deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-11770
Published: 2025-11-21
Description: The BrightTALK WordPress Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'format' shortcode attribute in the brighttalk-time shortcode in all versions up to, and including, 2.4.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/brighttalk-wp-shortcode/tags/2.4.0/brighttalk-wp-shortcode.php#L130; https://www.wordfence.com/threat-intel/vulnerabilities/id/3e3b5433-e17b-4ece-9e5c-ef4d818068dc?source=cve
CVE: CVE-2025-11771
Published: 2025-11-21
Description: The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'createSaleRecord' function in all versions up to, and including, 2.4.7. This makes it possible for unauthenticated attackers to manipulate presales counters.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://plugins.trac.wordpress.org/browser/tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop/tags/2.4.6/app/RestAPI.php#L275; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3449189%40tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop&new=3449189%40tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/c5c5793f-4d98-4ec1-a9b6-6e7c3f8b6099?source=cve
CVE: CVE-2025-11773
Published: 2025-11-21
Description: The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveDeployedContract' function in all versions up to, and including, 2.4.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the WordPress option `tokenico_deployed_contracts`, poisoning the smart contract addresses displayed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop/tags/2.4.6/app/RestAPI.php#L108; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3449189%40tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop&new=3449189%40tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/e02597b1-eea6-4fdd-baeb-527201d1c61f?source=cve
CVE: CVE-2025-11799
Published: 2025-11-21
Description: The Affiliate AI Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'asin' shortcode attribute in the affiai_img shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/affiliate-ai-lite/tags/1.0.1/includes/afx-img.php#L53; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399153%40affiliate-ai-lite&new=3399153%40affiliate-ai-lite; https://www.wordfence.com/threat-intel/vulnerabilities/id/b05f4ef4-aa64-4cf4-a278-604df8407d12?source=cve
CVE: CVE-2025-11800
Published: 2025-11-21
Description: The Surbma | MiniCRM Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the 'minicrm' shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/surbma-minicrm-shortcode/tags/2.0/surbma-minicrm-shortcode.php#L34; https://www.wordfence.com/threat-intel/vulnerabilities/id/f7509053-fc70-420a-b998-b7158732c147?source=cve
CVE: CVE-2025-11801
Published: 2025-11-21
Description: The AudioTube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' shortcode attribute of the 'audiotube' shortcode in all versions up to, and including, 0.0.3. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/audiotube/tags/0.0.3/index.php#L64; https://www.wordfence.com/threat-intel/vulnerabilities/id/258a2d5d-a176-4b89-bc4c-089d072982dd?source=cve
CVE: CVE-2025-11802
Published: 2025-11-21
Description: The Bulma Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' shortcode attribute in the bulma-notification shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/bulma-shortcodes/tags/1.0/inc/components.php#L36; https://www.wordfence.com/threat-intel/vulnerabilities/id/e119d542-7cac-47e4-ae13-5382911f1f5e?source=cve
CVE: CVE-2025-11815
Published: 2025-11-21
Description: The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the uip_save_site_option() function in all versions up to, and including, 3.5.08. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary plugin settings. Other AJAX actions are also affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-285
References: https://plugins.trac.wordpress.org/browser/uipress-lite/trunk/admin/core/ajax-functions.php#L396; https://plugins.trac.wordpress.org/changeset/3398753/; https://www.wordfence.com/threat-intel/vulnerabilities/id/8f8d7397-0201-4194-8604-057f905ef10b?source=cve
CVE: CVE-2025-11885
Published: 2025-11-21
Description: The EchBay Admin Security plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_ebnonce' parameter in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3398386%40echbay-admin-security&new=3398386%40echbay-admin-security&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/6e7bd966-9a98-4192-83d9-e1682ec00a02?source=cve
CVE: CVE-2025-11985
Published: 2025-11-21
Description: The Realty Portal plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'rp_save_property_settings' function in versions 0.1 to 0.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://cwe.mitre.org/data/definitions/862.html; https://developer.wordpress.org/reference/functions/current_user_can/; https://plugins.trac.wordpress.org/browser/realty-portal/tags/0.1/includes/functions/enqueue.php#L224
CVE: CVE-2025-12086
Published: 2025-11-21
Description: The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the 'wps_rma_cancel_return_request' AJAX endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete other users refund requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3394215%40woo-refund-and-exchange-lite&new=3394215%40woo-refund-and-exchange-lite&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/126e2b92-322e-440c-a924-1b604330f164?source=cve
CVE: CVE-2025-12135
Published: 2025-11-21
Description: The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css_code' parameter in all versions up to, and including, 1.0.6 due to a missing capability check on the save_custome_code() function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://github.com/d0n601/CVE-2025-12135; https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/class.wpb-admin-routes-handler.php#L15; https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/class.wpb-admin-routes.php#L118
CVE: CVE-2025-12138
Published: 2025-11-21
Description: The URL Image Importer plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.0.6. This is due to the plugin relying on a user-controlled Content-Type HTTP header to validate file uploads in the 'uimptr_import_image_from_url()' function which writes the file to the server before performing proper validation. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible via the uploaded PHP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://plugins.trac.wordpress.org/browser/url-image-importer/trunk/url-image-importer.php#L1319; https://plugins.trac.wordpress.org/browser/url-image-importer/trunk/url-image-importer.php#L1353; https://plugins.trac.wordpress.org/browser/url-image-importer/trunk/url-image-importer.php#L1358
CVE: CVE-2025-12170
Published: 2025-11-21
Description: The Checkbox plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_ajax_nopriv_checkbox_clean_log' AJAX endpoint in all versions up to, and including, 2.8.10. This makes it possible for unauthenticated attackers to clear log files.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3392710%40checkbox&new=3392710%40checkbox&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/16735e63-d652-4b0e-b454-2bd13368d8a7?source=cve
CVE: CVE-2025-12660
Published: 2025-11-21
Description: The Padlet Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'key' parameter in the 'wallwisher' shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wallwisher-shortcode/tags/1.3/wallwisher.php#L22; https://wordpress.org/plugins/wallwisher-shortcode/; https://www.wordfence.com/threat-intel/vulnerabilities/id/09989141-43ba-446c-8230-0485add7a1e2?source=cve
CVE: CVE-2025-12661
Published: 2025-11-21
Description: The Pollcaster Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter in the 'pollcaster' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/pollcaster-shortcode/tags/1.0/pollcaster.php#L33; https://wordpress.org/plugins/pollcaster-shortcode/; https://www.wordfence.com/threat-intel/vulnerabilities/id/120ba9e5-9594-4a4f-b475-ef3fcf5f4565?source=cve
CVE: CVE-2025-12746
Published: 2025-11-21
Description: The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/tainacan/tainacan/blob/2491612ee9d5b14baa70862ba2308ee925de0938/src/classes/theme-helper/template-tags.php#L1652; https://plugins.trac.wordpress.org/changeset/3395909/tainacan/trunk/classes/theme-helper/template-tags.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/014dd0ee-0bd0-477c-a0fa-bde8ce5a099c?source=cve
CVE: CVE-2025-12881
Published: 2025-11-21
Description: The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the wps_rma_fetch_order_msgs() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read other user's order messages.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3394215%40woo-refund-and-exchange-lite&new=3394215%40woo-refund-and-exchange-lite&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/9c159237-1a3a-4d42-9a2e-fbd6ca98f38e?source=cve
CVE: CVE-2025-12894
Published: 2025-11-21
Description: The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.17 via the import/export functionality and a lack of .htaccess protection. This makes it possible for unauthenticated attackers to extract sensitive data from exports stored in /exportwp and import data stored in /importwp.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552
References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3394624%40jc-importer&new=3394624%40jc-importer&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/28ca9590-dc0b-40c9-9de6-1480094ea8be?source=cve
CVE: CVE-2025-13134
Published: 2025-11-21
Description: The AuthorSure plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the 'authorsure' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://drive.google.com/file/d/1ZVmQSyjgRxNVGef7Zkzdws8kLraxOt59/view?pli=1; https://www.wordfence.com/threat-intel/vulnerabilities/id/81070529-b269-44b0-8f21-b08add63a099?source=cve
CVE: CVE-2025-13135
Published: 2025-11-21
Description: The HotelRunner Booking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hotelrunner' shortcode in all versions up to, and including, 5.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/hotelrunner/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/df2854c4-5d57-4c39-a28f-41dab36a086e?source=cve
CVE: CVE-2025-13142
Published: 2025-11-21
Description: The Custom Post Type plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the custom post type deletion functionality. This makes it possible for unauthenticated attackers to delete custom post types via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/custom-post-type/tags/1.0/cupta-dmin.php#L29; https://www.wordfence.com/threat-intel/vulnerabilities/id/48fefbd5-d872-4f47-8696-d73fbc9133ed?source=cve
CVE: CVE-2025-13159
Published: 2025-11-21
Description: The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.0.43. This is due to the plugin allowing SVG file uploads via an unauthenticated AJAX endpoint (`flo_form_submit`) without proper file content validation. This makes it possible for unauthenticated attackers to upload malicious SVG files containing JavaScript that executes when an administrator views the uploaded file in the WordPress admin interface, leading to potential full site compromise.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/flo-forms/trunk/admin/class-flo-forms-admin.php#L821; https://plugins.trac.wordpress.org/browser/flo-forms/trunk/includes/class-flo-forms.php#L301; https://plugins.trac.wordpress.org/browser/flo-forms/trunk/public/class-flo-forms-public.php#L502
CVE: CVE-2025-13322
Published: 2025-11-21
Description: The WP AUDIO GALLERY plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 2.0. This is due to the `wpag_uploadaudio_callback()` AJAX handler not properly validating user-supplied file paths in the `audio_upload` parameter before passing them to `unlink()`. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when critical files like wp-config.php are deleted.
CVSS Score: 8.1 (HIGH)
CWE: CWE-73
References: https://plugins.trac.wordpress.org/browser/wp-audio-gallery/tags/2.0/wp-audio-gallery.php#L150; https://plugins.trac.wordpress.org/browser/wp-audio-gallery/tags/2.0/wp-audio-gallery.php#L513; https://plugins.trac.wordpress.org/browser/wp-audio-gallery/tags/2.0/wp-audio-gallery.php#L607
CVE: CVE-2025-11803
Published: 2025-11-21
Description: The WPSite Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'format' shortcode attribute in the wpsite_y shortcode and the 'before' attribute in the wpsite_postauthor shortcode in all versions up to, and including, 1.2. This is due to insufficient input sanitization and output escaping in error messages. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wpsite-shortcode/tags/1.2/shortcodes/wpsite-date.php#L19; https://plugins.trac.wordpress.org/browser/wpsite-shortcode/tags/1.2/shortcodes/wpsite-date.php#L35; https://plugins.trac.wordpress.org/browser/wpsite-shortcode/tags/1.2/shortcodes/wpsite-date.php#L51
CVE: CVE-2025-11808
Published: 2025-11-21
Description: The Shortcode for Google Street View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'streetview' shortcode in all versions up to, and including, 0.5.7. This is due to insufficient input sanitization and output escaping on the 'id' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-google-street-view-shortcode/tags/0.5.7/gsv-shortcode.php#L108; https://www.wordfence.com/threat-intel/vulnerabilities/id/a8a5b5ce-9975-449b-bdd1-d139f1360297?source=cve
CVE: CVE-2025-11826
Published: 2025-11-21
Description: The WP Company Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the 'social-networks' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/wp-company-info/tags/1.9.0/classes/class-wp-company-info-social-links.php#L244; https://www.wordfence.com/threat-intel/vulnerabilities/id/6743a762-6d40-4ed9-95f2-f1b405683f26?source=cve
CVE: CVE-2025-11973
Published: 2025-11-21
Description: The 简数采集器 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.6.3 via the __kds_flag functionality that imports featured images. This makes it possible for authenticated attackers, with Adminstrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-73
References: https://plugins.trac.wordpress.org/browser/gallery-photo-gallery/trunk/includes/lists/class-gallery-photo-gallery-list-table.php#L1060; https://wordpress.org/plugins/keydatas/; https://www.wordfence.com/threat-intel/vulnerabilities/id/66dc2ca2-c61c-4c73-aa2a-0017299cbca5?source=cve
CVE: CVE-2025-12039
Published: 2025-11-21
Description: The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 2.0.5 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for unauthenticated attackers  to retrieve the output of phpinfo().
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/bigbuy-wc-dropshipping-connector/tags/2.0.5/src/Controller/ApiController.php#L225; https://plugins.trac.wordpress.org/browser/bigbuy-wc-dropshipping-connector/tags/2.0.5/src/Controller/ApiController.php#L260; https://www.wordfence.com/threat-intel/vulnerabilities/id/19a3d5a5-4673-41e7-9[PII_REDACTED]2f330?source=cve