deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-49283
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Matthias Nordwig Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant gdpr-compliant-recaptcha-for-all-forms allows Cross Site Request Forgery.This issue affects Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant: from n/a through <= 4.1.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/gdpr-compliant-recaptcha-for-all-forms/vulnerability/wordpress-anti-spam-spam-protection-recaptcha-for-all-forms-and-gdpr-compliant-4-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49284
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Maintenance Mode & Site Under Construction wp-maintenance-mode-site-under-construction allows Cross Site Request Forgery.This issue affects WP Maintenance Mode & Site Under Construction: from n/a through <= 4.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-maintenance-mode-site-under-construction/vulnerability/wordpress-wp-maintenance-mode-site-under-construction-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49285
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Cross Site Request Forgery.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through <= 3.8.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/gdpr-cookie-consent/vulnerability/wordpress-wp-cookie-notice-for-gdpr-ccpa-eprivacy-consent-3-8-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49286
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Table Builder WP Table Builder wp-table-builder allows Cross Site Request Forgery.This issue affects WP Table Builder: from n/a through <= 2.0.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-table-builder/vulnerability/wordpress-wp-table-builder-2-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49287
Published: 2025-06-06
Description: Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed for WooCommerce: from n/a through <= 2.2.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/webtoffee-product-feed/vulnerability/wordpress-product-feed-for-woocommerce-2-2-8-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49288
Published: 2025-06-06
Description: Missing Authorization vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Authentication Bypass.This issue affects Ultimate WP Mail: from n/a through <= 1.3.5.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/ultimate-wp-mail/vulnerability/wordpress-ultimate-wp-mail-1-3-5-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49289
Published: 2025-06-06
Description: Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through <= 5.5.0.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/pdf-for-wpforms/vulnerability/wordpress-pdf-for-wpforms-5-5-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49291
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Cross Site Request Forgery.This issue affects Calculated Fields Form: from n/a through <= 5.3.58.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/calculated-fields-form/vulnerability/wordpress-calculated-fields-form-5-3-58-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49292
Published: 2025-06-06
Description: Improper Validation of Specified Quantity in Input vulnerability in Cozmoslabs Profile Builder profile-builder allows Phishing.This issue affects Profile Builder: from n/a through <= 3.13.8.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1284
References: https://patchstack.com/database/Wordpress/Plugin/profile-builder/vulnerability/wordpress-profile-builder-3-13-8-content-spoofing-vulnerability?_s_id=cve
CVE: CVE-2025-49293
Published: 2025-06-06
Description: Missing Authorization vulnerability in CodeRevolution Crawlomatic Multisite Scraper Post Generator crawlomatic-multipage-scraper-post-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crawlomatic Multisite Scraper Post Generator: from n/a through <= 2.6.8.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/crawlomatic-multipage-scraper-post-generator/vulnerability/wordpress-crawlomatic-multisite-scraper-post-generator-2-6-8-2-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49294
Published: 2025-06-06
Description: Insertion of Sensitive Information Into Sent Data vulnerability in CodeRevolution Crawlomatic Multisite Scraper Post Generator crawlomatic-multipage-scraper-post-generator allows Retrieve Embedded Sensitive Data.This issue affects Crawlomatic Multisite Scraper Post Generator: from n/a through <= 2.6.8.2.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-201
References: https://patchstack.com/database/Wordpress/Plugin/crawlomatic-multipage-scraper-post-generator/vulnerability/wordpress-crawlomatic-multisite-scraper-post-generator-plugin-2-6-8-2-sensitive-data-exposure-via-log-exposure-vulnerability?_s_id=cve
CVE: CVE-2025-49298
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows Stored XSS.This issue affects Event post: from n/a through <= 5.10.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/event-post/vulnerability/wordpress-event-post-5-10-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49299
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPlugged.com WebHotelier webhotelier allows Stored XSS.This issue affects WebHotelier: from n/a through <= 1.9.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/webhotelier/vulnerability/wordpress-webhotelier-1-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49301
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows DOM-Based XSS.This issue affects Greenshift: from n/a through <= 11.5.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/greenshift-animation-and-page-builder-blocks/vulnerability/wordpress-greenshift-11-5-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49304
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeManas Search with Typesense search-with-typesense allows Stored XSS.This issue affects Search with Typesense: from n/a through <= 2.0.10.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/search-with-typesense/vulnerability/wordpress-search-with-typesense-2-0-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49305
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode Product Catalog Simple post-type-x allows Stored XSS.This issue affects Product Catalog Simple: from n/a through <= 1.8.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/post-type-x/vulnerability/wordpress-product-catalog-simple-1-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49306
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through <= 2.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wp-social-widget/vulnerability/wordpress-wp-social-widget-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49307
Published: 2025-06-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magazine3 WP Multilang wp-multilang allows PHP Local File Inclusion.This issue affects WP Multilang: from n/a through <= 2.4.19.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/wp-multilang/vulnerability/wordpress-wp-multilang-2-4-19-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49308
Published: 2025-06-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue affects WP Travel Engine: from n/a through <= 6.5.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/wp-travel-engine/vulnerability/wordpress-wp-travel-engine-6-5-1-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49309
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Team Member ht-team-member allows Stored XSS.This issue affects HT Team Member: from n/a through <= 1.1.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ht-team-member/vulnerability/wordpress-ht-team-member-1-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49310
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Stored XSS.This issue affects Frontend Dashboard: from n/a through <= 2.2.8.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/frontend-dashboard/vulnerability/wordpress-frontend-dashboard-2-2-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49311
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CoolHappy The Events Calendar Countdown Addon countdown-for-the-events-calendar allows Stored XSS.This issue affects The Events Calendar Countdown Addon: from n/a through <= 1.4.9.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/countdown-for-the-events-calendar/vulnerability/wordpress-the-events-calendar-countdown-addon-1-4-9-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49313
Published: 2025-06-06
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme BRW ova-brw allows PHP Local File Inclusion.This issue affects BRW: from n/a through <= 1.8.6.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98
References: https://patchstack.com/database/Wordpress/Plugin/ova-brw/vulnerability/wordpress-brw-1-8-6-local-file-inclusion-vulnerability?_s_id=cve
CVE: CVE-2025-49314
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ovatheme BRW ova-brw allows Stored XSS.This issue affects BRW: from n/a through <= 1.8.6.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/ova-brw/vulnerability/wordpress-brw-1-8-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49315
Published: 2025-06-06
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce-sms allows SQL Injection.This issue affects Persian Woocommerce SMS: from n/a through <= 7.0.10.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/persian-woocommerce-sms/vulnerability/wordpress-persian-woocommerce-sms-7-0-10-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49317
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in NTC WP Page Loading wp-page-loading allows Cross Site Request Forgery.This issue affects WP Page Loading: from n/a through <= 1.0.6.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-page-loading/vulnerability/wordpress-wp-page-loading-1-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49318
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPtouch WPtouch wptouch allows Stored XSS.This issue affects WPtouch: from n/a through <= 4.3.60.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/wptouch/vulnerability/wordpress-wptouch-4-3-60-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49320
Published: 2025-06-06
Description: Missing Authorization vulnerability in fraudlabspro FraudLabs Pro for WooCommerce fraudlabs-pro-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FraudLabs Pro for WooCommerce: from n/a through <= 2.22.11.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/fraudlabs-pro-for-woocommerce/vulnerability/wordpress-fraudlabs-pro-for-woocommerce-2-22-11-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49322
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeedProd 404 Page by SeedProd allows Stored XSS. This issue affects 404 Page by SeedProd: from n/a through n/a.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/wordpress/plugin/404-page/vulnerability/wordpress-404-page-by-seedprod-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49323
Published: 2025-06-06
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.10.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/hydra-booking/vulnerability/wordpress-hydra-booking-1-1-10-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49324
Published: 2025-06-06
Description: Missing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Job Board Manager: from n/a through <= 2.1.60.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/job-board-manager/vulnerability/wordpress-job-board-manager-2-1-60-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49325
Published: 2025-06-06
Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Automattic Newspack Newsletters newspack-newsletters allows Phishing.This issue affects Newspack Newsletters: from n/a through <= 3.13.0.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://patchstack.com/database/Wordpress/Plugin/newspack-newsletters/vulnerability/wordpress-newspack-newsletters-3-13-0-open-redirection-vulnerability?_s_id=cve
CVE: CVE-2025-49326
Published: 2025-06-06
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows SQL Injection.This issue affects GamiPress: from n/a through <= 7.4.5.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/gamipress/vulnerability/wordpress-gamipress-7-4-5-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49327
Published: 2025-06-06
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia ShortLinks Pro shortlinkspro allows SQL Injection.This issue affects ShortLinks Pro: from n/a through <= 1.0.7.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/shortlinkspro/vulnerability/wordpress-shortlinks-pro-1-0-7-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49328
Published: 2025-06-06
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agile Logix Store Locator WordPress agile-store-locator allows SQL Injection.This issue affects Store Locator WordPress: from n/a through <= 1.5.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/agile-store-locator/vulnerability/wordpress-store-locator-wordpress-1-5-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49329
Published: 2025-06-06
Description: Unrestricted Upload of File with Dangerous Type vulnerability in Agile Logix Store Locator WordPress agile-store-locator allows Upload a Web Shell to a Web Server.This issue affects Store Locator WordPress: from n/a through <= 1.5.2.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-434
References: https://patchstack.com/database/Wordpress/Plugin/agile-store-locator/vulnerability/wordpress-store-locator-wordpress-1-5-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE: CVE-2025-49332
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Cross Site Request Forgery.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.30.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-time-slots-booking-form/vulnerability/wordpress-wp-time-slots-booking-form-1-2-30-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49333
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp.insider Simple Membership simple-membership allows Stored XSS.This issue affects Simple Membership: from n/a through <= 4.6.3.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-membership/vulnerability/wordpress-simple-membership-4-6-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49419
Published: 2025-06-06
Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in esigngenie Foxit eSign for WordPress esign-genie-for-wp allows Retrieve Embedded Sensitive Data.This issue affects Foxit eSign for WordPress: from n/a through <= 2.0.3.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-497
References: https://patchstack.com/database/Wordpress/Plugin/esign-genie-for-wp/vulnerability/wordpress-foxit-esign-for-wordpress-2-0-3-other-vulnerability-type-vulnerability?_s_id=cve
CVE: CVE-2025-49421
Published: 2025-06-06
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Andrei Filonov WP Text Expander wp-text-expander allows SQL Injection.This issue affects WP Text Expander: from n/a through <= 1.0.1.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/Wordpress/Plugin/wp-text-expander/vulnerability/wordpress-wp-text-expander-1-0-1-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2025-49425
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Adrian Hanft Konami Easter Egg konami-easter-egg allows Stored XSS.This issue affects Konami Easter Egg: from n/a through <= v0.4.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/konami-easter-egg/vulnerability/wordpress-konami-easter-egg-v0-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49427
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Burnette Abbie Expander abbie-expander allows Stored XSS.This issue affects Abbie Expander: from n/a through <= 1.0.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/abbie-expander/vulnerability/wordpress-abbie-expander-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49429
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Burnette Video Embeds video-embeds allows Stored XSS.This issue affects Video Embeds: from n/a through <= 0.1.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/video-embeds/vulnerability/wordpress-video-embeds-0-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2025-49435
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Hasina77 Wp Easy Allopass wordpress-easy-allopass allows Cross Site Request Forgery.This issue affects Wp Easy Allopass: from n/a through <= 4.1.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wordpress-easy-allopass/vulnerability/wordpress-wp-easy-allopass-4-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49439
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in mariusz88atelierweb Atelier Create CV atelier-create-cv allows Cross Site Request Forgery.This issue affects Atelier Create CV: from n/a through <= 1.1.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/atelier-create-cv/vulnerability/wordpress-atelier-create-cv-plugin-1-1-2-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve
CVE: CVE-2025-49440
Published: 2025-06-06
Description: Cross-Site Request Forgery (CSRF) vulnerability in Vuong Nguyen WP Security Master wp-security-master allows Cross Site Request Forgery.This issue affects WP Security Master: from n/a through <= 1.0.2.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/Wordpress/Plugin/wp-security-master/vulnerability/wordpress-wp-security-master-1-0-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2025-49441
Published: 2025-06-06
Description: Missing Authorization vulnerability in WP Map Plugins Interactive Regional Map of Florida interactive-map-of-florida allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Interactive Regional Map of Florida: from n/a through <= 1.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/interactive-map-of-florida/vulnerability/wordpress-interactive-regional-map-of-florida-1-0-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-49442
Published: 2025-06-06
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mostafa Shahiri Simple Nested Menu simple-nested-menu allows Stored XSS.This issue affects Simple Nested Menu: from n/a through <= 1.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/simple-nested-menu/vulnerability/wordpress-simple-nested-menu-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve