfs_evict_inode+0x230/0x2f0
   evict+0x25c/0x5dc
   iput+0x304/0x480
   dentry_unlink_inode+0x208/0x46c
   __dentry_kill+0x154/0x530
   [...]

  Allocated by task 463:
   __kmalloc_cache_noprof+0x13c/0x324
   binderfs_binder_device_create.isra.0+0x138/0xa60
   binder_ctl_ioctl+0x1ac/0x230
  [...]

  Freed by task 215:
   kfree+0x184/0x31c
   binder_proc_dec_tmpref+0x33c/0x4ac
   binder_deferred_func+0xc10/0x1108
   process_one_work+0x520/0xba4
  [...]
  ==================================================================

Call binder_remove_device() within binder_free_proc() to ensure the
device is removed from the binder_devices list before being kfreed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/4a7694f499cae5b83412c5281bf2c961f34f2ed6; https://git.kernel.org/stable/c/72a726fb5f25fbb31d6060acfb671c[PII_REDACTED]; https://git.kernel.org/stable/c/9857af0fcff385c75433f2162c30c62eb912ef6d
CVE: CVE-2025-7060
Published: 2025-07-04
Description: A vulnerability was found in Monitorr up to 1.7.6m. It has been classified as problematic. This affects an unknown part of the file assets/config/_installation/mkdbajax.php of the component Installer. The manipulation of the argument datadir leads to improper input validation. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-20
References: https://vuldb.com/?ctiid.314835; https://vuldb.com/?id.314835; https://vuldb.com/?submit.602080
CVE: CVE-2025-23970
Published: 2025-07-04
Description: Incorrect Privilege Assignment vulnerability in aonetheme Service Finder Booking sf-booking allows Privilege Escalation.This issue affects Service Finder Booking: from n/a through <= 6.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Plugin/sf-booking/vulnerability/wordpress-service-finder-booking-6-0-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-24771
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Content Manager Light content-manager-light allows Reflected XSS.This issue affects Content Manager Light: from n/a through <= 3.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/content-manager-light/vulnerability/wordpress-content-manager-light-plugin-3-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-24780
Published: 2025-07-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce printcart-integration allows SQL Injection.This issue affects Printcart Web to Print Product Designer for WooCommerce: from n/a through <= 2.4.0.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/printcart-integration/vulnerability/wordpress-printcart-web-to-print-product-designer-for-woocommerce-2-3-9-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-28968
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladimir Prelovac WP Wall wp-wall allows Reflected XSS.This issue affects WP Wall: from n/a through <= 1.7.3.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-wall/vulnerability/wordpress-wp-wall-plugin-1-7-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28976
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dsrodzin Email Address Security by WebEmailProtector webemailprotector allows Stored XSS.This issue affects Email Address Security by WebEmailProtector: from n/a through <= 3.3.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/webemailprotector/vulnerability/wordpress-email-address-security-by-webemailprotector-3-3-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28978
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hung Trang Si SB Breadcrumbs sb-breadcrumbs allows Reflected XSS.This issue affects SB Breadcrumbs: from n/a through <= 1.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/sb-breadcrumbs/vulnerability/wordpress-sb-breadcrumbs-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-28980
Published: 2025-07-04
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in machouinard Aviation Weather from NOAA aviation-weather-from-noaa allows Path Traversal.This issue affects Aviation Weather from NOAA: from n/a through <= 0.7.2.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/aviation-weather-from-noaa/vulnerability/wordpress-aviation-weather-from-noaa-0-7-2-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE: CVE-2025-28983
Published: 2025-07-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Click & Pledge Connect allows Privilege Escalation. This issue affects Click & Pledge Connect: from 25.04010101 through WP6.8.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://patchstack.com/database/wordpress/plugin/click-pledge-connect/vulnerability/wordpress-click-pledge-connect-plugin-25-04010101-wp6-8-privilege-escalation-via-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-30933
Published: 2025-07-04
Description: Unrestricted Upload of File with Dangerous Type vulnerability in LiquidThemes LogisticsHub logistics-hub allows Upload a Web Shell to a Web Server.This issue affects LogisticsHub: from n/a through <= 1.1.6.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Theme/logistics-hub/vulnerability/wordpress-logisticshub-1-1-6-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-31037
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey homey allows Reflected XSS.This issue affects Homey: from n/a through <= 2.4.5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/homey/vulnerability/wordpress-homey-theme-2-4-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-32297
Published: 2025-07-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows SQL Injection.This issue affects Simple Link Directory: from n/a through < 14.8.1.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/qc-simple-link-directory/vulnerability/wordpress-simple-link-directory-pro-plugin-14-7-3-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-32311
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs Pressroom pressroom allows Reflected XSS.This issue affects Pressroom: from n/a through <= 7.0.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/pressroom/vulnerability/wordpress-pressroom-news-magazine-wordpress-theme-theme-6-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-39487
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ValvePress Rankie valvepress-rankie allows Reflected XSS.This issue affects Rankie: from n/a through <= 1.8.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/valvepress-rankie/vulnerability/wordpress-rankie-plugin-1-8-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-47479
Published: 2025-07-04
Description: Weak Authentication vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Authentication Abuse.This issue affects WP Compress: from n/a through <= 6.30.30.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1390
References: https://patchstack.com/database/Wordpress/Plugin/wp-compress-image-optimizer/vulnerability/wordpress-wp-compress-6-30-30-broken-authentication-vulnerability?_s_id=cve
CVE: CVE-2025-47565
Published: 2025-07-04
Description: Missing Authorization vulnerability in ashanjay EventON eventon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventON: from n/a through <= 4.9.9.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/eventon/vulnerability/wordpress-eventon-plugin-4-9-9-broken-access-control-vulnerability-2?_s_id=cve
CVE: CVE-2025-47627
Published: 2025-07-04
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LCweb PrivateContent - Mail Actions allows PHP Local File Inclusion. This issue affects PrivateContent - Mail Actions: from n/a through 2.3.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/wordpress/plugin/private-content-mail-actions/vulnerability/wordpress-privatecontent-mail-actions-plugin-2-3-2-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-47634
Published: 2025-07-04
Description: Missing Authorization vulnerability in Keylor Mendoza WC Pickup Store wc-pickup-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Pickup Store: from n/a through <= 1.8.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/wc-pickup-store/vulnerability/wordpress-wc-pickup-store-1-8-9-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-48231
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar-contact-form allows Stored XSS.This issue affects Booking Calendar Contact Form: from n/a through <= 1.2.58.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/booking-calendar-contact-form/vulnerability/wordpress-booking-calendar-contact-form-1-2-58-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49070
Published: 2025-07-04
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Elessi elessi-theme allows PHP Local File Inclusion.This issue affects Elessi: from n/a through < 6.4.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Theme/elessi-theme/vulnerability/wordpress-elessi-6-4-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49245
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmoreira Testimonials Showcase testimonials-showcase allows Reflected XSS.This issue affects Testimonials Showcase: from n/a through <= 1.9.16.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/testimonials-showcase/vulnerability/wordpress-testimonials-showcase-plugin-1-9-16-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49247
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmoreira Team Showcase team-showcase-cm allows DOM-Based XSS.This issue affects Team Showcase: from n/a through < 25.05.13.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/team-showcase-cm/vulnerability/wordpress-team-showcase-plugin-25-05-13-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49274
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awordpresslife Neom Blog neom-blog allows Reflected XSS.This issue affects Neom Blog: from n/a through <= 0.0.9.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Theme/neom-blog/vulnerability/wordpress-neom-blog-theme-0-0-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49302
Published: 2025-07-04
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Scott Paterson Easy Stripe easy-stripe allows Remote Code Inclusion.This issue affects Easy Stripe: from n/a through <= 1.1.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Plugin/easy-stripe/vulnerability/wordpress-easy-stripe-1-1-remote-code-execution-rce-vulnerability?_s_id=cve
CVE: CVE-2025-49303
Published: 2025-07-04
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Path Traversal.This issue affects Frontend Admin by DynamiApps: from n/a through <= 3.28.7.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: https://patchstack.com/database/Wordpress/Plugin/acf-frontend-form-element/vulnerability/wordpress-frontend-admin-by-dynamiapps-3-28-7-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2025-49414
Published: 2025-07-04
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Gallery fw-gallery allows Using Malicious Files.This issue affects FW Gallery: from n/a through <= 8.0.0.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/fw-gallery/vulnerability/wordpress-fw-gallery-8-0-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-49417
Published: 2025-07-04
Description: Deserialization of Untrusted Data vulnerability in BestWpDeveloper WooCommerce Product Multi-Action Woo-product-multiaction allows Object Injection.This issue affects WooCommerce Product Multi-Action: from n/a through <= 1.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://patchstack.com/database/Wordpress/Plugin/Woo-product-multiaction/vulnerability/wordpress-woocommerce-product-multi-action-1-3-deserialization-of-untrusted-data-vulnerability?_s_id=cve
CVE: CVE-2025-49418
Published: 2025-07-04
Description: Server-Side Request Forgery (SSRF) vulnerability in TeconceTheme Allmart allmart-core allows Server Side Request Forgery.This issue affects Allmart: from n/a through <= 1.0.0.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://patchstack.com/database/Wordpress/Plugin/allmart-core/vulnerability/wordpress-allmart-1-0-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
CVE: CVE-2025-49431
Published: 2025-07-04
Description: Missing Authorization vulnerability in Gnuget MF Plus WPML mf-plus-wpml allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MF Plus WPML: from n/a through <= 1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/mf-plus-wpml/vulnerability/wordpress-mf-plus-wpml-1-1-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-49866
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikel Beautiful Cookie Consent Banner beautiful-and-responsive-cookie-consent allows Reflected XSS.This issue affects Beautiful Cookie Consent Banner: from n/a through <= 4.6.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/beautiful-and-responsive-cookie-consent/vulnerability/wordpress-beautiful-cookie-consent-banner-4-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49867
Published: 2025-07-04
Description: Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes: from n/a through <= 4.4.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-266
References: https://patchstack.com/database/Wordpress/Theme/realhomes/vulnerability/wordpress-realhomes-4-4-0-privilege-escalation-vulnerability?_s_id=cve
CVE: CVE-2025-49870
Published: 2025-07-04
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows SQL Injection.This issue affects Paid Member Subscriptions: from n/a through <= 2.15.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/paid-member-subscriptions/vulnerability/wordpress-paid-member-subscriptions-2-15-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-4414
Published: 2025-07-04
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cmsmasters CMSMasters Content Composer cmsmasters-content-composer allows PHP Local File Inclusion.This issue affects CMSMasters Content Composer: from n/a through < 2.5.7.
CVSS Score: 8.1 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/cmsmasters-content-composer/vulnerability/wordpress-cmsmasters-content-composer-2-5-7-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-50032
Published: 2025-07-04
Description: Missing Authorization vulnerability in Paytiko - Payment Orchestration Platform Paytiko for WooCommerce paytiko allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paytiko for WooCommerce: from n/a through <= 1.3.21.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/paytiko/vulnerability/wordpress-paytiko-for-woocommerce-1-3-13-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-50039
Published: 2025-07-04
Description: Missing Authorization vulnerability in vgwort VG WORT METIS vgw-metis allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VG WORT METIS: from n/a through <= 2.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/vgw-metis/vulnerability/wordpress-vg-wort-metis-2-0-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-52718
Published: 2025-07-04
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Remote Code Inclusion.This issue affects Alone: from n/a through <= 7.8.2.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://patchstack.com/database/Wordpress/Theme/alone/vulnerability/wordpress-alone-7-8-2-arbitrary-code-execution-vulnerability?_s_id=cve
CVE: CVE-2025-52776
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thanhtungtnt Video List Manager video-list-manager allows Stored XSS.This issue affects Video List Manager: from n/a through <= 1.7.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/video-list-manager/vulnerability/wordpress-video-list-manager-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-52796
Published: 2025-07-04
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tggfref WP-Recall allows Reflected XSS. This issue affects WP-Recall: from n/a through 16.26.14.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/wp-recall/vulnerability/wordpress-wp-recall-16-26-14-cross-site-scripting-xss-vulnerability?_s_id=cve